Privacy Policy

We collect only what the platform needs to do its job:

• Account and identity. Your name, email address, and role (for example teacher, administrator, student, or parent), so we can sign you in and show you the right information.
• School and student records. The academic data your school manages in Eduin — attendance, marks and assessments, timetables, enrolment, discipline records, and related notes. Some of this concerns minors and is entered and controlled by the school.
• Photos you choose to add. When you attach a student photo or evidence to an incident report, the image you capture or select is uploaded to Eduin. The app resizes images on your device before upload. The app does not scan or continuously access your photo library — it only receives the specific image you pick.
• Device and notification data. A random installation identifier for the device and, if you allow notifications, a push notification token. These let us send a device reminders (for example, a missing roll call) and let you sign a device out of notifications.
• Diagnostics and crash reports. If the app crashes or errors, we collect a technical report (device model, OS version, app version, and a stack trace). These reports are configured to exclude names, emails, student numbers, and message contents; they carry only an internal user identifier and role so we can trace the fault.

We do not collect your device's GPS or precise location, your contacts, your calendar, audio recordings, or advertising identifiers. The app contains no third-party advertising.

Biometrics stay on your device. If you enable fingerprint or face unlock, that check is performed by your device's own operating system. Eduin never receives, stores, or transmits your biometric data.

• To provide the platform's features and keep your account secure.
• To send operational notifications you have opted into (reminders and alerts).
• To diagnose crashes and improve reliability and performance.
• To meet the school's record-keeping and reporting needs.

We do not sell personal data, and we do not use it for advertising or to build advertising profiles.

Eduin is used by schools and is not directed to children for independent sign-up. Records about students, including minors, are entered and controlled by the school as part of its legitimate educational function. The school is responsible for obtaining any consent required from parents or guardians under applicable law. Eduin acts as the school's processor for this data and applies the protections described in this policy. A parent or guardian who wishes to review, correct, or delete a child's record should contact the child's school, which can act on the request within Eduin.

We share personal data only with service providers that operate the platform on our behalf, under contract, and only as needed to deliver the service:

• Cloud hosting and database infrastructure.
• Content delivery for uploaded images.
• Push notification delivery (Expo).
• Crash and error reporting (Sentry).
• Messaging delivery where a school has enabled it (for example WhatsApp).

We may also disclose data where required by law, or to protect the rights, safety, and security of users and the platform. We do not sell personal data to third parties.

We keep personal data for as long as the school's account is active and as needed to provide the service and meet legal and academic record-keeping obligations. When a school closes its account, its data is deleted or anonymised within a reasonable period, except where longer retention is required by law. Crash reports are retained on a rolling basis for a limited period.

Data is encrypted in transit. Access is restricted by role and permission, so a user sees only the records their role allows. On mobile, credentials are held in the device's secure storage and can be protected by device unlock. No system is perfectly secure, but we take reasonable technical and organisational measures to protect personal data.

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. Because schools control the records they enter, requests about student or staff records are usually best directed to your school, which can act on them in Eduin. You may also contact us using the details below and we will assist or route your request appropriately.

Eduin serves schools across several countries and may process and store data on servers located outside your country. Where we transfer personal data across borders, we take steps to ensure it remains protected consistent with this policy and applicable law, including Uganda's Data Protection and Privacy Act, 2019.

The Eduin mobile app requests the following device permissions, each only when needed:

• Camera and photos — to capture or attach a student photo or evidence for an incident report.
• Notifications — to send you reminders and alerts you opt into.
• Biometric unlock — to protect the app with your device's fingerprint or face unlock (performed on-device only).

You can change or revoke these permissions at any time in your device settings.

We may update this policy from time to time. We will revise the effective date above and, for significant changes, provide notice through the app or the platform.

For privacy questions or to exercise your rights, contact us at [email protected].