Privacy Policy

1. What information we hold

Information about the account holder: name, mobile number, email (if given), a password (we keep only a scrambled form of it, never the password itself), the school they belong to and their role, and when they agreed to our Terms and this policy.

Information the school puts into the system, such as:

• students: name, date of birth, gender, admission and class details, address, previous school, and the reason they left;
• parents and guardians: name, relationship, phone numbers and email;
• teachers and staff: name, phone, email, job, qualification, joining date, classes taught, attendance, leave and salary records;
• school work: attendance, exam marks and results, fee vouchers, payments, dues, notices and messages, question papers, certificates and letters.

Some schools also enter identity numbers (for example a B-form or CNIC number). The school should enter only what it needs.

Payment information for our subscription: the amount, the payment method (EasyPaisa, JazzCash or bank transfer), the reference number, and the photo or PDF of the payment proof if you send one. We never ask for card numbers.

Technical information: the time of sign-in, the internet address (IP address) and browser type, and a record of important changes made in the system (who changed what and when). This helps us keep the system safe and settle disputes.

2. Why we use it

To run the service the school asked for: to let people sign in, to show each person only what their job allows, to print vouchers, certificates and reports, and to send notices.

To keep the system safe: to stop misuse, to find and fix problems, and to prove who did what.

To look after subscriptions: to check payments, send bills and reminders, and give support.

To improve the system, using counts and patterns (for example how many schools use a feature) rather than looking at a school’s private records.

We do not sell information. We do not show advertisements. We do not use students’ information for marketing.

3. Who else can see it

Inside a school: only the people the school has given access to, and only what their role allows. The owner of the school decides what each role can do. A teacher sees only the classes and subjects they are given. A parent sees only their own children.

Between schools: nothing. Each school’s information is kept apart from every other school’s, and we test this automatically every time the system changes.

Companies that help us run the service (they may only use the information for that): the company that hosts our server, Amazon (Amazon S3, which stores the files that schools upload), Cloudflare (which protects and speeds up the website), Vercel (which delivers the website pages), our email delivery service that sends notices and reminders, and our AI provider when the AI features are used (see section 6).

When the law requires it, or to protect people from serious harm, we may have to give information to the authorities. We will try to tell the school first unless we are not allowed to.

If our business is ever sold or merged, the information moves with the service and this policy continues to apply.

4. Children’s information

Most of the information in the system is about children. It belongs to the school and the child’s family, not to us. We use it only to provide the service the school asked for. We do not build advertising profiles, and we do not let anyone outside the school see it.

The school is responsible for having the right to enter a child’s information (for example, that parents know the school keeps records). Parents who have questions about their child’s information should ask the school first.

5. Where the information is kept

The information is kept on a server that we rent and control, behind Cloudflare. The website pages are delivered by Vercel. Files that schools upload, such as scans and photos of documents, are stored safely on Amazon S3 bucket servers, in a private space for each school. These companies may handle information in other countries. Our AI provider stores and processes the data it receives in China (see section 6). We choose providers carefully and use them only to run the service.

6. AI features

Some parts of the service use an artificial-intelligence provider to answer questions and prepare drafts (for example the school assistant, the teacher helper, and the parents’ question service). When you use these features, the text you type and the information needed to answer it (such as names, classes, attendance and fee amounts you are allowed to see) are sent to our AI provider, DeepSeek, to produce the answer. We never send phone numbers, CNIC or B-Form numbers, addresses, email addresses or dates of birth.

The provider stores and processes data in China. We do not control its retention or training practices beyond the requests we make to it; its own policy applies to the data it receives. The AI can only use information the signed-in person is already permitted to see. It cannot change records: any action it prepares happens only after a person confirms it.

Schools can switch these features off for any role, and parents can choose not to use the parents’ question service. To ask about your data or object, contact the school.

7. How long we keep it

While a school has an account, the school’s records stay in the system. The system deliberately keeps a history of business records (fees, attendance, results) instead of erasing them, so mistakes can be traced.

If a school closes its account, we keep the records for a reasonable period so the school can take its lists out and so we can meet legal, accounting and dispute needs. After that we delete or anonymise them. Ask us if you need it sooner.

8. Your choices and rights

You can ask to see the information we hold about you, to correct it, to take a copy, or to have it deleted or restricted. You can also object to a use you do not agree with.

For information about a student or a teacher that a school entered, please ask the school first: it can look at, correct and export its own records (Excel) at any time. If the school cannot help, or the information is about you as an account holder, contact us and we will answer within a reasonable time, normally within 30 days.

You can change your own name, email, phone and password in the system under Settings → My account.

9. Cookies

We use only the small files needed to keep you signed in and remember your screen. We use no advertising or tracking cookies. Details are in the Cookie Policy.

10. Keeping information safe

We use strong protections: passwords are stored scrambled, connections are encrypted, each school’s information is separated, access follows roles, and important actions are recorded. No system is perfectly safe, so please also protect your own login. Read more on the Security & Data Protection page. If we learn of a breach that affects you, we will tell the school and, where required, the authorities.

11. Changes to this policy

When we change this policy in a way that matters, we will show the new date at the top and tell schools. Using the service after a change means you accept the new policy.

12. Contact

Questions, requests or complaints about privacy: use the contact page of BrightCodeX (https://brightcodex.com/).