Privacy policy

Who is responsible for your data

Your school decides which students, teachers and parents are added to Smart School and what the data is used for. For that data, the school is the data controller and we process it on the school's behalf.

For data we collect directly, such as a parent account or payment records, Smart School is the data controller.

What we collect

We only collect what is needed to run exams, show results and take payment.

• Account details: name, email address or phone number, role and password (stored only as a secure hash).
• School details: school name, classes, subjects and the staff and students the school adds.
• Student records: admission number, class, exam answers, scores and released results.
• Parent links: which parent is linked to which student.
• Payment records: amount, date, reference and status. Card and mobile money details are handled by our payment providers and never stored by us.
• Security logs: sign in times, failed sign in attempts and IP addresses, used to protect accounts.

What we do not collect

• We do not use advertising, analytics or tracking tools.
• We do not sell or rent personal data to anyone.
• We do not ask students for data the school has not requested.

Why we use it

• To create and secure accounts.
• To deliver, time and mark exams.
• To show results to the student, their teachers, the school admin and linked parents.
• To send SMS or email notices, such as verification codes and results being released.
• To process payments and keep receipts.
• To find and stop misuse of the service.

Who can see it

Inside a school, access follows each person's role. A parent only sees students they are linked to. A student only sees their own results. Results stay hidden until a teacher releases them.

We share data with a small number of service providers who help us run Smart School: hosting and file storage, email and SMS delivery, and the payment providers Selcom and AzamPay. They may only use the data to provide their service to us.

We will disclose data to authorities only when the law requires it.

Children's data

Many students are under 18. Student accounts are created by the school, and the school is responsible for having the right to add them. We use student data only for schoolwork and results, never for marketing.

How long we keep it

We keep exam records and results while the school's account is active, so students and parents can see progress over the years. When a school closes its account, we delete or anonymise its data within 90 days, except payment records we must keep by law.

How we protect it

• All traffic is encrypted with HTTPS.
• Passwords are hashed and never stored in plain text.
• Sign in attempts are rate limited and admin accounts use two step verification.
• Access to data is checked on every request, by role and by school.

Your rights

You can ask to see the personal data we hold about you, correct it, or have it deleted where we are not required to keep it. Students and staff should usually contact their school first, since the school manages their records. Parents can contact us directly about their own account.

Contact

Questions about this document can be sent to info@smartschools.tz.