DRAFT FOR BUSINESS AND LEGAL REVIEW
Privacy
LEGAL REVIEW REQUIRED. This working draft is not legal advice or a final professionally reviewed policy.
Purpose and school responsibilities
Paideia provides customized digital school portals. Schools decide which educational records to enter, keep them accurate and authorize their users. Paideia operates the platform and enforces its implemented access controls. Formal data protection roles and any processing agreement are LEGAL REVIEW REQUIRED; this draft does not declare either party a controller or processor.
Information used by the portal
Records include student names, admission identifiers, optional student email, enrollment, guardian contacts and profile image references; parent accounts and child links; and staff accounts, contacts, employment details and teaching assignments. Academic records include attendance, scores, results, report remarks, school report ratings and assessment activity. Schools may collect sensitive optional demographic information for administrative purposes; it is not required for core portal functionality and access is restricted.
Accounts, payments and enquiries
Account and authentication information supports sign-in and security. Payment orders, amounts, references and receipts support subscriptions, school fees and reconciliation. Uploaded school branding and assessment images support portal use. Demo submissions include school and contact details, population, location and the message supplied, so Paideia can respond to an enquiry. Platform security and diagnostic records support service operations.
Who can access records
School and role controls restrict access. Parents need an explicit link to a child for protected child records; students access their own protected information. Authorized school administrators manage school data, and platform administrators have operational access under platform permissions. Public school lookup supplies only the information needed to reach the school portal. Existing result checking requires admission details and scratch-card credentials.
Service providers and uploaded media
Railway supports backend/database hosting, Vercel frontend hosting, Paystack online payments and Cloudinary configured image storage. Configured messaging services support email and SMS delivery. These services receive information needed for their functions. Image URLs are not a secure document vault: do not upload confidential documents through public image facilities. Provider arrangements, data locations and any transfer requirements are LEGAL REVIEW REQUIRED.
Retention, suspension and requests
Suspension restricts normal school access while preserving records; it does not immediately delete school data. Retention periods, deletion/anonymization and backup handling remain LEGAL REVIEW REQUIRED and BUSINESS DECISION REQUIRED. No retention period or deletion deadline is promised. The school administrator is the first contact for corrections to school records and account access. Contact and request procedures must be finalized before this draft becomes a final policy.
Security and review status
The platform uses implemented authentication, tenant and role controls. These controls are not a guarantee against every incident. Schools and users should protect credentials and report suspected misuse through their agreed support channel. Legal obligations for children's data, sensitive information, requests and incident notification require professional review. This draft makes no compliance certification or legal approval claim.
Contact
Use your school administrator for school records and account matters. For a general Paideia enquiry, visit Contact or use the existing enquiry form. Official support and privacy-request channels still require confirmation. Do not submit passwords, payment credentials or detailed student records through that form.