EduLink
EduLink Trust & Privacy Center

Privacy Policy

Transparent, multi-tenant educational data protection designed for schools, educators, parents, and students.

Effective Date: September 9, 2026
Last Updated: September 9, 2026
Version: 4.0.0
Dedicated Cards: 59 Policy Cards

Privacy at a Glance

Multi-Tenant Isolation

Every school operates as an independent tenant. School data is logically partitioned and strictly access-isolated.

End-to-End Chat E2EE

Direct chat communications use Web Crypto ECDH P-256 and AES-GCM 256. Private keys are never stored on our servers.

Strict Child Privacy

Student records are controlled by authorized schools. Never sold, never indexed publicly, never tracked for ads.

No Invasive Trackers

We rely strictly on essential session cookies and privacy-friendly telemetry. No cross-site advertising trackers.

Card #01General & Scope
Introduction

Welcome to EduLink School Management System (“EduLink”, “we”, “us”, or “our”). EduLink is an integrated, multi-tenant digital educational management platform engineered to streamline administrative, academic, financial, communication, and learning workflows for educational institutions worldwide.

We recognize the paramount importance of privacy, data protection, and confidentiality in educational settings. This Privacy Policy sets forth our commitments and practices regarding the collection, handling, storage, security, and disclosure of personal data belonging to schools, administrators, teachers, parents, students, staff, and visitors.

Core Principle: EduLink processes institutional and student data strictly to deliver platform services on behalf of authorized schools. We do not sell personal data, monetize student profiles, or run behavioral advertising.
Platform foundational privacy commitments for schools, educators, parents, and students.
Card #02General & Scope
Who We Are

EduLink Systems provides the technological infrastructure powering EduLink. We operate as the platform provider and technical data processor for tenant educational institutions.

  • Headquarters & Operations: "D-21 Wilberforce Barracks",
  • Official Support Portal: Contact Support Desk
  • Telephone Assistance: "+232 32-041-615",
Identity of EduLink Systems as platform provider and technical data processor.
Card #03General & Scope
Scope of This Privacy Policy

This Privacy Policy encompasses all web applications, administrative dashboards, communication portals, and services operated under the EduLink ecosystem.

School Administrators: Campus infrastructure & user control.
Educators & Teachers: Grading, assignments, attendance.
Parents & Guardians: Student academic progress & fee tracking.
Enrolled Students: Timetables, exam results, and study tools.
Governing framework for administrative dashboards, portals, mobile apps, and public pages.
Card #04Data We Collect
Information We Collect

The types of information collected depend on your role, institutional permissions, and how you interact with EduLink. We collect information through three primary channels:

  1. Direct Input: Information submitted directly during onboarding, enrolment, or profile management.
  2. Academic Activity: Evaluations, attendance logs, timetables, and fee payment receipts.
  3. Essential Diagnostics: Secure session cookies and access audit telemetry to safeguard the platform.
Overview of information categories processed via direct input, usage activity, and diagnostics.
Card #05Data We Collect
Account Information

When user accounts are provisioned by an institution or created directly, the system records:

  • Full legal name, professional title, and authorized email address
  • Cryptographically hashed credentials (plain-text passwords are never stored)
  • Assigned institutional role (Administrator, Teacher, Parent, Student, or Support Staff)
  • Associated school membership and account status flags
Credentials, authentication identifiers, and role profiles.
Card #06Data We Collect
School and Organization Information

During tenant registration and institutional profile configuration, we process:

  • Official school name, registration code, accreditation details, and crest/logo
  • Physical campus address, contact email, and administrative contact lines
  • Academic calendar schedules, terms, semesters, and holiday dates
  • Departments, classes, streams, and subject curricula
Institutional identity, campus profiles, departments, curricula, and term calendars.
Card #07Data We Collect
Student Information

Student information is maintained on behalf of the enrolling school:

  • Student legal name, gender, date of birth, and nationality
  • Official Student Identification Number and Roll Number
  • Assigned Class, Stream, and academic year
  • Emergency medical notations provided by the school (such as blood group or emergency contact info)
  • Linked guardian relationship identifiers
Student records entered and managed on behalf of enrolling educational institutions.
Card #08Data We Collect
Parent/Guardian Information

To support parent-school communication and legal oversight, EduLink processes:

  • Guardian legal name and relationship to student
  • Contact phone number, communication channel, and residential address
  • Notification preferences for attendance and grade updates
  • Linked student profiles under the guardian's legal responsibility
Family contacts, communication preferences, and custody linkage.
Card #09Data We Collect
Teacher and Staff Information

For educational staff and school administrators, records include:

  • Staff employee ID, professional title, academic qualifications, and teaching experience
  • Department assignment, primary subjects taught, and assigned classes
  • Work schedule, timetable allocations, and institutional appointment records
Instructional appointments, subject assignments, timetables, and staff directory records.
Card #10Data We Collect
Academic Information

Academic information consists of subject enrollments, syllabus structures, lesson materials, academic terms, and curricular department mappings managed within the tenant's educational portal.

Curricula, subject enrollments, lesson resources, and departmental structures.
Card #11Data We Collect
Attendance Information

EduLink captures student and staff attendance records entered by authorized teachers or administrators. These entries include date, class, attendance status (e.g., Present, Absent, Late, Excused), and optional reason notes recorded for school records.

Daily roll calls, period attendance, excuses, and absence notes.
Card #12Data We Collect
Examination and Assessment Information

Assessment data includes exam papers, marking schemes, continuous assessment scores, term exam scores, grade assignments, academic remarks, and generated student report cards. Access is strictly scoped to authorized educators, students, and their verified guardians.

Continuous assessments, exam papers, grades, remarks, and student report cards.
Card #13Data We Collect
Financial Information

EduLink facilitates school tuition and subscription fee tracking:

  • School Fees: Fee schedules, fee item categories, student payment receipts, and payment reference numbers.
  • Card Safety: EduLink does not store full debit/credit card numbers or CVV codes. Online subscription payments are securely handled by PCI-compliant payment gateways.
Tuition structures, fee categories, payment receipts, and bank deposit confirmations.
Card #14Data We Collect
Payroll/HR Information

Where an educational institution elects to record compensation or departmental budgeting within EduLink, basic salary brackets and departmental budget totals may be recorded. These fields are exclusively visible to designated school financial administrators.

Compensation brackets and departmental budgets for authorized institutional admins.
Card #15Data We Collect
Communication and Messaging Data

EduLink offers integrated communication tools between staff, parents, and students:

End-to-End Encrypted (E2EE) Direct Chat

Direct one-to-one messages are encrypted on your local device using standard Web Crypto SubtleCrypto (ECDH P-256 key exchange and AES-GCM 256-bit encryption) before transmission. Messages can only be decrypted by the intended recipient.

End-to-End Encrypted (E2EE) direct messaging and institutional broadcast announcements.
Card #16Data We Collect
Notifications and Push Notifications

Users may elect to receive operational alerts (such as grade publications, attendance updates, or fee notices).

For browser push notifications via our service worker, we register the browser's push endpoint and device authentication tokens under the standard Web Push protocol. You may disable push notifications at any time via your browser settings.

Operational alerts for grades, notices, and optional browser Web Push messaging.
Card #17Data We Collect
Documents and File Uploads

Users can upload coursework assignments, syllabus files, and profile imagery:

  • File uploads are routed through secure, token-authenticated storage infrastructure.
  • Uploads are restricted by size limits and allowed file format restrictions.
  • Upload operations require verified user session authorization.
Secure storage of coursework files, syllabus documents, and profile photos.
Card #18Data We Collect
Device and Technical Information

When connecting to the EduLink platform, standard network metadata is processed, including browser family and version, operating system, preferred language, screen resolution, and connection timestamp to ensure correct layout rendering.

Browser family, operating system, and responsive viewport telemetry.
Card #19Data We Collect
IP Addresses and Security Logs

For audit accountability and attack mitigation, EduLink maintains server-side login activity logs (visible to authorized institutional administrators), capturing user identifier, IP address, user-agent, outcome (successful or failed attempt), and timestamp.

Audit trails capturing login outcomes, IP addresses, and anomaly mitigation data.
Card #20Data We Collect
Cookies and Local Storage

EduLink utilizes essential cookies and browser storage strictly to preserve application session state, enforce security boundaries, and maintain user preferences.

CategoryTypeLifespanPurpose
Session AuthenticationSecure HTTP Cookie24 HoursMaintains user session with Strict security flags
Session RenewalSecure HTTP Cookie30 DaysAllows automated session renewal for active users
Tenant & Profile ContextSecure HTTP CookieSessionMaintains active school workspace context
Chat Encryption KeysLocal Device StoragePersistentClient-side keys for end-to-end messaging
Visual ThemeLocal Device StoragePersistentSaves preference for Light or Dark display
Essential first-party cookies and local storage tokens powering session state and preferences.
Card #21Multi-Tenancy & Usage
How We Use Information

Personal and institutional data is processed exclusively to:

  • Provide educational and school management services.
  • Calculate and format assessment scores and report cards.
  • Maintain student daily and period attendance records.
  • Facilitate authorized teacher, parent, and student communication.
Operational utilization strictly bounded to school administration and learning services.
Card #23Multi-Tenancy & Usage
How Schools Control Their Data

In our multi-tenant model, the educational institution operates as the principal data controller of its records, controlling account provisioning, academic roles, report card publications, and fee rules.

Schools as primary data controllers determining user roles, records, and publications.
Card #24Multi-Tenancy & Usage
Multi-Tenant Data Isolation
Logical Tenant Isolation

Every academic entity is bound to an isolated institutional organization ID. Server actions strictly enforce tenant boundaries: users in School A cannot view, query, or mutate data in School B.

Cryptographic and logical boundaries ensuring complete data separation between schools.
Card #25Security & Cryptography
Data Security

EduLink implements defense-in-depth technical, physical, and administrative measures to protect educational data against accidental loss, unauthorized access, and malicious modification.

Defense-in-depth security architecture safeguarding records against unauthorized access.
Card #26Security & Cryptography
Encryption
Data in Transit

All data transferred between client and servers is secured over modern TLS (HTTPS & WSS).

Chat E2EE

Direct chat messaging utilizes ECDH P-256 key agreement with AES-GCM 256-bit encryption.

End-to-end chat encryption and modern TLS transit encryption.
Card #27Security & Cryptography
Authentication and Access Control

Authentication is governed by tokenized sessions delivered over secure, HTTP-only cookies with strict SameSite protection. Passwords are subjected to modern one-way cryptographic hashing before persistence. Password reset operations require cryptographically signed tokens.

Cryptographic password hashing, secure tokenized sessions, and signed recovery links.
Card #28Security & Cryptography
Role-Based Access Control (RBAC)
  • SUPER_ADMIN: Platform-wide operations, school onboarding, system subscriptions.
  • ADMIN: School-wide administration, user provisioning, academic and financial oversight.
  • TEACHER: Class-specific grading, attendance entry, assignment management, student notices.
  • PARENT: Visibility into linked dependent children's results, attendance, and fees.
  • STUDENT: Personal timetable, own assessment scores, submissions, learning materials.
  • SECRETARY: Administrative support workflows based on customized institutional permissions.
Granular authorization matrix defining capabilities across administrators, teachers, parents, and students.
Card #29Security & Cryptography
Audit Logs

To maintain accountability, authentication attempts are preserved in the system login log (capturing user identifier, status, IP address, and timestamp) for authorized school administrator review.

Historical accountability logs tracking administrative and access events.
Card #30Retention & Lifecycle
Data Retention

We retain personal information for as long as reasonably necessary to provide the services, comply with statutory educational record obligations, resolve disputes, and maintain security.

Retention schedules balanced between educational continuity and regulatory compliance.
Card #31Retention & Lifecycle
Data Deletion

Upon written request by an authorized educational institution or verified account holder (subject to the institution's regulatory obligations), personal data will be deleted or irreversibly anonymized from operational databases.

Procedures for account purge and irreversible anonymization upon authorized school request.
Card #32Retention & Lifecycle
Account Closure

When a school subscription concludes or an individual account is terminated, access permissions are revoked. Institutional data may be archived for an export grace period before permanent purge.

Revocation protocols, data export grace periods, and decommissioning.
Card #33Student & Child Privacy
Student and Child Data
Student Data Safeguards

Student records are never indexed publicly, never tracked for advertisements, and are accessible only by authorized staff and verified guardians.

Strict protections preventing public indexing or commercial profiling of student records.
Card #34Student & Child Privacy
Parents and Guardians

Parents and legal guardians receive portal access to view their dependent children's records in accordance with the school's configuration and authorization rules, including term reports, attendance, and fee status.

Transparent portal access for parents to review their children's progress.
Card #35Third-Party Processors
Third-Party Services

To maintain high platform availability, secure file distribution, and payment processing, EduLink integrates with reputable third-party infrastructure providers operating under strict data processing standards.

Vetted infrastructure vendors bound by contractual confidentiality and privacy commitments.
Card #36Third-Party Processors
Email & Transactional Delivery

Transactional emails (such as password reset notices and administrative alerts) are dispatched via secure transactional email gateways solely to ensure reliable receipt of essential platform notifications.

Transactional delivery gateways dispatching password recovery and operational notices.
Card #37Third-Party Processors
Cloud Storage Providers

EduLink utilizes secure cloud storage infrastructure (such as UploadThing and Cloudinary) for encrypted document storage and optimized school logo delivery, strictly requiring token verification for uploads.

Authenticated file storage infrastructure for academic assignments and media assets.
Card #38Third-Party Processors
Payment Providers (Monime)

EduLink integrates with Monime for school subscription processing. Users are securely redirected to Monime's PCI-DSS compliant checkout. EduLink receives confirmation status callbacks without storing raw payment card numbers.

PCI-compliant payment gateways handling school subscriptions without card storage.
Card #39Third-Party Processors
Hosting and Infrastructure

The EduLink platform applications and API services are hosted in enterprise data centers providing high availability, automated backup redundancy, DDoS mitigation, and firewall isolation.

Enterprise data center facilities providing automated backups, firewalls, and redundancy.
Card #40Third-Party Processors
Analytics Providers (Vercel Analytics)

We utilize Vercel Analytics to monitor platform web performance and page load reliability. Vercel Analytics is privacy-friendly and does not track users across the internet or build advertising profiles.

Privacy-focused telemetry monitoring web performance without advertising cookies.
Card #41Third-Party Processors
Push Notification Infrastructure

Browser Web Push messages are relayed using standard Web Push protocols (operating through user-agent browser notification gateways) under our registered cryptographic keys.

Web Push notification protocols delivering opt-in alerts to modern browsers.
Card #42Third-Party Processors
International Data Transfers

Where data is routed across borders to reach global cloud infrastructure or content distribution networks, we ensure appropriate data transfer safeguards and encryption standards are maintained.

Contractual safeguards ensuring consistent protection when data is routed globally.
Card #43Third-Party Processors
Data Sharing

EduLink does not sell, rent, lease, or trade personal data to third parties. Data sharing is limited to institutional requirements authorized by the school or vetted technical infrastructure processors.

Strict prohibition against selling personal data or sharing with marketing brokers.
Card #44Third-Party Processors
When Information May Be Disclosed

Information may only be disclosed under limited circumstances: with explicit institutional authorization, to trusted technical processors, in response to lawful judicial orders, or to protect physical safety.

Limited emergency, judicial, or school-authorized scenarios permitting disclosure.
Card #46Third-Party Processors
Fraud and Security Investigations

We reserve the right to review technical logs and account activity when investigating cybersecurity incidents, unauthorized intrusion attempts, automated abuse, or fraudulent payment actions.

Audit log inspections utilized to investigate security threats or automated attacks.
Card #47User Rights & Compliance
User Rights Overview

Depending on your location and applicable data protection legislation, you may hold specific rights concerning access, correction, deletion, restriction, and portability of your personal information.

Comprehensive framework of data subject rights under applicable data protection laws.
Card #48User Rights & Compliance
Access Requests

Users have the right to request confirmation of whether their personal data is being processed, and to obtain a readable copy. Because institutional student records are managed by the school, student access requests are coordinated with school administration.

Procedures for inspecting and obtaining copies of processed personal records.
Card #49User Rights & Compliance
Correction Requests

If your profile or contact details are inaccurate or incomplete, you can update them directly within your portal profile settings or request an update through your school's administrative office.

Mechanisms to rectify inaccurate profile, student, or guardian details.
Card #50User Rights & Compliance
Deletion Requests

You may request the deletion of your personal account data where processing is no longer necessary for educational purposes or legally required record retention.

Submitting erasure requests where data is no longer necessary for educational delivery.
Card #51User Rights & Compliance
Data Portability

Where technically feasible, users or schools may request export copies of their academic spreadsheets, fee records, and report cards in standard electronic formats (such as Excel or PDF).

Exporting academic records and report cards in standard electronic formats.
Card #52User Rights & Compliance
Restriction and Objection

Under applicable statutory conditions, you may have the right to restrict or object to certain non-essential processing activities.

Statutory rights to object to or restrict non-essential data processing.
Card #54Governance & Contact
School Administrator Responsibilities

Institutional administrators are responsible for:

  • Ensuring lawful authority to enter staff, guardian, and student data into EduLink
  • Maintaining confidentiality of administrative credentials
  • Promptly revoking access for departing staff members
  • Accurately reviewing grades, fee records, and report cards prior to publication
Administrative obligations for lawful onboarding, permission control, and credential safety.
Card #55Governance & Contact
Platform Responsibilities

EduLink commits to:

  • Maintaining rigorous multi-tenant data isolation and security controls
  • Ensuring high uptime, database redundancy, and system availability
  • Providing responsive technical support to institutional administrators
  • Promptly patching vulnerabilities and adhering to data protection standards
EduLink commitments to uptime, tenant isolation, technical security, and support.
Card #56Governance & Contact
Children's Privacy Protection

Protecting young learners is a core duty. EduLink operates as a closed school platform where student accounts are established exclusively by authorized educational institutions or verified guardians. We do not provide social feeds, public chatrooms, or behavioral advertising to children.

Dedicated safeguards ensuring a closed, safe educational environment for minors.
Card #57Governance & Contact
Cookies Policy Summary

EduLink relies strictly on first-party operational cookies essential for session authentication, tenant isolation, and interface preferences. We do not deploy third-party advertising cookies or cross-site tracking pixels.

Strict reliance on essential functional cookies with no third-party tracking pixels.
Card #58Governance & Contact
Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect technological updates, product enhancements, or statutory changes. When updates are published, the “Last Updated” date at the top of this document will be modified.

Notification mechanisms for material updates and version tracking.
Card #59Governance & Contact
Contact Information

If you have questions, privacy inquiries, or data subject requests regarding this policy or our privacy practices, please contact our privacy office:

Support Portal
EduLink Contact Portal
Call Us
"+232 32-041-615",
Office Address
"D-21 Wilberforce Barracks",
Official support desk, privacy office email, and institutional physical address.

Have privacy or data questions?

Our Data Protection and Governance team is available to assist schools, guardians, and staff.

Contact Support