1. Who We Are
This portal is developed and operated by ScholarMatrix ERP Digital Solution (CAC BN 9637404), based in Nigeria. We provide school management software (the “Portal”) to educational institutions (Subscribers). For questions regarding this policy, contact us at:
📧 Email: admin@scholarmatrix.com.ng
📞 Phone: Available on request via email
📍 Address: Kano, Nigeria
2. What Data We Collect
The Portal collects and processes the following categories of personal data on behalf of Subscriber schools:
👨🎓 Students: Full name, Arabic name (optional), class, date of birth, passport photo (optional), fee records, exam scores, attendance records.
👨👩👧 Parents/Guardians: Full name, phone number, password (hashed), children linked, fee payment communications.
👨🏫 Staff: Full name, role, phone number, passport photo, password (hashed), attendance records, salary/deduction data, and — where the school enables face-verified attendance — a biometric face template (a 128-number mathematical descriptor derived from the face; see Section 4.1). The template is not a photograph and cannot be reversed into one.
🏫 School Administrators: School name, address, bank details (for display to parents), admin password (hashed), Firebase configuration, SMS API keys.
3. How We Use the Data
All data collected is used solely for the following purposes:
- Managing student enrolment, fees, attendance and academic results
- Enabling parent access to their children’s records
- Processing staff attendance, payroll and deductions
- Sending fee reminders and school communications via SMS (Termii)
- Generating report cards and academic transcripts
- Providing system administration and technical support
We do not sell, rent, share or use personal data for advertising, marketing to third parties, or any purpose beyond operating the Portal.
4. Data Storage & Security
📱 On your device: The Portal works local-first — your school’s working data lives in the browser on your own devices, so day-to-day use works even with poor internet.
☁️ Cloud backup & sync (Google Firebase): School data is synchronised to Google Firebase Firestore — a secure, access-controlled, encrypted cloud database — so records survive a lost or damaged device and stay consistent across the school’s devices. Access is restricted by security rules to authenticated members of your school only: knowing a school code alone grants no access. Google’s data centres are ISO 27001 certified; see firebase.google.com/support/privacy.
🖥️ Server-side processing (Netlify Functions): Logins, registrations, exam submissions, payment verification and receipt QR-verification are validated by our serverless functions rather than trusted from a device. These functions process only the data needed for each request and store no independent copies beyond the school’s own records.
💳 Payments (Paystack): Online fee payments are processed by Paystack, a CBN-licensed payment processor. Card details are entered directly into Paystack’s secure checkout and never touch our servers or the school’s devices. We receive only the payment outcome (amount, reference, status). See paystack.com/privacy.
🧾 Receipt verification: Printed fee receipts carry a QR code linking to a verification page. That page discloses only details already printed on the paper receipt itself (receipt number, amount, date, method) — never a student’s name, class, phone number or balance.
📱 SMS (Termii): Parent phone numbers are transmitted to Termii’s API solely to deliver fee reminder messages. Termii is a licensed Nigerian bulk SMS provider. See termii.com/privacy for their terms.
🔐 Passwords are never stored in plain text. Admin and staff passwords are obfuscated and stored only on-device or in your Firebase project — which only you control.
4.1 Biometric Face Data (Special Category)
Where a school enables face-verified staff attendance, the Portal processes biometric data, which the Nigeria Data Protection Act 2023 treats as sensitive personal data. We handle it as follows:
• What is stored: a 128-number mathematical face template (descriptor) — not a photograph, and not reversible into one. The staff passport photo used for comparison is stored on the school’s device only.
• Consent: a face template is only ever created through a deliberate, supervised enrollment step, and the staff member is informed and asked to consent at that moment. A school may also disable face verification entirely in Settings, in which case attendance uses password sign-in.
• Where it lives: on the school’s enrolled device(s) and within the school’s own cloud backup, protected by the same authenticated-members-only security rules as all school data. It is never used for any purpose other than confirming the enrolled staff member’s own attendance, and is never shared with or sold to anyone.
• Deletion: a staff member may ask their school administrator to delete their face template at any time (the admin re-enrolls or removes the staff record); deletion requests can also be sent to us using the contact details in Section 1.
5. Data Retention
Data is retained for as long as the school Subscription is active. On subscription expiry or termination, the Subscriber admin may export or delete all records. We do not retain copies of school data after account termination.
6. Your Rights (NDPR Compliance)
Under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, you have the right to:
- Access — request a copy of personal data held about you
- Correction — request correction of inaccurate data
- Deletion — request erasure of your personal data
- Objection — object to processing of your data
- Portability — receive your data in a portable format
To exercise any of these rights, contact us using the details in Section 1. We will respond within 30 days.
7. Children’s Data
Student data (including minors) is entered exclusively by authorised school administrators. Parents/guardians consent to their child’s enrolment data being recorded in the Portal at the point of school registration. We do not collect data directly from children.
8. Third-Party Services
🔥 Google Firebase — cloud database (optional). policies.google.com/privacy
💳 Paystack — payment processing. paystack.com/privacy
📲 Termii — SMS delivery. termii.com/privacy
🌐 Netlify — app hosting. netlify.com/privacy
We are not responsible for the privacy practices of these third-party services. Their own policies govern how they process data.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected in the “Last updated” date above. Continued use of the Portal after changes constitutes acceptance of the updated policy.
10. Contact & Complaints
For privacy concerns or complaints, contact us at:
📧 admin@scholarmatrix.com.ng
📞 Available on request via email
You may also file a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.