1. Who we are and what this covers
SchoolKit is a school management platform built in Lagos, Nigeria for private schools across Nigeria and the wider African continent. We help schools collect fees, track attendance, manage student and staff records, generate report cards and communicate with parents.
This Privacy Policy explains what personal data we collect, why we collect it, who we share it with and what rights you have. It applies to:
- schoolkit.ng — this website, including our blog and the early-access waitlist form;
- the SchoolKit application — the web and mobile software your school uses to run day-to-day operations;
- our communications — the emails and WhatsApp messages we send to schools, staff and parents on a school's behalf.
Throughout this policy, "SchoolKit", "we", "us" and "our" mean SchoolKit, operating from Lagos, Nigeria and reachable at hello@schoolkit.ng.
2. The short version
The full policy is below, but here is the substance of it in plain English:
- Your school owns its data. Student records, results, attendance and fee history belong to the school, not to us. We hold them on the school's instructions.
- We never sell personal data. Not to advertisers, not to data brokers, not to anyone. There is no circumstance in which we would.
- We never store card details. Fee payments run through Paystack, a licensed and PCI-DSS compliant processor. Card numbers and PINs never reach our servers.
- Student data is not sold, rented or used to advertise to children. We do not run advertising inside the SchoolKit application.
- You can get your data out. Schools can export their records, and can ask us to delete them when they leave.
3. Two different roles: your school and SchoolKit
This distinction matters, and it determines who you contact about what.
Where your school is the data controller. For everything inside the school's SchoolKit account — student records, guardian contact details, attendance marks, results, invoices, staff files — the school decides what is collected and why. SchoolKit acts as a data processor, handling that information only on the school's documented instructions. If you are a parent, guardian, student or staff member and you want to access, correct or delete your information, contact your school first. We will support the school in answering you, but we cannot act on the school's data without its authority.
Where SchoolKit is the data controller. For our own business activity — the marketing website, the early-access waitlist, sales enquiries, support conversations, billing records and our own staff recruitment — we decide the purposes ourselves and act as the data controller. Contact us directly about any of this at hello@schoolkit.ng.
Schools using SchoolKit to process personal data are bound by our Terms of Service, which incorporate data-processing commitments consistent with the Nigeria Data Protection Act 2023.
4. Information we collect
School and administrator information
- School name, address, logo, term structure and grading configuration
- Names, email addresses, phone numbers and roles of the people who administer the account
- Login credentials — passwords are stored hashed, never in plain text
Student information (entered by your school)
- Name, admission number, date of birth, gender, class and enrolment history
- Photograph, where the school chooses to upload one
- Attendance records
- Scores, grades, comments and generated report cards
- Fee invoices, payment history and outstanding balances
- Any additional notes or fields the school chooses to record in free-text areas
Parent and guardian information
- Name, relationship to the student, phone number, WhatsApp number, email
- Payment records and receipts associated with their ward's fees
- Delivery status of messages we send on the school's behalf
Staff information
- Name, contact details, role, subjects and classes assigned, employment status
- Permissions and access level within the school's account
- Activity logs showing actions taken in the system
Payment information
When fees are paid through SchoolKit, the transaction is handled by Paystack. We receive and store a transaction reference, amount, currency, payment channel, timestamp, status and a masked identifier (for example, the last four digits of a card). We do not receive or store full card numbers, CVVs, PINs or bank login credentials.
AI Tutor interactions (feature in development)
Where a school enables the AI Tutor, we process the questions a student asks, the responses generated, the subject and class context, and the teacher's approval or rejection of generated material. See section 9 for how this data is handled.
Technical and usage information
- IP address, browser type, device type and operating system
- Pages visited, features used, and timestamps
- Error reports and diagnostic logs when something goes wrong
- For offline mode: a local copy of the school's working data stored on the device, which syncs when connectivity returns
Waitlist and marketing information
If you join our early-access waitlist, we collect the email address you provide, your WhatsApp number if you choose to give one, the time of signup and which part of the page you signed up from.
5. How we use information, and our lawful basis
Under section 25 of the Nigeria Data Protection Act 2023, we must have a lawful basis for each purpose. Ours are:
- Performance of a contract — running the school's account, processing fee payments, generating report cards, delivering receipts and notifications, and providing support.
- Legitimate interests — securing the platform against fraud and abuse, diagnosing faults, understanding which features are used so we can improve them, and communicating with schools about service changes. We balance these against your rights and interests.
- Consent — marketing emails, the early-access waitlist, non-essential analytics cookies, and any optional feature a school switches on. Consent can be withdrawn at any time.
- Legal obligation — retaining financial records, and responding to lawful requests from regulators or courts.
- Instructions of the data controller — where we process student, parent and staff data on your school's behalf, the school establishes the lawful basis and we act on its instructions.
We do not use student, parent or staff data for our own marketing. We do not profile students for advertising purposes. We do not make automated decisions that produce legal or similarly significant effects on any individual.
6. Children's data and parental consent
SchoolKit is used to manage records about children. We treat that data as sensitive and handle it accordingly.
SchoolKit is not directed at children. Accounts are created and controlled by schools. Students access only the parts of the platform a school assigns to them — for example, results or, where enabled, the AI Tutor.
Consent is obtained by the school. Under the NDPA 2023, processing a child's personal data generally requires the consent of a parent or legal guardian. Your school is responsible for obtaining that consent, usually through its enrolment forms or parent handbook, and for notifying parents that it uses SchoolKit. By uploading student data to SchoolKit, a school confirms it has the authority to do so.
What we will not do. We do not sell children's data, do not serve advertising to students, do not build advertising profiles from student activity, and do not disclose student data to third parties except the service providers listed in section 10, all of which are bound to process it only on our instructions.
If you believe a child's data has been entered into SchoolKit without proper authority, contact your school and copy us at hello@schoolkit.ng. We will work with the school to resolve it promptly.
7. Fee payments and Paystack
Fee collection through SchoolKit is processed by Paystack, a payment company licensed by the Central Bank of Nigeria and certified to PCI-DSS Level 1.
When a parent pays, the card, bank transfer or USSD details are entered directly into Paystack's environment. Those details do not pass through and are not stored on SchoolKit's servers. We receive confirmation of the transaction and store the reference, amount, status and timestamp so the school's ledger stays accurate and a receipt can be issued.
Paystack acts as an independent data controller for the payment data it collects, and its own privacy policy governs that processing. Settlement of funds to the school's bank account is handled under the school's arrangement with Paystack.
SchoolKit is not a bank and is not a licensed payment service provider. We do not hold school funds on deposit.
8. Messages we send to parents and staff
On your school's instruction, SchoolKit sends transactional messages by email and WhatsApp: payment receipts, absence notifications, results availability, invoices and school announcements.
These are sent because the school has a relationship with the recipient and has asked us to send them — they are not marketing. Recipients who no longer wish to receive them should contact the school, which controls the message settings and the contact list.
WhatsApp messages are delivered through Meta's WhatsApp Business infrastructure and are subject to WhatsApp's own terms and privacy policy. Email is delivered through Resend. Both providers process delivery metadata such as whether a message was delivered, opened or bounced.
Marketing emails from SchoolKit itself — product updates and early-access news — are separate, are sent only with consent, and carry an unsubscribe link in every message.
9. The AI Tutor
The AI Tutor is in development and is grounded in the WAEC and NECO curriculum. Where a school enables it, the following applies.
- Teachers stay in control. AI-generated lessons and quizzes are held for teacher review and must be approved before a student sees them.
- Questions and responses are processed to deliver the feature and to let teachers review what was generated for their class.
- We do not sell AI Tutor content, and we do not permit our AI providers to use your school's student data to train their general models. Where we use a third-party model provider, we do so under terms that exclude customer data from model training.
- AI output can be wrong. It supports teaching, it does not replace a teacher's judgement. Schools should treat generated material as a draft to be checked.
If the way we process AI Tutor data changes materially when the feature launches in full, we will update this policy and tell schools before the change takes effect.
11. Where your data is stored and cross-border transfers
Some of the providers listed above are located outside Nigeria, principally in the United States and the European Union. This means personal data may be transferred across borders.
Under section 41 of the NDPA 2023, we transfer personal data outside Nigeria only where there is an adequate legal basis — an adequacy determination, or contractual safeguards imposing data-protection obligations equivalent to those in the Act, or your consent, or where the transfer is necessary to perform our contract with your school.
We contractually require every provider handling school data to maintain appropriate security and to process it only on our instructions. Schools that need data residency within a particular country should contact us at hello@schoolkit.ng to discuss options before onboarding.
12. How long we keep information
We keep personal data only as long as we need it:
- Active school accounts — for as long as the school uses SchoolKit.
- After a school leaves — school data remains available for export for 90 days, after which it is deleted or irreversibly anonymised, unless the school asks us in writing to delete it sooner.
- Financial and transaction records — retained for at least 6 years to meet Nigerian tax and accounting obligations, even after an account closes.
- Waitlist and marketing contacts — until you unsubscribe or ask us to delete your details.
- Backups — deleted data persists in encrypted backups for up to 90 days before being overwritten on the normal backup cycle.
- Technical logs — typically 12 months.
13. How we protect information
The measures we apply include:
- Encryption in transit using TLS, and encryption of data at rest
- Passwords stored using one-way hashing — we cannot read yours
- Role-based access control, so a class teacher sees only what their role requires
- Activity logging on sensitive actions within a school's account
- Regular backups, with restore testing
- Access to production systems restricted to the smallest number of SchoolKit personnel necessary, each bound by confidentiality obligations
Offline mode. SchoolKit is built to keep working when the power or the network does not. To do that, a copy of the school's working data is stored on the device in use and synced when connectivity returns. Schools should therefore secure their own devices — screen locks, device encryption where available, and prompt removal of access for departing staff.
Breach notification. If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as required by the NDPA 2023, and notify affected schools without undue delay so they can inform the individuals concerned.
No system is perfectly secure, and we do not claim otherwise. We commit to acting quickly and transparently if something goes wrong.
14. Your rights under the NDPA 2023
If you are in Nigeria, the Nigeria Data Protection Act 2023 gives you the right to:
- Be informed about how your data is used — this policy is part of meeting that obligation
- Access the personal data held about you
- Correct data that is inaccurate or incomplete
- Delete data where there is no lawful reason to keep it
- Restrict or object to certain processing, including direct marketing
- Data portability — receive your data in a structured, commonly used format
- Withdraw consent at any time, where consent was the basis for processing
- Lodge a complaint with the Nigeria Data Protection Commission
How to exercise them. If your data sits inside a school's SchoolKit account, contact the school — it is the data controller. For data we control ourselves, email hello@schoolkit.ng. We respond within 30 days and may need to verify your identity first. There is no charge unless a request is manifestly excessive or repetitive.
Complaints. If you are unhappy with our response you may complain to the Nigeria Data Protection Commission (NDPC), Abuja, at ndpc.gov.ng. We would appreciate the chance to put things right first.
15. Schools outside Nigeria
SchoolKit serves schools elsewhere in Africa. Where local law applies to your school, we will honour the equivalent rights and obligations under it, including:
- Ghana — Data Protection Act, 2012 (Act 843), supervised by the Data Protection Commission
- Kenya — Data Protection Act, 2019, supervised by the Office of the Data Protection Commissioner
- South Africa — Protection of Personal Information Act, 2013 (POPIA), supervised by the Information Regulator
- Other jurisdictions — we comply with applicable local data protection law in the countries where we offer the service
The substantive protections in this policy — no sale of personal data, no advertising to students, school ownership of school data, contractual controls on providers, breach notification — apply to every school regardless of location. Where your local law grants a right this policy does not mention, you keep that right and can exercise it by writing to hello@schoolkit.ng.
17. Changes to this policy
We update this policy as the product develops — the AI Tutor and other features listed as coming soon will bring changes. The effective date at the top always reflects the current version.
For material changes affecting how we handle school, student or parent data, we will notify schools by email or in-app notice before the change takes effect. Continuing to use SchoolKit after that point means you accept the updated policy.
18. Contact us
For any privacy question, request or complaint — including data access, correction and deletion requests:
- Email: hello@schoolkit.ng
- WhatsApp: +234 704 967 7393
- Location: Lagos, Nigeria
Please write "Privacy request" in your subject line so it reaches the right person quickly.