1. Overview
Schola is a multi-tenant school management platform. This Privacy Policy describes how we collect, use, and protect personal information when you use the Service. We act as a processor on behalf of each Tenant for student, parent, and staff data, and as a controller for our own account holders.
2. Information we collect
- Account information. Name, email, role, and authentication credentials of administrators, teachers, parents, and students.
- Tenant data. Student records, attendance, grades, fees, and related school operations data provided by your institution.
- Usage data. IP address, browser type, pages visited, and timestamps — used for security and product analytics.
- Audit logs. A record of privileged actions taken inside your Tenant, as required by §10 of our product requirements.
3. How we protect data
- Tenant isolation. Every query in Schola filters by tenant identifier. Direct database access outside the isolation layer is forbidden.
- Encryption in transit. All traffic is encrypted via TLS 1.2+.
- PII encryption at rest. Sensitive fields — phone, date of birth, address — are encrypted using envelope encryption.
- Password hashing. Argon2id with tenant-appropriate parameters.
4. How we use information
We use personal information to provide the Service, send transactional notifications, prevent abuse, and improve product reliability. We do not sell personal information. We do not use Tenant Data to train third-party AI models.
5. Sub-processors
We use a small set of sub-processors to operate the Service — hosting (MongoDB Atlas), email delivery (Resend), and media storage (ImageKit). Each is contractually obligated to maintain confidentiality and security at least as protective as ours.
6. Data retention
We retain Tenant Data for the duration of your relationship with Schola plus 30 days after termination, during which you may export data. Audit log entries are retained for at least 12 months for compliance and security review.
7. Your rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information. For Tenant Data, contact your school administrator first — they control how data is managed inside their Tenant.
8. Children's privacy
Schola is used in K-12 contexts where students under 13 may have accounts created by their school. We process this data only on the instructions of the school, under their authority as the educational institution.
9. International transfers
Data may be processed in regions where our sub-processors operate. Enterprise tenants can request data residency options at signup.
10. Changes
We will notify Tenant administrators by email of material changes to this Policy at least 14 days before they take effect.
11. Contact
For privacy questions or to exercise your rights, email privacy@schola.reactbd.com.