Our role: your school is in control
Your school is the data controller — it decides what is collected and why. EduBoard is the data processor — we only handle that data on your school's instructions, to run its account. Consent, notices to parents, and lawful basis for processing student information rest with the school; we give you the tools to honour them.
Children's data
Most records in EduBoard concern minors. We treat them with extra care: student data is never used for advertising, never sold, never shared outside the school's own account, and never used to train third-party models. Parents and guardians exercise their rights through the school, which can view, correct, export or delete any child's record from the admin dashboard.
What we collect
Names, emails, phone numbers, student records, attendance, marks, fee transactions, messages between users, and uploaded documents (proof of payment, profile photos). We never collect anything we don't need to run the school's account.
Where it lives & how it's secured
In enterprise-grade cloud infrastructure, encrypted in transit and at rest, with daily snapshots retained for 30 days. Access is role-based and logged, and administrative access is restricted to the smallest team needed to operate the service.
Who can see it
Per-school RBAC. A teacher only sees their own classes. A parent only sees their own children. A student only sees their own records. Schools are isolated from one another. Our staff only access tenant data with written customer approval (typically support tickets).
How long we keep it
For the lifetime of the school's account, plus 30 days after cancellation for export. After that, full deletion.
Your rights
Schools can export, edit, or delete any record at any time from the admin dashboard. Parents and students can request access or deletion via their school. We action verified requests within 10 days.
If something goes wrong
In the unlikely event of a data breach affecting your school, we notify your primary admin without undue delay — and within 72 hours of confirming it — with what happened, what's affected, and the steps we're taking.
Subprocessors & transfers
A short list of reputable providers for hosting, transactional email, and mobile push notifications. No analytics or ad-tech subprocessors — your data is never sold or shared. Where data is processed outside your country, it stays under equivalent safeguards. The full subprocessor list ships with every contract.
Questions, or a data request? Email privacy@eduboard.tech.