Privacy Policy

1. In short

• A school’s records belong to the school. We hold them on the school’s behalf and act on its instructions.
• We do not sell personal data, and we never will. There is no advertising on Xoudo and no data broker in this policy.
• We do not use student data to train machine-learning models, ours or anyone else’s.
• Each school’s data is isolated from every other school’s.
• If you are a parent with a question about your child’s record, your school is the right first contact — see section 9.

2. Who is responsible for what

This policy covers two different relationships, and they have different answers.

Data we hold for a school (we are the processor)

Student records, guardian details, attendance, marks, medical notes, fee records, staff records and the documents a school uploads. The school is the data controller: it decides what to collect, why, and for how long. We are the processor — we store and process it to provide the service, on the school’s instructions, and for no purpose of our own.

Data we hold about our own customers (we are the controller)

The name, email address and phone number of the person who signs a school up, subscription and billing records, support correspondence, and our website analytics. For this data Xoudo is the controller.

3. What we collect

Given to us by a school

• Students: name, date of birth, sex, photograph, admission number, class, address and contact details, guardians, and the records a school keeps — attendance, assessment marks, report cards, discipline records, clinic visits, transport and boarding arrangements.
• Guardians and parents: name, relationship to the student, phone number, email address, address.
• Staff: name, contact details, role and permissions, employment and payroll details where the school uses payroll.
• Financial records: invoices, discounts, payments and receipts.

Created by using the service

• Sign-in records — when an account signed in, from what IP address and on what kind of device — kept so a school can tell whether someone else has used a staff account.
• An audit trail of significant actions: who changed a mark, cancelled an invoice, or altered someone’s permissions, and what the value was before and after. This exists so a school can answer questions about its own records, and we do not switch it off on request.
• Technical logs and error reports needed to keep the service running and to diagnose faults.

4. Children’s data

Most of the personal data in Xoudo is about children, which is why this policy is stricter than it would otherwise need to be.

• Children do not sign up to Xoudo. A school enrols a student, and the lawful basis for holding that record is the school’s, arising from its relationship with the family.
• A student or guardian portal account is created by the school, and shows only that family’s own information.
• We do not profile children, do not advertise to them, and do not share their data with anyone except the processors listed in section 6.
• A school’s public page shows only what the school chooses to publish about the school. It never exposes student records.

5. Why we process it

• To provide the service the school has asked for — running the modules it uses, and sending the notifications it configures.
• To take payment — our subscription fee, and school fees paid online where the school has enabled that.
• To keep the service secure — detecting misuse, investigating incidents, and maintaining the audit trail.
• To support you — answering questions, which sometimes means looking at an account to diagnose a problem.
• To meet legal obligations, including keeping financial records.

We do not use school data for marketing. We may email the person who signs a school up about their trial, their subscription and changes to the service; those are service messages, and any genuine marketing email carries an unsubscribe link.

6. Who else processes it

We use a small number of suppliers to run the service. Each is bound to handle the data only as instructed, and none of them receives data for their own purposes.

• Hosting — our servers and database, which is where school data lives.
• Payments — our payment provider, for both subscription fees and online school-fee collection. Card details are entered on the provider’s own page and we never see or store them.
• Email delivery — for invitations, password resets, receipts, report cards and the notifications a school sends.
• SMS and WhatsApp delivery — where a school switches those channels on. The recipient’s phone number and the message text are passed to that provider so it can be delivered.
• AI features — where a school uses them, the specific text needed for that request is sent to our AI provider. It is not retained by the provider for training. A school that would rather send nothing can leave these features switched off.

Some of these suppliers operate outside Nigeria, so data may be processed abroad. We use suppliers that offer appropriate safeguards and contractual protection for international transfers. We will name our current suppliers on request — write to support@xoudo.com.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If we are compelled to hand over a school’s data we will tell the school, unless we are legally forbidden from doing so.

7. How we protect it

• Traffic between your device and Xoudo is encrypted in transit.
• Each school’s data is separated at the database layer, and that separation is enforced by an automated test that fails the build if a new record type is added without it.
• Passwords are stored hashed, never in a readable form. Two-factor authentication is available to every account and we recommend it for administrators.
• Within a school, roles and per-person permissions decide who can see what. A class teacher does not see the payroll.
• Databases are backed up, and restores are rehearsed rather than assumed.
• Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach occurs that is likely to put people at risk, we will notify the affected schools without undue delay, and the regulator where the law requires it.

8. How long we keep it

• While a school is a customer, we keep its data. A school record is deliberately long-lived: a former student may ask for a transcript years later, and the school decides when to remove a record.
• After an account ends, the school has 60 days to export its data. We then delete it from live systems, and it falls out of backups as those backups age out.
• Financial records we are required to keep are retained for as long as the law requires, even after an account closes.
• Sign-in and audit records are kept while the account is active, as the school’s own record of what happened.

9. Your rights

Under the Nigeria Data Protection Act and the NDPR you may ask to see the personal data held about you, to have it corrected, to have it deleted, to object to certain processing, and to receive a copy in a portable form.

If you are a parent, student or member of staff at a school using Xoudo, ask your school first. The school controls that record and decides what happens to it; we cannot change or delete a school’s records on a third party’s instruction, and would be acting improperly if we did. If you contact us we will pass your request to the school and help them answer it.

If you are the person who signed your school up, or you are asking about data we hold as controller, write to support@xoudo.com and we will respond within 30 days.

You also have the right to complain to the Nigeria Data Protection Commission if you think your data has been handled wrongly.

10. Cookies and analytics

Xoudo sets only the cookies and local storage it needs to keep you signed in, remember your display preferences, and let the app work when your connection drops. There are no advertising cookies and no third-party trackers in the app.

On our public website we measure visits using privacy-friendly analytics that set no cookies and do not track individuals across sites or build a profile of you. We can see that a page was visited; we cannot see who you are.

11. Data protection contact

Questions about this policy, or about how we handle data, go to support@xoudo.com. A school that needs a formal data processing agreement for its own records should ask, and we will provide one.

12. Changes

We will update this policy as the service changes. If a change materially affects how personal data is handled we will tell account owners by email at least 30 days before it takes effect. See also our Terms of Service.