Privacy policy

• Your school decides. When a school uses Scholaid, the school decides whose information goes in (its staff and students) and what it’s used for. For that information the school is the data controller and we are its data processor: we only use it to run Scholaid for that school, as this policy and our Terms describe.
• We decide about the information we need to run our own business: the account of the school owner who signs up, access requests, billing records, and the security and error logs that keep the service working. For that information we are the data controller.

If you are a student, a parent or a staff member and want to see, correct or remove your information, please contact your school first. We will help your school respond.

When a school asks for access

Your name, email address, phone number, the school’s name and address, and anything else you tell us in the request form.

School owners and staff

• Name, email address (owners), staff ID (generated by Scholaid), role (Owner, Admin, Academic Head, Teacher) and the classes and subjects a teacher is assigned to.
• A password, which we store only as a one-way hash. We can never see it.
• What you create and upload: teaching notes and documents (PDF or Word), the question banks and lesson plans generated from them, tests, reviews and comments.

Students

• Name, student code (generated by Scholaid), class, and whether the student is active.
• A password set by the school. We store it only as a one-way hash.
• Test activity: when they logged in and started, their answers, their score, and, if the test asks for it, when and for how long they left the test page.
• The IP address and browser type of each test login, so a student can only be signed in on one device at a time.

We do not ask for students’ email addresses, phone numbers, dates of birth, photos or home addresses.

Billing

The plan, the period paid for, the amounts and payment status. Card and bank details are entered on our payment provider’s page (Bachs). We never see or store them.

Technical information

• Security logs: an activity log of important actions (for example a login, a password reset, a deleted test) with the time and the IP address. Failed login attempts are recorded with the IP address so we can block password guessing.
• Error reports: when something breaks, we receive a report with the page address (with any link codes removed), the browser type and a pseudonymous id for the user, school and role. These reports never include names, emails, student codes or answers. Text on the screen is hidden in any screen recording attached to an error.

Cookies

Scholaid uses only cookies needed to keep you signed in (for staff, platform staff and students on a test link). We don’t use advertising or tracking cookies. Your browser also keeps a small amount of information on the device: unsent test answers until they reach us, and a few settings such as a remembered tab.

We don’t sell information, and we don’t use it for advertising.

Scholaid uses AI services to read the notes your teachers upload and draft questions and lesson plans. To do that, the text of the document (and, for pictures and diagrams, images of those pages) is sent to our AI providers, OpenAI and Google (Gemini). We use their paid business services, which do not use what we send to train their models. We do not send students’ names, codes or answers to AI providers.

Everything the AI drafts is reviewed and approved by your school’s staff before students see it.

We share information only with service providers who help us run Scholaid, under contracts that limit what they can do with it:

We may also share information if the law requires it, or to protect the safety of students, staff or the service.

Some of the providers above are outside Nigeria. When we transfer information abroad, we do so as the NDPA allows (sections 41–43): to countries with adequate protection, or under contracts with appropriate safeguards.

• School records (staff, students, classes, tests, results, lesson plans, question banks): for as long as the school uses Scholaid. Academic history is kept even when a student is deactivated or moves class, so past results stay accurate.
• When a school leaves: its information is kept so it can come back. To get a copy or have it deleted, reach out to us at [email protected].
• Activity and usage logs: 12 months in the live system, then moved to a secure archive for [period].
• Failed login records: about one day.
• Billing records: [6 years], as tax law requires.
• Access requests that aren’t approved: [12 months].
• Error reports: [90 days].
• Unsent answers on a student’s device: until they reach us, then removed.

Most students on Scholaid are under 18. Schools add their own students, and the school is responsible for having the right to do so, including any consent needed from parents or guardians under the NDPA. We collect only what a test needs (name, code, class, answers), never contact students directly, and never use their information for marketing.

• Passwords stored only as one-way hashes; sign-in cookies that scripts can't read.
• Each school sees only its own information.
• Staff see only what their role allows.
• Documents and pictures are shared through short-lived links.
• All connections are encrypted (HTTPS).
• Login limits to stop password guessing; students limited to one device at a time.

If a breach puts your information at risk, we will tell the affected schools and the Nigeria Data Protection Commission as the law requires (within 72 hours of becoming aware of it).

Under the NDPA you can ask to see your information, correct it, have it deleted, restrict or object to its use, or receive a copy in a common format. You can also withdraw consent where we rely on it.

• For school records (staff and students), ask your school. It can make most changes itself in Scholaid, and we will help with the rest.
• For anything else, email [email protected]. We will answer within [30 days].

You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

If we make a significant change, we will tell school owners by email or in Scholaid before it takes effect. The date at the top shows when this policy was last updated.