Privacy Policy

In short. SchoolPort runs the platform. Your school owns and controls official school records; SchoolPort controls app accounts and app-level data.

SchoolPort Liberia (“SchoolPort”, “we”, “us”) is operated by SchoolPort and provides a student information system used by schools in Liberia, a web portal for school staff, and SchoolPort BLUE (Broad Learning, Unified Environment), a mobile app for students and parents. In this policy, “the app” means BLUE. Liberian company registration details will be published here when they are issued.

Two different parties are responsible for your data, and it matters which one, because it decides who answers your requests:

• Your school is the data controller for official student records — enrollment information, grades, attendance, transcripts, timetables, and fee accounts. We process those records only on the school’s written instructions, under a data-processing agreement. The school decides what its records contain and how long they are kept, and we refer requests about them to the school.
• SchoolPort is the data controller for things that exist because of the app itself: accounts parents create, device push tokens, in-app messages and posts, conversations with the Kate assistant, support correspondence, and the record of your acceptance of this policy.

In short. Identity details (including student date of birth), the enrollment information your school records, academic records, fee balances, content you create, and basic device data. No location tracking, no advertising data.

Student identity and enrollment information, provided by the school. When a school enrolls a student, it records the information it needs to run the school, and that information is stored in SchoolPort on the school’s behalf. This includes the student’s full name, date of birth, gender, grade level and class section, SchoolPort ID, enrollment date and status, guardian names and phone numbers, home address or community where the school records it, previous school where relevant, an optional student photo, and any enrollment documents the school collects (such as a birth certificate or prior report card). The student’s date of birth is also used once during account activation, to confirm the person activating the account matches the school’s record.

Academic and school-life records, created by the school. Grades and report cards, attendance, timetables, homework and assignment submissions, exam registrations and results, disciplinary or conduct notes where the school keeps them, and school announcements addressed to you.

Parent account details, provided by you. Your name, email address, phone number, the password you choose (stored only as a cryptographic hash — we cannot read it), your links to your children’s records, and an optional profile photo.

Financial records. School fee balances and the payment references you submit after paying the school. We never collect card numbers, mobile-money PINs, or bank credentials — payments happen entirely outside the app, directly with your school.

Content you create. Messages, study-group and course-discussion posts, questions you ask the Kate assistant, reports you file about other content, and feedback you send us.

Device and technical data. A push-notification token (if you enable notifications), device type and operating system, app version, and the security and sign-in logs described in section 10 (Retention).

Anti-bot checks. Public forms on the website (school registration, contact and demo requests) use Cloudflare Turnstile to tell people from automated programs. When a form loads, Cloudflare receives your IP address and standard browser signals to run the check, and returns a pass or fail result that we verify on our servers. Turnstile is a security measure and is not used for advertising or tracking.

What we deliberately do not collect: precise location, your contact list, advertising identifiers, browsing history, or biometric data. The app contains no advertising or analytics SDKs of any kind. The public marketing website (not the app) may send a cookieless conversion beacon to our own servers — page path, event name, and optional referrer only — after you allow measurement in the cookie bar, and only when your browser has not sent a Do Not Track or Global Privacy Control signal. We do not use that for advertising, and we do not assign you a visitor identifier. See the Cookie Policy.

In short. From your school, from you directly, and a small amount generated automatically by the app.

From your school

Enrollment information (including date of birth), academic records, fee accounts, class assignments, and the credentials used to activate student and parent access.

From you

Account details you enter, content you post, questions you ask Kate, payment references you submit, and support messages you send. If you browse the public marketing website, a conversion event (not a profile) as described in section 2 — only if you allowed measurement.

Generated by the app

Push tokens, sign-in and security logs, the record of which policy version you accepted and when, and delivery status of notifications.

In short. To run the school’s information system, show you your own records, keep the service safe, and meet legal duties. Never for advertising, and never sold.

• Operating the school’s information system — storing and displaying enrollment, academic, and fee records (performance of the school’s agreement with us and its public-education mandate).
• Providing your account — letting parents and students see their own linked records, sending notifications you enable, and answering Kate questions you ask (performance of our terms with you, and your consent for optional features).
• Safety and integrity — content filtering, report handling, user blocking, abuse prevention, rate limiting, and security logging (legitimate interest in keeping a service used by children safe).
• Legal obligations — keeping records the law requires, responding to lawful requests, and demonstrating consent.

We do not sell personal data, we do not share it for advertising, and we do not use it to make automated decisions about students.

In short. Kate is an optional AI helper for parents. Your question and your children’s school records go to OpenAI to generate the answer. Don’t want that? Simply don’t use Kate — everything else works without it.

Kate stands for Key Academic Tracking & Evaluation. She is an AI assistant, available to parents only, that answers questions about your own linked children’s school information — grades, attendance, fees, timetables, and school announcements.

How it works with your data. When you send Kate a message, your question and the relevant records of your linked children are transmitted to OpenAI to generate the reply. OpenAI processes the data solely to produce the response and is contractually restricted from using it to train its models.

Safety measures. Every reply passes through an automated safety filter before you see it, Kate’s usage is rate-limited, and your chat history can be cleared in the app at any time (and is kept no longer than 12 months regardless).

Your choice. Kate is entirely optional. If you prefer that your children’s records never be processed by an AI provider, do not use the Kate feature — every other part of SchoolPort works without it. Kate’s answers are generated automatically and can be wrong; the school’s official records always prevail.

In short. Only the infrastructure providers needed to run the service, each under a data-processing agreement. Nobody gets your data for marketing.

Supabase

Database, authentication, file storage and server functions. Where SchoolPort’s data lives. Data involved: All platform data, hosted in the United States and the European Union.

Vercel

Serves the staff web portal and the public website. Data involved: Page requests (IP address and browser details) while pages are delivered.

Sentry

Error monitoring for the staff web portal, so faults are found and fixed. Data involved: Technical error details and page paths without query strings. Cookies, request headers and bodies, and user identity are not collected, and any session recordings mask all text and block images.

Cloudflare (Turnstile)

Anti-bot check on public forms (school registration, contact and demo requests). Data involved: The visitor’s IP address and browser signals during the check; the form content is not sent to Cloudflare.

Expo

Push-notification delivery and app updates. Data involved: Push token and notification text.

Google Firebase

SMS-code sign-in for parents. Data involved: The parent’s phone number while the code is sent and checked.

Twilio

Sends account and enrollment text messages (for example activation codes and enrollment decisions). Data involved: The recipient’s phone number and the message text.

Resend

Sends account and notification emails. Data involved: The recipient’s email address and the message content.

OpenAI

Powers the optional Kate assistant. Not used unless a parent uses Kate. Data involved: The parent’s question and the relevant records of their linked children.

Each provider processes data only on our documented instructions, under a written data-processing agreement. Beyond these providers, we disclose personal data only to your school (its own records), to authorities when the law genuinely requires it, or to protect a child from harm. We give schools 30 days’ notice before adding a new sub-processor.

In short. Data is hosted in the United States and European Union, encrypted in transit and at rest, under contractual safeguards. There is no Liberian data-centre option today.

SchoolPort runs on cloud infrastructure hosted outside Liberia — our database, file storage, and authentication are hosted in the United States and the European Union, our web portal is served from a global content network, and push notifications are delivered through servers in the United States. There is no Liberian data-centre option available from our providers today; if that changes we will reassess.

We protect data in transit with TLS and at rest with provider-managed encryption, and each provider is bound by a written data-processing agreement that permits processing only on our instructions. Where the data of people in the European Economic Area or the United Kingdom is transferred, we rely on the European Commission’s Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum.

Liberia. Liberia enacted a Data Protection Act on 19 August 2026. Its implementing regulations and supervisory authority are still being established. We are assessing our transfers against that Act and against the ECOWAS Supplementary Act on Personal Data Protection, and we will update this policy — and, where the law requires it, seek your explicit consent or notify the authority — as the framework takes effect. By using SchoolPort you understand that your data is processed outside Liberia as described above.

In short. Schools provision student accounts with parental authority. We collect only what the school function requires, show students only their own records, and never use children’s data for marketing or profiling.

SchoolPort is used by students, including children under 13. Student accounts are provisioned by the school, not created by children themselves, and the school — acting with the authority of parents and guardians under its enrollment agreements — consents to the processing needed to operate its information system.

• We collect from students only what the school function requires.
• Students see only their own records; parents see only their linked children.
• Communication features are limited to the student’s own school community — there is no public discovery or contact with strangers — and every message can be reported and every user blocked (see our Child Safety Standards).
• Students under 16 additionally cannot exchange private one-to-one messages with classmates, create study groups, share web links in messages, or show their photo to classmates, unless their school expressly enables a feature. These limits are enforced on our servers and lift automatically at 16.
• We never use children’s data for marketing, advertising, profiling, or automated decision-making, and the Kate assistant is not available to student accounts.

Parents can review their children’s records in the app and can contact us or the school with any question or objection.

In short. Encryption in transit and at rest, role-based access enforced at the database layer, encrypted on-device storage, and regular security reviews.

Data is encrypted in transit (TLS) and at rest. Access is restricted by role and enforced at the database layer: school administrators manage their institution, staff see only what their role requires, and students and parents see only linked records. On your device, the mobile app stores its session and cached data in encrypted storage. We review our security controls regularly and maintain an internal security runbook and audit process.

If something goes wrong. If a data breach is likely to put you or your children at risk, we will notify the affected schools and account holders without undue delay, tell you what happened and what we are doing about it, and notify the supervisory authority where the law requires it.

In short. Nothing is kept forever. Parent accounts until you delete them (or 24 months of inactivity); Kate chats 12 months max; backups expire within 35 days. School records follow the school’s own rules.

For the data we control, our periods are:

Parent account

Until you delete it, or 24 months after your last sign-in.

Push tokens

Deleted when you sign out or disable notifications.

Kate chat history

Clearable in BLUE at any time; kept no longer than 12 months.

In-app notifications

12 months.

Support messages

24 months after the matter closes.

Security & audit logs

12 months; administrative audit trails 365 days.

Abuse reports

24 months after resolution.

Backups

Rolling expiry of no more than 35 days.

We keep a record of your acceptance of this policy for 7 years, because we have to be able to show that you agreed. If you delete your account, that record is reduced to a one-way cryptographic fingerprint of your email address — enough to answer a later dispute, but not readable personal data.

Official academic records — enrollment information, grades, attendance, transcripts, and fee history — belong to your school, which sets how long they are kept under Ministry of Education requirements and its own rules. If your school ends its use of SchoolPort, we delete its records within 90 days unless the law requires us to keep them. Student health information is never copied into our archive of departed students.

In short. Parents: delete instantly in the app, or request by email at /delete-account. Students: through the school, closed within 14 days of confirmation.

Parents who created their account in the app can delete it entirely from inside the app: Settings → Account → Delete account. Deletion takes effect immediately — it removes your sign-in, profile, and links to students. If you no longer have the app, follow the steps on our account deletion page.

Student app access is provisioned by the school; students and their parents can request closure of a student login in the app or through the school office, and access is typically closed within 14 days of school confirmation. Deleting app access does not erase official academic records, which belong to the school.

In short. Download your data instantly in the app, correct or delete it, object to processing, withdraw consent. We answer within 30 days, free of charge.

Get a copy of your data, right now. In the mobile app, open Settings → Account → Download my data. This builds a machine-readable file of the personal data we hold about you — and, if you are a parent, the records of the students linked to your account. You do not need to ask us, and you do not need a reason.

You can also ask us to correct or delete your data, to restrict or object to processing, or to withdraw consent for anything based on it — such as notifications or the Kate assistant. Parents can delete their account entirely in the app. For official school records (including enrollment information and date of birth), we pass the request to your school, because the school decides what its records say; we will tell you when we have done so. To exercise any right, email the address in section 16. We respond within 30 days, and we never charge for a first request.

In short. Wherever you are, the rights above apply. Liberia, the EEA/UK, the US, Brazil, Canada, and India add specific rights and complaint routes.

SchoolPort is built for schools in Liberia, but parents use it from all over the world. Wherever you are, the rights above apply to you. Some places add more.

Liberia. The Data Protection Act 2026 governs how your personal information is collected, processed, stored and used. As its regulations and supervisory authority are established, you will be able to complain to that authority; until then, contact us and we will deal with the complaint directly.

European Economic Area and United Kingdom. You have the rights of access, rectification, erasure, restriction, objection, and data portability under the GDPR and UK GDPR, and the right to lodge a complaint with your national supervisory authority — or the UK Information Commissioner’s Office — as well as with us. Where we rely on legitimate interests, you may object and we will stop unless we have compelling grounds. Our legal bases are set out in section 4.

United States. We do not sell or share personal information, and we do not use it for targeted advertising or to build student profiles for any non-educational purpose — so there is nothing for you to opt out of. Where your school is subject to FERPA, we act as a school official under the school’s direct control and do not re-disclose education records. For children under 13, we rely on your school’s authorisation under COPPA rather than collecting consent from children. Residents of California and other states with privacy statutes may request access, correction, deletion, and portability as described above, free of charge and without discrimination for asking.

Brazil. You have the rights set out in Art. 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion, and information about with whom we have shared your data.

Canada, India, and elsewhere. You may access, correct, and request deletion of your data, withdraw consent, and complain to your national regulator — including the Office of the Privacy Commissioner in Canada and the Data Protection Board in India.

In short. A necessary consent cookie on the public site. No advertising cookies. Optional measurement is off until you allow it.

The public website uses one necessary first-party cookie to remember whether you allowed optional measurement. There are no advertising cookies and no third-party trackers. You can change or withdraw that choice in the Cookie Policy.

Optional measurement is a one-way conversion beacon to our own servers — page path, event name, and optional referrer only. It is not a tracker cookie, it does not assign a visitor identifier, and it does not run until you allow it (or if your browser sends Do Not Track or Global Privacy Control).

Fonts and all other assets on these public pages are served from our own domain.

Sign-in to the staff portal and the mobile app is a separate secure path and is not covered by the website Cookie Policy. Those products store a session so you stay signed in. The mobile app also stores cached records, offline submissions, and a push token in encrypted on-device storage, cleared when you sign out.

In short. Material changes are posted here with a new version date, and the app will ask you to accept the new version.

We will post any material change to this policy here and update the version date shown at the top. If a change materially affects how we use your data, we will ask you to accept the new version in the app before continuing — your acceptance of each version is recorded with its date, so there is never doubt about what you agreed to.

In short. privacy@schoolportsis.com — questions, requests, and complaints, answered within 30 days.

Questions, requests, and complaints — including any request to exercise the rights above: privacy@schoolportsis.com. A registered postal address will be published here when Liberian company registration is complete; until then, our data protection contact is that same email.

SchoolPort BLUE is published only in the Liberian and United States app stores and is intended for Liberian schools and their families, so we do not offer it for download in the European Economic Area or the United Kingdom. If you are in the EEA or the UK and use SchoolPort anyway — for example, you are a parent living abroad — you keep the rights described above and can exercise them by writing to the email above. We will appoint a representative under Article 27 of the GDPR if we become required to do so, and will name them here.

In short. Quick answers to what families ask most, each pointing to the binding section above.