Privacy Policy

Last updated 15 October 2026

SkoolBase is a school management platform used by schools in Ghana. This policy explains what information the platform handles, why, who it is shared with and the choices you have. It applies to the SkoolBase web app, including the parent portal.

1. Who is responsible

Your school decides what is recorded. Each school that uses SkoolBase decides which student, guardian and staff information it records and why. For that information the school is the data controller and SkoolBase processes it on the school's behalf and on its instructions.

For the accounts of school administrators, subscription billing and the security of the platform itself, SkoolBase is responsible for the information it handles.

2. Information we handle

Accounts (administrators, teachers and staff)

Name, email address, phone number (optional), job title, staff number and role at the school.
Sign-in data: passwords are handled by our authentication provider and never stored by SkoolBase in readable form. Two-factor authentication is required; recovery codes are stored only as keyed one-way hashes.

Student and guardian records (entered by the school)

Students: full name, Student ID, date of birth, gender, place of stay, photograph (optional), class, admission details and status.
Guardians: name, relationship, phone number and emergency phone number.
School records: attendance, timetables, homework and teachers' marking of it, examination dates, marks, grades, report-card comments and published report cards, fee charges, payments, receipts and balances.

Employees without accounts

Schools can keep simple records of employees who do not sign in (for example drivers, cooks or security staff): name, job title, contact details and employment dates.

Staff and employee administration

Staff attendance (daily status and check-in/out times) and leave requests with their dates, reasons and decisions.
Payroll: salary, allowances, deductions, payment method and account details entered by the school, and the payslips it issues. Staff can see only their own payslips, and only after the school finalises the month.
The head teacher's name and, optionally, a signature image printed on report cards.

Messages and payments

SMS messages a school sends to guardians, including their content, recipients and delivery status.
Subscription and SMS-credit payments are processed by Paystack. SkoolBase stores the payment reference, amount, purpose and status. We never receive or store card or mobile-money PINs.

Security and technical information

An audit log of important actions (who did what and when, the outcome, and the IP address and browser type where available). Passwords, PINs, tokens and SMS bodies are never written to the audit log.
For parent sign-in and school registration we record attempts to protect against abuse; IP addresses for these checks are stored as keyed hashes rather than in readable form.

3. How it is used

To provide the service your school has chosen: admissions, attendance, timetables, homework, examinations, report cards, fees, payroll, staff attendance and leave, reports and messaging.
To keep accounts and records secure, detect misuse and investigate problems.
To bill schools for subscriptions and SMS credits.
To send service messages, such as account invitations and password-reset emails.
To meet legal obligations.

We do not sell personal information, show advertising or use school records to build marketing profiles.

4. The parent portal

Parents and guardians sign in with the Student ID and a 6-digit PIN issued by the school. PINs are stored only in a hashed form that cannot be reversed, and repeated wrong attempts are locked out. A portal session lasts 30 minutes, only works in the browser tab where it was opened, and gives read-only access to that one student. Fee information is shown only if the school has enabled it.

We use a small number of providers to run SkoolBase. They process information only to provide their service to us:

Supabase: database, sign-in and private file storage (for example student photos and school logos).
Vercel: hosting of the web app and its server functions.
Paystack: payment processing for subscriptions and SMS credits.
Hubtel: delivery of SMS messages using the school's own Hubtel account and approved Sender ID.

These providers may process information outside Ghana. We do not share personal information with anyone else unless the law requires it.

6. Storage on your device

SkoolBase does not use advertising or analytics cookies. The app stores only what it needs in your browser:

Your sign-in session (in local storage), so you stay signed in. You are signed out automatically after 30 minutes without activity.
A parent portal session (in session storage), which ends when the tab is closed.
Optional conveniences: your email address if you tick "Remember my email", and whether the sidebar is collapsed.
An offline copy of the app's design and code.
For teachers and administrators who take attendance: the class lists of their classes (each student's name and Student ID) and any registers taken without a connection, so attendance can be taken offline. Unsent registers are sent automatically when the connection returns. All of this is deleted from the device when you sign out. Guardian, fee, payroll and other records are never stored for offline use.

7. Security

All traffic is encrypted with HTTPS.
Two-factor authentication is mandatory for every staff and administrator account.
Each school's records are separated at the database level, so one school can never read another's records. Platform administrators cannot see student, guardian or school-fee records.
Teachers only see the classes they are assigned to.
Files are kept in private storage and shown through short-lived links.
Payment and SMS provider credentials stay on our servers, and SMS credentials are encrypted.

No system is perfectly secure. If we become aware of a breach affecting personal information, we will inform the affected schools and act as the law requires.

8. Retention

School records are kept for as long as the school uses SkoolBase and needs them. Payments and receipts cannot be edited, because they are financial records; mistakes are corrected with reversals or adjustments, or a school administrator can delete a payment recorded in error, which is noted in the audit log with the reason. Expense records are deleted automatically 3 years after the date of the expense. Audit entries cannot be edited or deleted. When a school leaves SkoolBase it can export its records, and information is then deleted or kept only where the law requires it.

9. Your rights

Under Ghana's Data Protection Act, 2012 (Act 843) you can ask to access the personal information held about you, to correct it, or to object to or limit its use.

Parents, guardians, students and employees: please contact the school first, because it controls these records and can correct them directly.
Account holders: you can update your name and phone number in Profile & Security. For anything else, ask your school administrator, who can contact SkoolBase support for you.

You can also complain to the Data Protection Commission of Ghana.

10. Children

Students do not create accounts. Their information is entered by their school for school administration, and parents or guardians view it through the parent portal.

11. Changes and contact

We may update this policy as the service changes. The date at the top shows the latest version, and significant changes will be announced to schools in the app.

Questions about a student's or employee's records should go to the school. School administrators can contact SkoolBase support about this policy or the platform.