Privacy Policy

1. Two roles, and who is responsible

Your school's data (students, guardians, payments). When a school uses SchoolPurse to record its students, guardians, invoices and payments, the school is the data controller — it decides what data to hold and why. SchoolPurse is the data processor: we only process that data on the school's instructions to provide the service. How we do that is set out in our Data Processing Agreement.

Staff account data. For the accounts of the school staff who sign in (name, email, role), SchoolPurse acts as the controller, and this Privacy Policy governs that data.

2. What we collect

Staff accounts

• Name, email address and assigned role (head, bursar, teacher).
• Authentication data and sign-in activity (handled by our auth provider).
• Basic product-usage analytics — only if you consent to analytics cookies (see section 9).

School records (processed for the school)

• Students: names, dates of birth, gender, class, enrolment dates and optional photographs.
• Guardians / parents: names, phone numbers, email addresses and home addresses.
• Finance: invoices, fee items, payments (cash, bank transfer, mobile money), receipts, arrears and expenses.

3. How we use data

• To provide, secure and support the SchoolPurse service.
• To let bursars and heads invoice fees, record payments, issue receipts and track arrears.
• To send transactional emails (invites, receipts, notices).
• On the AI plan only, and where enabled: to power the AI finance assistant and send WhatsApp fee reminders.
• To meet legal and accounting obligations.

We do not sell personal data, and we do not use school records for advertising.

4. Legal basis

We process personal data under the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe: to perform our contract with the school, to meet legal obligations, for our legitimate interest in operating and securing the service, and — for analytics cookies — with your consent. Schools are responsible for obtaining any parental consent required for the student data they enter.

5. Where your data is stored (international transfer)

Personal data in SchoolPurse is stored in London, United Kingdom (Supabase, eu-west-2), and some sub-processors operate in the United States or the EU (see section 7). This means data may be transferred outside Zimbabwe. We rely on contractual safeguards with our providers and take reasonable steps to ensure a comparable level of protection, consistent with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe.

6. How long we keep it

We keep school records for as long as the school has an active account, plus a reasonable period afterwards for backups, dispute resolution and legal/accounting requirements. Voided receipts are never hard-deleted so the audit trail stays intact. When a school closes its account, we return or delete its data on request, subject to legal retention periods.

7. Who we share data with (sub-processors)

We use a small set of trusted providers to run the service. They may only process data to provide their service to us. The current list is in the Data Processing Agreement, and includes our database/hosting, email, billing, analytics and (on the AI plan) AI and messaging providers. We otherwise disclose data only where required by law.

8. Security

• All traffic is encrypted in transit (HTTPS).
• Each school's data is isolated using database row-level security, so one school can never see another's.
• Access is role-based — a teacher sees students but not finance; only the head/admin can change settings or correct income.
• Student photos are served via short-lived signed links only.

9. Cookies & analytics

We use a strictly-necessary cookie to keep you signed in. We also use PostHog for product analytics — but only if you accept analytics cookies in the consent banner. You can decline, and you can change your mind at any time; declining does not affect your ability to use SchoolPurse.

10. Your rights

Under the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe you may request access to your personal data, ask us to correct or delete it, or object to certain processing. For student or guardian records, contact the school (the controller) first; we will support the school in responding. To exercise any right, email support@schoolpurse.app.

11. Children's data

SchoolPurse holds data about children because schools record their students. Students and parents do not have logins — only school staff do. Schools are responsible for the lawful basis (including any parental consent) for the student data they enter, and we process it strictly on their instructions with the safeguards above.

12. Breach notification

If a personal-data breach occurs that is likely to affect you or a school's data, we will notify the affected school(s) and, where required, POTRAZ — the Postal and Telecommunications Regulatory Authority of Zimbabwe (Zimbabwe's Data Protection Authority), without undue delay.

13. Changes

We may update this policy; we will change the "last updated" date above and, for material changes, notify schools by email.

14. Contact & complaints

Questions or complaints: email support@schoolpurse.app. You also have the right to lodge a complaint with POTRAZ — the Postal and Telecommunications Regulatory Authority of Zimbabwe (Zimbabwe's Data Protection Authority).