Ednaro

Privacy Policy

Last updated 1 November 2026

In short: your school decides what goes into Ednaro and owns it. We look after it for the school, keep each school's records separate from every other school's, never sell it, never use it for advertising, and only share it with the few services we need to run Ednaro. Parents and students with a question about their records should start with their school.

1. Who we are

Ednaro ("Ednaro", "we", "us") provides school management software to schools in Nigeria. You can reach us at info@ednaro.com or on +234 807 755 5789. Questions about this policy or your data can be sent to the same address, marked "Data protection".

2. Schools are in charge of their records

Under the Nigeria Data Protection Act 2023 (NDPA), the school is the data controller for the records it keeps in Ednaro about its students, parents and staff. It decides what to record and why. Ednaro is the school's data processor: we store and process those records only to provide the service, on the school's instructions and under our Terms.

Ednaro is the controller only for the small amount of data we collect for ourselves: enquiries from our website (such as a demo request), and the contact details of the people who manage a school's subscription with us.

3. What is collected

About students

  • Name, gender, date of birth, home address, admission number, photo (if the school adds one).
  • Class, subjects, attendance, scores, quiz answers, report cards, comments and behaviour ratings.
  • Fee invoices, payments and balances.
  • Sign-in details, if the school gives the student an account.

About parents and guardians

  • Name, email address, phone number, relationship to the student, and sign-in details.
  • Records of fee payments made through Ednaro.

About staff

  • Name, email address, phone number, date of birth, home address, role and class or subject assignments.
  • Sign-in details, including two-factor authentication for administrators.

Collected automatically

  • A record of important actions (for example, who changed a score and when, or who approved a report card), so schools can see what happened.
  • Technical error reports when something goes wrong. These contain the page and the error, not the contents of forms.
  • Inside Ednaro (once you sign in): only essential cookies that keep you signed in. There are no advertising or tracking cookies and no third-party analytics there, so nothing about students, parents, staff or school records ever reaches an advertiser.

On our public website pages

On our public pages (the home page and the pricing page), we ask before using any tracking cookie. If you choose “Accept”, Meta (Facebook and Instagram) cookies and the Meta Pixel measure which of our ads bring schools to us: the pages you visit and whether you contact us or request a demo. If you then request a demo, we also tell Meta about it from our server, with your email and phone number scrambled (hashed) first, so Meta can match it to its ads without us sending the details themselves. If you choose “No thanks”, none of this happens. When you arrive from one of our ads, the ad's name is kept on your device for 30 days and saved with your demo request, so we know which ad you came from. To change your choice, use “Cookie choices” at the bottom of the home page.

We do not collect payment card details. Schools pay their Ednaro subscription by card through Paystack, which handles the card entirely; Ednaro only receives a confirmation that the payment succeeded. Parents pay school fees directly to the school; Ednaro only keeps the record of a payment the parent or school enters (amount, date, reference and, if provided, a proof-of-payment image).

4. Why it is used, and on what legal basis

  • Running the school's day-to-day work: registers, scores, report cards, fees, messages to families. Basis: our contract with the school, and the school's own lawful basis (usually its contract with parents and its legitimate interest in educating its students).
  • Keeping accounts secure: sign-in, password reset, two-factor authentication, action history, error monitoring. Basis: legitimate interest and legal obligation to keep data secure.
  • Optional AI-drafted report comments, if the school leaves AI suggestions switched on: when a teacher asks for a draft comment, the student's class, gender, grades, attendance and behaviour ratings for that term are sent to Google Gemini to write a suggestion. The student's name is not sent (we add it to the suggestion afterwards), and neither is any surname, address, contact detail or photo. A teacher always reviews and can rewrite the comment before it appears on a report card. Google may use what is sent; see section 6. Basis: the school's legitimate interest in reducing staff workload. A school can switch AI suggestions off at any time in Setup, and then nothing is sent.
  • Optional AI help with lesson notes, under the same school switch: when a teacher asks, the lesson's subject, class, topic, length and text, and the teacher's previous lesson for that class, are sent to Google Gemini to draft lesson content or an assignment. No student information is sent. The teacher reviews and edits every draft; nothing is shared with students or submitted by the AI. Google may use what is sent; see section 6.
  • Text messages to parents, if the school turns them on: absence alerts, report card notices, fee reminders and announcements, sent to the parent's phone number.
  • Replying to enquiries made through our website. Basis: your consent and our legitimate interest.

We never sell personal data, use it for advertising, or combine one school's records with another's.

5. Children's data

Most students are under 18. Schools add student records as part of running the school, and are responsible for having the consent of a parent or guardian where the NDPA requires it (for example, for publishing a student's photo). Parents can see their own children's records through their parent account. Students only see their own records.

6. Who else handles the data

We use a small number of service providers. Each is bound to protect the data and use it only to serve us, except Google Gemini, explained below:

  • Supabase: database, sign-in and file storage. Hosted in Frankfurt, Germany (European Union).
  • Vercel: runs the Ednaro website and application.
  • Resend: sends emails such as invitations, password resets and announcements.
  • Paystack: processes schools' Ednaro subscription payments.
  • Meta (Facebook and Instagram): measures our adverts, only for visitors to our public pages who accept its cookies, and for demo requests they then make (see “On our public website pages” above). Meta acts as an independent controller under its own terms. It never receives any school's records.
  • Termii: sends text messages to parents (a phone number and a short message), where a school turns them on.
  • Google (Gemini): drafts report comments and lesson-note content, only when a teacher asks and only if the school has AI suggestions switched on. We currently use Google's free Gemini service. Under its terms, Google may use what we send and the drafts it returns to provide and improve its products and AI models, and its reviewers may read them after Google has separated them from our account. This is why we send only what a comment needs and never the student's name or contact details. A school that doesn't want this can switch AI suggestions off in Setup; staff then write every comment themselves.

Some of these providers store or process data outside Nigeria. Where they do, we rely on the transfer safeguards in Part VIII of the NDPA: the destination has adequate data-protection law (for example, the European Union's GDPR) or the provider is bound by contract to protect it to that standard. We may also disclose data where the law requires it, for example in response to a valid court order.

7. How it is protected

  • Every connection to Ednaro is encrypted (HTTPS).
  • Each school's records are separated at the database level, so staff of one school cannot see another's. Inside a school, people only see what their role needs: a teacher sees their own classes, a parent sees their own children.
  • Administrators must use two-factor authentication.
  • Passwords are never stored in readable form, and sign-in links expire and can only be used once.
  • Important changes are recorded so they can be reviewed.

If a breach puts people's data at risk, we will tell the affected school without delay so it can meet its obligations, and notify the Nigeria Data Protection Commission within 72 hours where the NDPA requires it.

8. How long it is kept

School records are kept for as long as the school uses Ednaro, so that past report cards, results and fee history remain available. When a student leaves, their history is kept (schools often need it for transcripts and references) unless the school asks for it to be removed. When a school stops using Ednaro, it can export its records, and we delete them within 90 days of the agreement ending unless the law requires us to keep something longer. Backup copies are overwritten on a rolling basis after that. Website enquiries are kept for up to two years.

9. Your rights

Under the NDPA you have the right to:

  • be told how your data is used (this policy);
  • get a copy of your data;
  • have wrong or incomplete data corrected;
  • have data deleted, or its use restricted, where the law allows;
  • object to some uses, and withdraw consent you have given;
  • receive your data in a commonly used format;
  • complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Because the school controls its records, please send requests about school records to your school; we will help the school respond. You can also write to us at info@ednaro.com and we will pass your request to the school or deal with it ourselves where we are the controller. We aim to reply within 30 days.

10. Changes to this policy

If we make an important change, we will tell schools before it takes effect. The date at the top of this page shows when it was last updated.