Privacy Policy

Last updated: 11 July 2026

EduPrefect (“we”, “us”) is a school-management platform operated by Caramel Cove Limited. This policy explains what personal data we process through our website, web app (app.eduprefect.com), and the EduPrefect Parent and Teacher mobile apps, and your rights under the Nigeria Data Protection Act, 2023 (NDPA).

Our role: schools are the data controller

EduPrefect is provided to schools. Each school decides what records it keeps and how they are used — it is the data controller. We process that data on the school’s behalf as a data processor, under a Data Processing Agreement signed at onboarding. Parents, teachers, and staff use accounts that are created and managed by their school; there is no public self-signup in the apps.

Information we process

Account & identity

Name, email address, phone number, role (proprietor, principal, teacher, bursar, parent, etc.), and the school(s) you belong to. Used to sign you in and show you the right information for your role.

School & student records

On the school’s behalf we process student enrolment, academic results, attendance, behaviour notes, and — where the school records it — basic health/allergy information. Guardian relationships and contact details are processed so schools can communicate with families.

Fees & payments

Invoices, payment and receipt records. Card and bank payments are handled by licensed processors (Paystack, Monnify) — we do not collect or store card details.

Communications

Messages, announcements, and notifications sent through the platform (in-app, SMS, email, and push), and their delivery status.

Device & technical data

When you enable notifications, the app registers a push notification token for your device so we can deliver school alerts. We also process basic device/operating-system information and diagnostic logs to keep the apps secure and working. The apps do not use third-party advertising or tracking SDKs, and we do not track you across other companies’ apps or websites.

How we use data

To provide and operate the service for your school; to deliver notifications and messages you’ve opted into; to process fee payments; to provide support; to keep the platform secure (including a full audit log on records); and to meet legal obligations.

Push notifications

The Parent and Teacher apps can send push notifications (e.g. fee receipts, attendance alerts, announcements, duty reminders). We register a device push token for this purpose. You can turn notifications off at any time in your device settings.

Legal basis (NDPA)

We process personal data to perform our contract with your school, to pursue legitimate interests in running and securing the service, to meet legal obligations, and — where required — on the basis of consent obtained by the school.

Who we share data with

We do not sell personal data. We share it only with: your school (the controller); payment processors (Paystack, Monnify) to take fee payments; messaging providers to deliver SMS, email, and push notifications; our infrastructure/hosting providers; and authorities where we are legally required to. All processors are bound to protect the data and use it only as instructed.

Children’s data

Student records often relate to minors. We process them strictly on the school’s instructions and to support the child’s education. We minimise what we collect, log access to a minor’s record for accountability, and never use children’s data for advertising. Parents exercise rights over their child’s data through the child’s school.

Retention, deletion & account closure

We keep data for as long as the school’s account is active or as the school requires to maintain its records, then delete or anonymise it in line with the school’s instructions and the NDPA.

Because accounts are provisioned by schools, you can request account deactivation or deletion by contacting your school’s administrator/registrar, or by emailing us at [email protected]. Parents and guardians may also request deletion or erasure of personal data associated with their child. Because schools are the data controller for school and student records, we may need to verify or route requests through the school. Official school records may be retained, anonymised, or handled by the school where required by law, accounting obligations, safeguarding duties, school policy, or our contract with the school.

Schools can export their full data and request erasure or anonymisation of records at any time, subject to applicable retention requirements.

Security

Role-based access control, a full audit log on every record, and encryption in transit and at rest. Access to a minor’s record is logged. Payments run through licensed processors so card data never touches our systems.

International transfers

Our infrastructure may process data on servers located outside Nigeria. Where data is transferred, we use providers that apply appropriate safeguards consistent with the NDPA.

Your rights

Subject to the NDPA, you may request access to, correction of, erasure of, or a portable copy of your personal data, and you may object to certain processing. Because your school is the data controller, please raise requests through your school; you can also contact us and we’ll route it appropriately. Some official school records may need to be retained or anonymised instead of deleted where legally or contractually required.

Changes to this policy

We may update this policy as the service evolves. We’ll revise the “last updated” date above and, for material changes, notify schools.

Contact us

EduPrefect is operated by Caramel Cove Limited. For privacy questions or data requests, email [email protected] or message us on WhatsApp. Need help using the app? See our Support page.