Privacy Policy

1. Who is responsible for your data

Your school is in charge of school records. Each school decides what it records about its pupils, parents and staff, and is the data controller for those records. Termbell is the school's data processor: we store and process that data only to provide the service to the school and on its instructions.

We are in charge of our own records — the accounts of school owners who sign up, billing and payment records for our subscriptions, marketer accounts, support requests, testimonials and visits to our website. For these, Termbell is the data controller.

If you are a parent, pupil or staff member with a question about your school's records, please contact your school first. We will help the school answer you.

2. What we collect

• Pupils: name, admission number, date of birth, gender, photo, class, guardians, attendance, scores and report cards, online test answers, behaviour records, library loans and school-bus records — as entered by the school.
• Health and care notes (allergies, conditions, blood group, care notes), if the school records them. These are encrypted in our database.
• Parents and guardians: name, phone number, email, relationship, preferred language, pickup authorisations, and messaging preferences (including WhatsApp consent).
• Staff: name, contact details, role, classes and subjects, sign-in, leave and cover records, and payroll information including bank details (encrypted).
• Safe journey (only for parents who switch it on): the places a parent saves and the location taken at the moment a pupil presses “I'm home”. No location is tracked in the background. Places and positions are encrypted and visible only to that pupil's parents who agreed.
• Payments: amounts, references and receipts. Card and bank details are entered on Paystack's pages and are never stored by us.
• Messages: a log of notices sent (channel, delivery and read status) so schools can see what reached parents.
• Security and device data: IP address, browser details, sign-in attempts, an audit log of sensitive actions, the rough location of suspicious sign-in attempts, and, during online tests, signals such as leaving the page or using a second device.
• Things you send us: support requests, testimonials, and marketer details including payout bank details (encrypted).

3. Children's data

Most pupil records are about children. Schools are responsible for having a lawful basis and, where needed, parental consent for the records they keep. We use pupils' data only to provide the service to their school: we never sell it, never use it for advertising, and never build marketing profiles of pupils. Pupils are never asked for testimonials.

4. How we use data

• To provide the service: records, results, tests, attendance, fees, messages, safety features and portals.
• To send the notices a school or parent has chosen (free phone notifications, WhatsApp, SMS and email).
• To bill schools for their subscription and to pay marketers their commission.
• To keep the service secure: detecting break-in attempts, preventing fraud and cheating, and investigating problems.
• To answer support requests and improve the service.
• To meet legal, tax and accounting obligations.

Our lawful bases under the NDPA are: performing our contract with the school; legal obligations; our legitimate interests in running a secure, reliable service; and consent where it is required — for example Safe journey locations, WhatsApp messages, and showing a testimonial on our website. You can withdraw consent at any time.

5. AI features

Some features (report card remarks, parent result summaries, test questions, marking written answers, lesson notes, the Ask Termbell helper and filling a form from a document) use AI services. We send only what the task needs — for example pupils' first names and marks, never surnames, contact details or addresses. When matching an imported spreadsheet, only its column headings are sent. When a school chooses to have a photo, PDF, Word document or pasted list read for it (to fill a form or to import records, such as a photo of a class register), that page — with whatever it contains, including names and phone numbers — is sent to the AI provider to be read once; we do not keep the file, only the rows the school then reviews and imports. Spreadsheets, Word tables and copied spreadsheet cells are read without AI. AI drafts are always checked by a person before they are used. Schools can switch AI features off.

6. Who we share data with

We share data only with service providers that help us run Termbell, under contracts that require them to protect it:

• Railway — hosting, database and file storage.
• Paystack — school fee and subscription payments.
• Resend — email delivery.
• Meta (WhatsApp Business), Termii and Twilio — WhatsApp and SMS, when a school uses them.
• Google, Apple and Mozilla push services — delivering free phone notifications.
• AI providers (such as Groq, xAI and Anthropic) — only for the AI features described above.
• An IP-location service — to show the rough location of suspicious sign-in attempts.

We may also disclose data where the law requires it, or to protect the safety of pupils or others. We never sell personal data.

7. Data stored outside Nigeria

Some of our providers store or process data outside Nigeria. Where that happens we rely on the transfer grounds in Part VIII of the NDPA, including adequate protection in the receiving country or contractual safeguards with the provider.

8. How we protect data

• Every school's data is kept apart; no school can see another school's records.
• All traffic is encrypted; health notes, bank details, Safe journey places and backups are encrypted at rest.
• Passwords are stored as one-way hashes; platform administrators use two-step sign-in.
• Termbell support can only enter a school's workspace with a code the school gives, for a limited time, and every action is logged.
• Sign-ins and sensitive actions are rate-limited and recorded in an audit log.

If a breach puts personal data at risk, we will tell the affected schools without undue delay and notify the NDPC within 72 hours where the law requires.

9. How long we keep data

• School records: while the school's workspace is active. After a school closes its account, it has 30 days to export its data, and we delete it within 90 days after that unless the law requires us to keep it.
• Safe journey timeline: 7 days. Uploaded import files: 24 hours. Security records: 90 days.
• Backups: the most recent 14 daily backups.
• Billing and payment records: as long as tax and accounting law requires (generally 6 years).

10. Your rights

Under the NDPA you can ask for access to your personal data, correction, deletion, restriction, a copy in a portable format, and you can object to processing or withdraw consent. For school records, please ask your school (it can export and correct records itself); we will help it respond. For our own records, write to us at the address below. You can also complain to the Nigeria Data Protection Commission.

11. Cookies

We use only the cookies the service needs: to keep you signed in, to remember that this browser has signed in before, and to remember settings such as dismissed notices. We do not use advertising cookies.

12. Changes and contact

We will post any changes here and tell schools about important ones before they take effect.

Privacy questions or requests: privacy@termbell.com.