Version v1
Privacy Policy
AcademicLog Technologies Limited · Last updated Oct 22, 2026 ·
1. Introduction
AcademicLog Technologies Limited (“AcademicLog,” “we,” “us,” “our”) provides a school management platform used by schools (“Schools”) in Nigeria to manage student records, academic results, attendance, communication, and fee collection.
This Privacy Policy explains what personal data we collect, why, how it is used and shared, how long it is kept, and the rights available to individuals whose data we process, in accordance with the Nigeria Data Protection Act, 2023 (“NDPA”) and applicable regulations issued under it.
This Policy applies to School administrators and staff, students, and parents/guardians whose data is processed through the Service, as well as visitors to our public website.
2. Our Role: Controller and Processor
In general terms, and pending confirmation:
- With respect to School Data (student records, staff records, results, attendance, and related data that a School inputs into or generates through the Service), AcademicLog acts as a data processor, processing that data on the School’s instructions and on the School’s behalf as data controller. The respective obligations of AcademicLog and the School in this regard are set out in the Data Processing Agreement between AcademicLog and each School.
- With respect to data AcademicLog collects for its own purposes — such as billing and account data, Wallet transaction records, and website analytics — AcademicLog acts as a data controller.
3. Information We Collect
3.1 Information about Schools and their staff
- Name, role, and contact details (email, phone) of School administrators and staff who register or are added to the Platform. Administrators’ email addresses are also used for billing receipts, reminders, and renewal confirmations.
- Login credentials and authentication data.
- School institutional details (name, address, registration information).
3.2 Information about students
- Full name, date of birth, gender, class/grade level, and enrollment details.
- Academic records, including grades, results, report cards, and attendance records.
- Guardian/parent contact information linked to the student.
- Photographs, where a School chooses to upload them (e.g., for ID or report card purposes).
- Where the School enables student sign-in, a username (the student’s admission number) and a password.
3.3 Information about parents/guardians
- Name and contact information (email, phone). The phone number is also the guardian’s sign-in username, together with a password.
- Relationship to student(s).
- Communications sent or received through the Platform’s parent-facing features, where enabled, including announcements delivered to the guardian’s portal.
3.4 Payment and billing information
- Wallet balance and transaction history (deposits, debits, refunds).
- Payment references and status from our payment provider, Monnify.
- For each transfer that funds a Wallet: the payer’s name, bank, and a masked account number as reported by the payment provider, the amount, and the date.
- The name and email address of the School’s proprietor or bank signatory, given when the School’s permanent account numbers are created. The email address is also used for payment receipts and renewal notices.
- The National Identification Number (NIN) or Bank Verification Number (BVN) of that proprietor or signatory, which is needed to create the account numbers. We pass it straight to our banking partner to create the account and never store it. Only the type of ID and the date it was submitted are kept with us, as a record that the step was completed.
- Records of Plan purchases, automatic renewals, and promo codes used, and of the receipts, reminders, and renewal confirmations we send.
- We do not directly collect or store full payment card or bank account credentials; these are handled by our payment providers under their own security and privacy practices.
3.5 Technical and usage information
- IP address, browser/device type, and access timestamps.
- Usage logs necessary for security, troubleshooting, and service improvement.
3.6 Website visitor information
- Basic analytics and contact-form submissions from visitors to our public website who are not yet registered Schools.
4. Children’s Data
Much of the data processed through the Service relates to students who are minors. We recognize this requires particular care.
- School Data relating to students is submitted to the Platform by the School, acting as data controller, which is responsible for ensuring it has the appropriate legal basis — including any required parental/guardian consent — to submit such data under applicable law and its own policies.
- We do not knowingly collect data directly from students for purposes unrelated to the School’s use of the Service (e.g., we do not use student data for advertising).
5. How We Use Information
We use the information described in §3 to:
- Provide, operate, and maintain the Service, including generating results, report cards, attendance records, and Wallet/billing functionality;
- Authenticate users and secure Accounts;
- Process payments and maintain accurate billing and Wallet records, including renewing a School’s Plan automatically from its Wallet as described in the Terms of Service;
- Communicate with School administrators, staff, and (where features are enabled) parents/guardians about the Service, including service notices, payment receipts, billing reminders, renewal confirmations, and support;
- Monitor, maintain, and improve the security, reliability, and performance of the Service;
- Comply with legal obligations, including recordkeeping obligations described in §8; and
- Investigate and prevent fraud, abuse, or violations of the Terms of Service.
We do not sell personal data, and we do not use student data for behavioral advertising.
6. Legal Basis for Processing
7. How We Share Information
We share personal data only as described below, and never sell it.
7.1 Payment providers
Wallet top-ups and disbursements are processed through Monnify, to whom relevant billing and transaction data is shared solely to complete those transactions. This includes the name, email address, and NIN or BVN of the School’s proprietor or signatory when the School’s account numbers are created (the NIN or BVN is passed on and is not kept by us). Monnify processes data under its own privacy policy and, where applicable, as an independent controller or processor in its own right
7.2 Hosting and infrastructure providers
We use third-party hosting and infrastructure providers to operate the Service:
| Provider | Purpose | Personal data involved |
|---|---|---|
| Cloudflare | DNS, content delivery, and traffic security | IP addresses and request data in transit |
| Brevo | Delivery of email notices such as receipts and reminders | Recipient names and email addresses, and the email content |
| Storage of database backups | Backups of School Data | |
| Sentry | Error monitoring | Error reports, which may contain user identifiers |
| Better Stack | Uptime and backup monitoring | Monitoring signals, not School Data |
7.3 Legal and safety disclosures
We may disclose information where required by law, regulation, court order, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of AcademicLog, our users, students, or the public.
7.4 Business transfers
If AcademicLog is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy providing at least equivalent protection.
7.5 No sale of data
We do not sell, rent, or trade personal data to third parties for their own marketing purposes.
8. Data Retention
Pending that determination, our intended framework is:
- Active Subscription. School Data is retained for as long as the School’s Subscription is active.
- Post-termination. Following termination or cancellation of a Subscription, School Data is retained for 90 days to allow the School to request export, after which it is deleted or anonymized, unless a longer period is required by law. Deletion covers student, staff, and report card data.
- Wallet transaction records. Retained for accounting and audit purposes. When School Data is deleted, the personal details in these records (names, email addresses, bank account details, and raw payment payloads) are removed, and the amounts, dates, payment references, and our own account numbers are kept.
- Held Wallet balances on cancelled, inactive Accounts. Balances remaining twelve (12) months or more after cancellation, below a defined threshold, with no withdrawal request, are handled per the process described in the Terms of Service §7.3 — surfaced for manual administrative review, never automatically cleared, and logged for audit purposes.
- Acceptance records. Records of Terms of Service and Privacy Policy acceptance (§3.3 of the Terms) are retained for as long as necessary to demonstrate compliance, including after Account termination.
- Backups. Deleted data may remain in backups until they are replaced in the normal backup cycle. Maximum of six months.
9. Your Rights
Subject to applicable law and the exceptions and limitations it provides, individuals whose personal data we process have the right to:
- Be informed about how their personal data is processed (this Policy is part of that);
- Access a copy of their personal data;
- Request correction of inaccurate or incomplete data;
- Request deletion of their personal data, subject to our retention obligations described in §8;
- Object to or request restriction of certain processing;
- Request data portability, where applicable;
- Withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
- Lodge a complaint with the Nigeria Data Protection Commission.
For students and other minors, these rights are ordinarily exercised by a parent or guardian on the student’s behalf, or by the School as appropriate.
To exercise these rights, contact us using the details in §14.
10. Data Security
We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including access controls that isolate each School’s data from other Schools on the Platform, encryption in transit, and authentication safeguards. In particular:
- Passwords are stored in hashed form, and sign-in attempts are rate-limited.
- Optional two-factor authentication is available to School administrators.
- Guardian and student accounts can see only the records linked to them.
- AcademicLog staff access to a School’s account for support is logged and time-limited.
- The NIN or BVN used to create payment account numbers is passed to our banking partner and not stored.
- Backups are taken regularly and restore-tested.
No system is completely secure, and we cannot guarantee absolute security.
11. Data Breach Notification
In the event of a personal data breach that poses a risk to the rights and freedoms of affected individuals, we will notify the Nigeria Data Protection Commission and affected Schools (and, where we act as controller, affected individuals) in accordance with the timelines and requirements of the NDPA.
12. International Data Transfers
13. Data Protection Officer
AcademicLog’s designated contact for data protection matters is: [email protected]
14. Contact Us
For questions about this Privacy Policy or to exercise a data subject right, contact:
AcademicLog Technologies Limited Email: [email protected]
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to Schools by before taking effect. Each version of this Policy will be dated, and the version a School has accepted will be recorded as described in the Terms of Service.
16. Cookies and Similar Technologies
The public website and/or Platform use cookies, analytics, or similar tracking technologies. In the Platform, essential cookies keep users signed in and protect forms from forgery, and a display preference such as light or dark theme is remembered. The Platform’s mobile app stores only a small offline page and its own interface files, never student data.