Privacy Policy

1. Who We Are

Cakale EDU is a cloud-based educational management system (EMS/LMS) designed to help schools manage academic operations, student records, staff, communications, finance, and more. Cakale EDU is operated by Cakale EDU and is accessible via our web platform and mobile application.

For privacy-related inquiries, please contact us at: support@cakale.com

2. Information We Collect

We collect different categories of information depending on how you interact with Cakale EDU:

a. Account & Identity Information

• Full name, email address, and phone number
• Password (stored as a one-way bcrypt hash — never in plain text)
• Profile picture (uploaded to secure cloud storage)
• Role within each school (Super Admin, School Admin, Staff, Student, or Parent)
• Job title, department, and staff category (for staff members)
• Grade level and class section (for students)

b. School & Institutional Information

• School name, registration code, address, city, and country
• School logo, contact email, phone, and website
• Current academic session, term structure, and active term
• Subscription plan and billing history

c. Academic & Performance Data

• Assessment scores, grades, GPA, class positions, and term results
• Timetables, classroom assignments, and subject enrolments
• Assessment attempts, submitted answers, and proctoring data
• Student reports including behaviour ratings, remarks, and strengths/improvement areas
• Attendance records including clock-in/out times, location coordinates, and approval status

d. Financial & Payment Data

• Student fee records, balances, and payment history
• Staff salary structures, allowances, deductions, and payroll records
• School financial accounts, budgets, and transaction ledgers
• Payment method details processed via Stripe or Paystack (we do not store raw card numbers — payment processors handle card data under their own PCI-DSS compliance)

e. Communications & Content

• Messages sent via direct message, group chats, and classroom channels
• Announcements, news articles, and comments posted on the platform
• Enquiries submitted by parents and school replies
• Job postings, applications, interview notes, and offer details

f. Uploaded Files

• Enrollment documents submitted during student application (stored securely on Cloudflare R2)
• Job application CVs and supporting documents
• Member documents uploaded by school administrators or via upload link
• Library resources (PDFs, Word documents, spreadsheets) shared with school members
• Assessment proctoring video recordings

g. Technical & Usage Data

• IP address, browser type, and operating system
• Pages visited, features used, and session duration
• Device identifiers when using the mobile application
• Login timestamps and last-seen activity for security purposes

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: Creating and managing user accounts, school registrations, classrooms, and academic records
• Academic Operations: Tracking assessments, scores, results, attendance, timetables, and generating term reports
• Communications: Delivering in-app messages, announcements, notifications, and email alerts (e.g., enrollment status, report approvals, password resets)
• Financial Management: Processing fee payments, generating payroll, managing budgets, and tracking transactions
• Security: Authenticating users, detecting fraudulent activity, enforcing role-based access control, and protecting sensitive school and student data
• Platform Improvement: Analysing usage patterns to improve features, fix bugs, and build a better product
• Legal Compliance: Meeting our obligations under applicable laws and responding to lawful requests from authorities

4. Role-Based Access to Data

Cakale EDU enforces strict role-based access control (RBAC). Data visible to each user depends entirely on their assigned role within a school:

• Super Admins & School Admins: Full access to all school data including student records, staff payroll, finance, reports, and assessments
• Staff: Access to their own classrooms, assigned students’ academic data, assessments they created, and personal attendance/payroll
• Students: Access to their own grades, scores, results, timetables, assigned assessments, and personal attendance
• Parents: Access to their linked children’s academic information and their own enquiry history

No user can access data outside their assigned role scope. The Cakale EDU platform team has administrative access to all data for support and maintenance purposes only, under strict internal policies.

5. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

• Within Your School: Data is shared among authorised members of your school according to role-based permissions described above
• Service Providers: We use trusted third-party providers to operate Cakale EDU, including:
  • Cloudinary — profile pictures, school logos, and question bank images
  • Cloudflare R2 — member documents, library files, enrollment documents, and job application files
  • Stripe & Paystack — subscription and fee payment processing
  • Email provider (SMTP/SendGrid) — transactional email delivery
• Legal Requirements: We may disclose data if required by law, court order, or government authority
• Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the acquiring entity, with equivalent privacy protections in place

6. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• All passwords are hashed using bcrypt — plain text passwords are never stored or logged
• Authentication tokens (JWT) are stored in HttpOnly cookies, protecting against cross-site scripting (XSS) attacks
• All data in transit is encrypted using TLS (HTTPS)
• File uploads are stored in access-controlled cloud storage (Cloudinary and Cloudflare R2) with signed URLs for sensitive documents
• Role-based access control is enforced at both the API and database levels
• Payment card data is handled exclusively by PCI-DSS-compliant payment processors

While we employ industry-standard security practices, no system is completely immune to risk. We encourage you to use a strong, unique password and to contact us immediately at support@cakale.com if you suspect any unauthorised access.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. School data (academic records, financial history, communications) is retained for the duration of the school’s active subscription. Upon account deactivation or subscription termination, we may retain data for up to 90 days for backup and legal compliance purposes before permanent deletion.

Enrollment and job application documents are automatically deleted from storage 7 days after a final decision (acceptance or rejection) is made, except where they have been imported into the school’s member document records.

8. Children's Privacy

Cakale EDU is designed to be used in school environments, which means it may be used by students who are minors. We take special care with children’s data:

• Student accounts are created and managed by school administrators — not by the students themselves
• Student data is accessible only to authorised school staff, administrators, and the student’s linked parents or guardians
• We do not use student data for advertising or profiling purposes
• We do not knowingly collect personal information from children under 13 outside of a school-administered context. Schools are responsible for obtaining appropriate parental consent before enrolling minor students on the platform.

9. Cookies & Tracking

Cakale EDU uses HttpOnly cookies to store authentication tokens securely. We do not use third-party advertising cookies or tracking pixels. Usage analytics may be collected to improve the platform; this data is anonymised and not linked to individual identities.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Request your data in a portable, machine-readable format
• Restriction: Request that we limit processing of your data in certain circumstances
• Withdrawal of Consent: Opt out of non-essential communications at any time via your account settings

To exercise any of these rights, contact us at support@cakale.com. We will respond within 30 days.

11. International Data Transfers

Cakale EDU is operated from Nigeria and primarily serves educational institutions across Africa. Your data may be processed by our cloud service providers in data centres outside your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place to protect your data in accordance with applicable privacy laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify users via email or an in-app notification and update the “Last Updated” date at the top of this page. Continued use of Cakale EDU after the effective date of any update constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to us:

• Email: support@cakale.com
• Website: www.cakale.com