Privacy policy

Last updated 14 November 2026

• Who we are
• Schools and PupilBook
• What we keep
• Why we use it
• Where it is stored
• Who can see it
• How long we keep it
• How we protect it
• Your rights
• Children
• Cookies and the browser
• Changes to this policy

Who we are

PupilBook is school management software for private basic schools in Ghana. In this policy, "we" means PupilBook. You can contact us about privacy at [email protected].

Schools and PupilBook

Each school that uses PupilBook decides what it records about its pupils, parents and staff, and is the data controller for those records under Ghana's Data Protection Act, 2012 (Act 843). We store and process the records for the school, on its instructions, as its data processor. We don't sell them, use them for advertising, or share them with other schools.

For the details people send us through this website, and for the accounts of PupilBook's own staff, we are the data controller.

What we keep

• Pupils: name, date of birth, sex, class, admission details, attendance, scores, report cards, fees, payments and balances, and anything else the school adds, such as photos, medical notes or documents.
• Parents and guardians: name, phone number, relationship to the pupil, and the texts the school sends them.
• Staff: name, role, classes, sign-in name, and, where the school uses payroll, pay and SSNIT details.
• Sign-in and safety records: when and from which device people sign in, and a log of changes made, so a school can see who did what.
• This website: what you type into our forms, and the network address it came from, used only to stop abuse.

Why we use it

• To run PupilBook for the school: registers, fees, receipts, report cards, payroll and texts to parents.
• To keep it safe: two-step sign-in, logs of changes, backups and stopping misuse.
• To give support when a school asks for help. Our staff only open a school's records when the school asks, and every such visit is logged.
• To reply to you when you send a form on this website.

Schools use PupilBook to carry out their work of educating pupils and to keep the records they are required to keep. We process website requests because you asked us to get in touch.

Where it is stored

Records are stored by Supabase in data centres in London, United Kingdom, and encrypted backup copies are kept in Microsoft Azure in the United Kingdom. Our web pages are delivered by Cloudflare. Emails to our addresses are forwarded through Cloudflare to Google mail. When a school sends texts, the phone numbers and messages go to our SMS provider for delivery.

Because some of these services are outside Ghana, we only use providers that protect data to a standard at least as strict as Act 843, under contracts that limit them to providing their service to us.

Who can see it

• Inside a school, staff see what their role needs: a class teacher sees their class, a bursar sees fees, and the head teacher and proprietor see everything.
• Parents receive the texts and report cards the school sends them.
• Our service providers, named above, only to provide their service.
• Authorities, only where the law requires it. We'll tell the school unless the law forbids it.

How long we keep it

• A school's records are kept while the school uses PupilBook. Within the app, records are archived rather than wiped, so pupils who leave and past years remain available to the school.
• When a school stops using PupilBook, it can download its records first. We then remove them within 30 days, and backup copies expire 30 days after that.
• Details sent through this website are cleared two years after they were sent, or sooner if you ask.

How we protect it

• Each school's records are walled off from every other school's, checked by the database itself.
• Anyone who handles money, and every PupilBook staff member, confirms each sign-in with a code from their phone.
• Connections are encrypted, backups are encrypted, and every change is logged.
• If a breach puts your data at risk, we'll tell the school and the Data Protection Commission as the law requires.

Your rights

Under Act 843 you can ask to see the data held about you, to have it corrected, to have it removed, and to object to how it is used. For school records, ask the school first, as it decides what it keeps; we help schools answer these requests. For anything we hold ourselves, email [email protected]. To have data removed, see Delete your data. We reply within 30 days.

If you're unhappy with how your data is handled, you can complain to the Data Protection Commission of Ghana (dataprotection.org.gh).

Children

Pupils don't use PupilBook themselves and we never collect data from children directly. Their records are added by their school.

Cookies and the browser

This website uses no tracking or advertising cookies. The PupilBook app stores your sign-in and a working copy of the school's records in your browser, so it keeps working when the network drops. Signing out removes them.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how school records are used, we'll tell schools first.