Who is responsible for what

For student, parent and staff records, the school is the data controller: it decides why and how the data is used. RiseFlow is the data processor: we run the software that stores and processes that data on the school's behalf. Questions about what a school records, or requests to see, correct or delete it, go to the school first; RiseFlow will help the school answer them.

For the details a school gives us when it registers and pays (school name, contact person, email, phone, address, billing records), RiseFlow is the controller, and we use them to run your account, bill you and support you.

What a school keeps in RiseFlow

Depending on how the school uses RiseFlow: names, class and admission details, results and report comments, attendance, fees and receipts, photos, and contact details for parents and staff. Schools should only record what they need to run the school.

How it is protected

• Phone numbers, addresses and dates of birth are encrypted in the database, as are deletion requests and the records sent between schools when a student transfers.
• Every page and app connection uses HTTPS encryption.
• Inside a school, people see only what their role allows: for example, a parent sees only the children linked to them with the code the school sent them, and a teacher sees their own classes. The school owner decides who gets extra access.
• One-time codes by text or email protect password resets, and you are told whenever your password changes.
• RiseFlow staff do not open school records. Our engineers may need to access the systems that hold them to keep RiseFlow running, fix faults or meet a legal obligation; this is limited to what the task needs.

Services we use

We use a small number of providers to run RiseFlow. They handle data only to provide their service to us:

• Supabase (database and file storage) and Railway (application hosting).
• Resend (email) and Termii (text messages), for invitations, one-time codes and notices.
• Paystack, for school subscription payments. We never see or store card details.

Deleting data

A parent can ask for their child's data to be deleted, and students and staff can ask for their own, from Delete my data in their RiseFlow account. The request goes to the school, which decides; a school may need to keep some records by law, and will tell you if so. RiseFlow is told that a request was made at that school (not who it is about), and if the school has not answered within 30 days we contact the school.

When a school closes its RiseFlow account, it can ask us to delete all of its data.

Your rights and the law

Data protection laws across Africa give people rights over their personal data, for example the Nigeria Data Protection Act 2023, Ghana's Data Protection Act 2012, Kenya's Data Protection Act 2019 and South Africa's Protection of Personal Information Act. Depending on where you live, you may ask to see, correct or delete your data, or object to how it is used. Ask your school first; if you cannot reach them, write to us and we will pass your request on.

Children

Children's records are added by their school. Parents see their children's records only after the school links them, and can ask the school to correct or delete them.

Cookies

We use cookies only to keep you signed in, protect forms from misuse and remember settings such as dark mode. We do not use advertising cookies.

Changes and contact

If we make important changes to this policy we will say so on our website and tell school owners by email. Questions: ugochukwuhenry@riseflowschools.com.