Privacy Policy

Isikole (“Isikole”, “we”, “us”) makes school-management software and runs the services this policy covers. You can reach us at support@isikole.com.

Schools and Isikole have different roles. When a school uses Isikole, the school decides which information about its pupils, parents, guardians and staff is recorded, and why. The school is responsible for that information. We process it on the school’s behalf and on its instructions. For information you give us directly, such as registering a school on our website or contacting support, Isikole is responsible.

This policy covers:

• our website, isikole.com;
• the Isikole Android app (package name com.isikole.isikole);
• the Isikole web dashboard that school staff use; and
• the Isikole servers that these connect to.

When you register a school on isikole.com

The “Get Started” form asks for:

• About the school: its name, type, approximate number of students and its physical address. This is the school’s address, not a personal home address.
• About the contact person: name, email address and phone number.
• Anything you choose to write in the optional notes field.

To stop automated abuse, we also process your IP address and a Cloudflare Turnstile check while you submit the form. The website does not use cookies for tracking or analytics.

Accounts

There is no public sign-up. A school administrator, or Isikole while setting up a school, creates each account. An account holds your name, email address, phone number, role (for example parent, teacher, bursar, head teacher or administrator), the school or schools you belong to, and a profile photo if one is added. Your password is stored only in hashed form; we cannot read it.

When you sign in we record the time, and keep a session record that includes your IP address and your device’s browser or app identifier string (user agent).

School records

Depending on which features a school uses and which fields it fills in, Isikole may hold:

• Pupils: name, admission number, class and stream, date of birth, gender, photo, boarding status, enrolment details, contact details, home address and home area (district, sub-county, parish, village), nationality, country of birth, religion, tribe, and links to their parents or guardians.
• Parents and guardians: name, relationship to the pupil, email, phone number, address, occupation and workplace, and national ID number.
• Staff: name, contact details, address, date of birth, sex, marital status, next of kin and family contacts, qualifications, national ID number, tax number, NSSF number, bank name and account number, and blood type.
• Attendance and gate records: attendance status, check-in and check-out times, absence reasons and notes, and gate sign-in and sign-out scans.
• Academic records: exam results, grades, class positions and reports.
• Fees: balances, payments (amount, date, method, reference number and notes) and receipts, including payments made through SchoolPay.
• Communication: messages between staff and parents (content, sender, time and read status), announcements, in-app notifications, and the email and SMS notifications sent for the school.
• Files: photos and documents a school uploads.

Some of these are sensitive: information about children, national ID, tax and bank numbers, religion, tribe and blood type. Most of these fields are optional, and we ask schools to record only what they need.

What the Android app does not collect

The app does not contain advertising or crash-reporting software, and Isikole does not run analytics in it. It does not ask for your location, contacts, microphone or files, and it does not use advertising identifiers. Apart from loading photos from Cloudinary and the QR scanner’s diagnostics described below, the app talks only to Isikole’s servers.

• Camera. School staff can use the camera to scan pupils’ QR codes at the school gate. The code is read on your device. Camera images are not uploaded or saved. Only the result (which pupil, signing in or out, and when) is sent to Isikole. Codes are read by Google’s ML Kit barcode library, which runs entirely on the device. ML Kit sends Google your device model, Android version, the app’s version, a per-installation identifier and performance measurements, which Google uses for diagnostics. Google says the identifier is not intended to identify you or your device, and no camera images are sent.
• Sign-in. Your session token is kept in Android’s encrypted secure storage. Your password is never stored on the device.
• Offline gate scanning. So scanning keeps working without a connection, the app keeps a list of the school’s pupils (name, class and ID) and any scans not yet sent. Scans are sent once the device is back online. The list stays on the device until it is refreshed, the app’s data is cleared, or the app is uninstalled.
• Phone calls. The app can open your phone’s dialler with a parent’s number. Isikole does not place, listen to or record the call.

We use information to:

• provide Isikole to schools: records, attendance, fees, results, messaging and reports;
• create accounts, sign people in, reset passwords and keep accounts secure;
• send the email, SMS and in-app notifications a school or user has asked for;
• match fee payments received through SchoolPay to the right pupil;
• review requests to register a school and reply to them;
• prevent abuse, investigate problems and fix errors; and
• meet legal obligations.

We do not sell personal information. We do not use it for advertising, and we do not build marketing profiles of pupils, parents or staff.

We use the companies below to run Isikole. They process information for us, for the purposes listed. Google’s ML Kit diagnostics are handled under Google’s own terms, and Google does not pass them to third parties.

• Contabo (Germany)

  Servers, run by Isikole, for the Isikole API, database, caching and background jobs

  All platform records described above, sign-in sessions and server logs.

• Cloudinary

  Storing and delivering photos and documents

  Profile photos of pupils, staff and users, school logos, and documents a school uploads.

• Mailtrap

  Sending email

  Recipient name and email address, and the message: account invitations, password resets, notifications, and website registration emails.

• Africa's Talking

  Sending SMS

  Recipient phone number and message text, for example absence alerts, fee reminders and announcements.

• SchoolPay

  School fee payments

  We receive payment records for a school's pupils: pupil name, registration number, amount, and payer phone number.

• Google (ML Kit)

  Reading QR codes in the Android app

  Device model, Android version, app version, a per-installation identifier and scanner performance metrics, sent to Google for diagnostics. Camera images are not sent.

• Vercel

  Hosting isikole.com

  Requests to the website, including your IP address.

• Redis Cloud

  Rate limiting the website registration form

  IP address and email address, deleted automatically after one hour.

• Cloudflare (Turnstile)

  Blocking automated abuse of the website registration form

  Your IP address and browser signals while you use the form.

• Unsplash

  Some photographs on isikole.com

  Your browser fetches these images from Unsplash's servers, which receive your IP address and browser details.

• Within the school. Staff see the records their role allows. Parents see information about their own children.
• To our service providers, as described above.
• When the law requires it, for example a valid court order, or to protect someone’s safety.

Isikole is used by schools, so it holds information about pupils, most of whom are under 18. That information is entered by the school. The school is responsible for having the right to record it, including getting a parent’s or guardian’s consent where the law requires it.

Children cannot sign up for Isikole. A school may give its pupils their own sign-in to the app; only the school can create these accounts.

We use pupils’ information only to provide the service to their school. It is never used for advertising or profiling. A parent or guardian who wants to see, correct or delete their child’s information should contact the school first, or contact us.

• Information is encrypted in transit between your device and our servers using HTTPS.
• Passwords are stored only as salted bcrypt hashes.
• Sign-in sessions use short-lived access tokens and can be revoked.
• Sign-in and password-reset attempts are rate-limited.
• Access inside a school is controlled by role, and key actions are recorded in an audit log.
• Only Isikole’s own apps and dashboard are allowed to call our servers from a browser.
• Database backups are taken daily.

Only the Isikole staff who run the service can access production data.

No system is perfectly secure. If a breach affects your information, we will tell the affected schools and people, and the authorities where the law requires it.

• Rate-limiting records (IP address and email address) expire automatically after one hour.
• Website registration requests are kept in our support inbox and our email provider’s logs for up to 12 months.
• Accounts and school records are kept while the school uses Isikole.
• Records a school removes. When a school removes a pupil, parent, staff member or user, the record is deactivated and hidden, but kept in our database until the school or the person asks us to erase it. We then erase it within 30 days.
• Closed schools. When a school closes its account, we permanently erase all of its records and uploaded files within 30 days.
• Server logs are kept for 30 days.
• Sign-in sessions are kept until you sign out or they expire, and are erased with your account.
• Backups are kept for 30 days, so erased data is gone from backups no more than 30 days after we erase it.

You can ask to see, correct or delete the personal information Isikole holds about you. Because schools are responsible for their own records, we may involve your school in the request.

How to request deletion

1. Email support@isikole.com from the address linked to your account, with the subject “Delete my Isikole account”.
2. Include your full name, your school and your role (for example parent or teacher).
3. We confirm the request is genuine and let your school know. We then permanently erase your account and the personal information we hold about you within 30 days, and tell you when it is done.

Your school administrator can also deactivate your account, which stops you signing in. Deactivation does not erase your data; to have it erased, email us as above.

What may be kept. If your school is required by law to keep a record about you, such as a fee receipt or a pupil’s academic record, we tell you, keep only that record, and erase everything else.

Uninstalling the app or clearing its data removes everything the app stored on your device.

If you are unhappy with how we handled your information, you can complain to the data protection authority in your country: in Uganda, the Personal Data Protection Office; in Kenya, the Office of the Data Protection Commissioner.

The Isikole API, database and caches run on servers we operate at Contabo in Germany, in the European Union. Cloudinary, Mailtrap, Africa’s Talking, Cloudflare, Vercel, Redis Cloud and Google may process information in other countries, including the United States. Where they do, we rely on their contractual and security commitments to protect it.

We will update this page when our practices change and revise the “Last updated” date above. If a change is significant, we will also tell schools directly.

For privacy questions or requests, email support@isikole.com.