Privacy Policy
Last updated: 15 September 2026
This policy explains what data the MODIT Nations Edu Suite collects, why it collects it, where it is stored, and what rights you have over it. It applies to every school that uses the Edu Suite and to every person who has an account on it.
1. Who controls your data
The Edu Suite is installed on each school's own server or hosting account. The school is the data controller. They decide what data to enter, who can access it, and how long to keep it. MODIT Nations (the software developer) does not access, store, or process school data unless the school explicitly asks for technical support.
2. What data is collected
The system stores only the data needed to run a school:
| Category | Examples | Why |
|---|---|---|
| Account data | Username, password hash, role, name | Authentication and access control |
| Student records | Name, date of birth, class, guardian details, address | Enrolment, reporting, communication |
| Staff records | Name, role, subjects taught, class allocation | Timetable, lesson plans, reports |
| Academic data | Attendance, exam marks, report cards | Tracking student progress |
| Financial data | Fee invoices, payment records | Fee management and reporting |
| System logs | Login timestamps, IP addresses, actions taken | Security auditing and troubleshooting |
3. What is NOT collected
- No analytics trackers (Google Analytics, Facebook Pixel, or similar)
- No advertising identifiers or cross-site tracking
- No biometric data (fingerprints, face scans)
- No location tracking beyond the IP address logged at login
- No data is sold, shared with advertisers, or used for profiling
4. How data is stored
All data is stored in a PostgreSQL database on the school's own server. Passwords are stored as salted hashes. The system cannot recover a plaintext password even if the database is compromised.
Session tokens are stored in HTTP-only cookies on your browser. They expire when you sign out or after a period of inactivity.
5. Who can see your data
Access is controlled by roles set by the school administrator:
- Students see only their own records.
- Teachers see records for students in their classes.
- Administrators see all records within their school.
- Nobody outside the school can access the data, including MODIT Nations, unless the school grants temporary support access.
6. Data sharing
The Edu Suite does not send data to any third party. There are no external API calls from the system to analytics services, advertising networks, or social media platforms. The only external connections made are:
- Optional: cloud AI services for lesson plan improvement (only when configured by the administrator, and only lesson plan content is sent, never student data)
- Optional: email delivery service for sending reports or notifications (only when configured)
7. Your rights
Depending on your jurisdiction, you may have the right to:
- Access: request a copy of all data the school holds about you
- Correction: ask the school to fix inaccurate data
- Deletion: ask the school to delete your data (subject to legal record-keeping requirements)
- Portability: request your data in a machine-readable format
To exercise these rights, contact your school administrator directly. They control the data and can action these requests through the system.
8. Data retention
Schools decide how long to keep records. The system does not automatically delete student or staff data. When a student leaves, the school may deactivate the account (preventing login) while retaining the academic record for reporting purposes, as required by education regulations in their jurisdiction.
9. Security
The system implements the following security measures:
- Passwords hashed with bcrypt (cost factor 12)
- CSRF protection on all state-changing requests
- HTTP-only, secure session cookies
- Optional two-factor authentication (TOTP)
- Server-side permission checks on every data access
- Login audit log with IP address and timestamp
- Automatic account lockout after repeated failed attempts
10. Children's data
The system processes data for students of all ages as directed by their school. The school is responsible for obtaining appropriate parental consent for data processing as required by their local laws. The system itself does not collect data directly from children. All data is entered by school staff or by students through their school-provided accounts.
11. Changes to this policy
If this policy changes, the updated version will be published on this page with a new "Last updated" date. Schools will be notified of material changes through the system.
Contact
For questions about this privacy policy or about how the Edu Suite handles data, contact the developer directly:
MODOI TIMOTHY
modoitimothy@moditnations.com
WhatsApp: +250 794 459 582