Privacy policy

IlmSchool (“we”) provides school management software to schools in Pakistan. This policy explains what information is kept, why, who can see it, and how it is protected. It applies to the app, the parent and student portal, school websites run on our platform, and the office-server version.

1. Who is responsible for the data

Each school owns the information about its students, families and staff, and decides what to record. We process that information on the school's behalf to run the service. For questions about a child's record, contact the school first; the school can contact us.

2. What we keep

• School: name, address, contacts, logo, classes, fees set-up, package and billing.
• Students: name, admission and roll number, class, date of birth, photo, guardian and emergency contacts, attendance, marks and results, homework, behaviour notes, fees and payments, and — only if the school records them — medical details, sick-bay visits, transport, hostel and library use.
• Parents and guardians: name, phone, email, and the children linked to their account.
• Staff: name, role, contacts, qualifications, classes and subjects, attendance (with a check-in photo where the school uses it), leave and — for the school's payroll — salary details.
• Use of the service: sign-ins, devices, and a log of changes (who changed what and when), kept for security.

We do not sell personal data, show advertising, or use children's data for marketing.

3. Why we use it

• To run the school's work: admissions, attendance, timetable, exams, fees, messages to families and reports.
• To keep accounts secure, stop misuse and investigate problems.
• To meet legal duties, and to bill schools for their package.

4. Who can see it

• Each school's data is kept separate. People see only what their role allows: teachers their own classes and subjects; parents only their own children; students only themselves.
• Salaries, medical notes and counselling notes are limited to the few roles that need them.
• Our staff access school data only to support the school or keep the service running, and such access is logged.
• Service providers that host or deliver the service (for example cloud hosting, SMS or WhatsApp delivery, payment providers) receive only what they need to do that job.
• We disclose information when required by Pakistani law or a lawful order.

5. How we protect it

• Encrypted connections (HTTPS) everywhere.
• Children's photos and documents, payment slips, homework uploads, staff check-in photos and medical notes are encrypted at rest (AES-256).
• Passwords are stored only as strong one-way hashes. Two-step sign-in, approved devices and automatic sign-out of old sessions are available.
• Every change is recorded in a log that cannot be edited. Payments are never deleted — only reversed with a reason.
• Nightly backups. Schools can download all their data at any time.

6. Children

Student accounts are created by the school. Students see only their own record. Their photo is checked by the school before it appears. Parents can ask the school to correct their child's details.

7. How long we keep it

While the school uses the service, and for a short period after it leaves so it can export its data. After that it is deleted, except what the law requires us to keep (for example billing records). Backups are deleted on a rolling schedule.

8. Your choices

• See and correct information through the school.
• Mute non-urgent notifications in “My account” (safety alerts such as absence and gate-pass messages always arrive).
• Ask the school to remove information it no longer needs.

9. Where data is kept

On cloud servers in the region nearest Pakistan, or — for schools using the office server — on the school's own computer inside the school.

10. Changes and contact

We will update this page when our practices change and tell schools about important changes. Questions: the contact details on our website.

This policy is written for the laws of Pakistan, including the Prevention of Electronic Crimes Act, 2016.