Your Privacy Matters
We take data protection seriously. This policy explains how we handle your information.
Last Updated: September 13, 2026
Table of Contents
1. Introduction
EduNest ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our school management platform, website, and related services (collectively, the "Services").
2. Information We Collect
We collect information to provide better services to our users and schools. The types of information we collect include:
School Information
School name, address, type, contact details, and administrator information.
User Information
Names, email addresses, phone numbers, roles (admin, teacher, student, parent).
Academic Data
Student records, grades, attendance, exam results, and learning progress.
Technical Data
IP addresses, browser type, device information, browser fingerprint, screen resolution, and usage patterns.
Security logging: We log IP addresses, browser fingerprints, and device metadata for security purposes — such as detecting unauthorized access attempts, blocking malicious traffic, and protecting our platform. This data is retained only as long as needed for security investigations.
3. How We Use Your Data
We use the information we collect to:
- Provide, maintain, and improve our Services
- Process transactions and send related information
- Send you technical notices, updates, security alerts, and support messages
- Detect, investigate, and prevent security incidents, fraud, and abuse
- Monitor and analyze trends, usage, and activities in connection with our Services
- Comply with legal obligations and protect our legal rights
4. Legal Basis for Processing
We process your personal data under the following legal bases, in line with the Nigeria Data Protection Regulation (NDPR):
Contract
To provide our Services to your school under your subscription agreement.
Legal Obligation
To comply with tax, accounting, and regulatory requirements.
Legitimate Interest
To secure our platform, prevent fraud, and improve our Services.
Consent
Where you have specifically opted in, such as for marketing communications.
5. Data Sharing and Disclosure
We may share your information in the following circumstances:
- • With Schools:Student and parent data is shared with the school that invited them.
- • Service Providers:We share data with trusted third-party vendors who assist us in operating our Services, bound by data protection agreements.
- • Legal Requirements:We may disclose data if required by law or to protect our rights.
We never sell your personal data to third parties. Your data is only shared with the service providers required to operate our Services, and always under strict contractual data protection obligations.
Sub-processors we use: Supabase (database and authentication), Render (application hosting), Paystack and Flutterwave (payment processing), and email delivery providers. A current list of sub-processors is available on request.
6. International Data Transfers
Our infrastructure and service providers may store or process data outside Nigeria. Where data is transferred internationally, we ensure appropriate safeguards are in place, including contractual commitments from our providers to protect your data in line with NDPR.
Data may be processed in the following regions: European Union, United States, and other jurisdictions where our sub-processors operate data centers. All transfers are covered by standard contractual clauses or equivalent safeguards.
7. Data Security
We implement appropriate technical and organizational measures to protect your data:
Encryption
TLS for data in transit. Encryption at rest is managed by our infrastructure provider (Supabase).
Encrypted Secrets
Passwords and integration credentials are encrypted using AES-256-GCM before storage.
Access Control
Row-level security (RLS) and role-based access controls on all tenant data.
Monitoring
Rate limiting, bot detection, and security logging on public endpoints.
Data Minimization
We retain data only as long as needed and securely delete it afterward.
Least Privilege
Internal access is limited to authorized personnel on a need-to-know basis.
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to security@edunest.com.
8. Data Breach Notification
In the event of a confirmed data breach affecting your personal data, we will notify affected users and the relevant supervisory authority within 72 hours of confirming the breach, in line with NDPR requirements.
Notifications will describe the nature of the breach, the categories of data affected, and the measures we are taking to address it.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- • Access:You can request a copy of your personal data.
- • Correction:You can request corrections to inaccurate data.
- • Deletion:You can request deletion of your personal data.
- • Restriction:You can request restriction of data processing.
- • Portability:You can request to receive your data in a structured format.
- • Withdraw Consent:Where processing is based on consent, you may withdraw it at any time.
- • Complain:You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.
To exercise any of these rights, please contact privacy@edunest.com or use our contact form.
11. Data Retention
We retain your personal data only for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we securely delete or anonymize it.
Retained for the lifetime of your subscription.
30 days after termination for recovery, then permanently deleted.
Up to 90 days in encrypted backup storage.
Retained for up to 24 hours for active threat investigation, unless needed for legal purposes.
12. Children's Privacy
Our Services are intended for use by schools and educational institutions. We may collect data about students as part of our school management services, but we do not knowingly collect personal information from children without parental consent and school authorization.
The school is responsible for obtaining any necessary parental consent for student data uploaded to our platform. We act as a data processor for such student data on behalf of the school (the data controller).
13. Policy Updates
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through our platform at least 30 days before the changes take effect. We will also update the "Last Updated" date at the top of this page.
We encourage you to review this policy periodically.
14. Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy, please contact us at:
We will respond to all legitimate requests within 30 days.