Privacy Policy

1. Introduction

SchoolBoss ("we", "us", "our" or "SchoolBoss.Ph") provides a school management platform used by school owners, branch administrators, staff and parents/guardians. This Privacy Policy describes what personal information we collect through the SchoolBoss platform, how we use it, and the rights you have over your information. It applies to the website at schoolboss.ph, every school-branded portal (schoolboss.ph/school/{slug}), and any related services.

SchoolBoss is operated from the Philippines and is committed to complying with the Republic Act No. 10173 (Data Privacy Act of 2012) and its implementing rules and regulations.

2. Information We Collect

2.1 Account information

• Name, email address, and hashed password of school owners and administrators
• School metadata (name, address, contact details, logo, URL slug)
• Branch metadata (name, address, principal, contact details, logo)

2.2 Information uploaded by the school

• Student records — name, photo, birthday, address, enrolled class & section, status
• Guardian information — name, contact details, photo, and whether parent-portal login is enabled
• Employee records — name, photo, role, contact details, salary configuration
• Attendance, grades, progress feedback notes, report cards
• Financial entries — tuition payments, income, expenses, fund transfers, pay slips

2.3 Technical information

• Authentication tokens stored in your browser's local storage
• Server-side activity audit logs (who did what and when)
• Standard web request metadata (IP address, user agent, timestamps)

3. How We Use Information

We use the information described above to:

• Provide the SchoolBoss platform — display dashboards, run reports, render parent portals
• Authenticate users and maintain secure sessions
• Send transactional emails (account approval, password resets, payment confirmations)
• Maintain an audit trail so school owners can see who changed what
• Detect, investigate and prevent abuse, fraud, or breaches
• Improve the platform — diagnose bugs, monitor performance, plan new features
• Comply with applicable laws and respond to lawful government requests

4. Sharing & Disclosure

SchoolBoss does not sell personal information. We share information only in the following situations:

• Within your school: data uploaded to your school is visible to other authorized users of the same school (owners, branch admins, staff with appropriate permissions, parents whose access has been enabled).
• Service providers: hosting, database, email and SMS providers strictly bound by data-processing agreements.
• Legal compliance: when we believe in good faith that disclosure is required by law, court order, or to protect the safety of a user.
• Business transfers: if SchoolBoss is acquired or merged, your information may transfer as part of that transaction. We will notify you before any such transfer.

5. Children's Data

Schools using SchoolBoss store information about children, including names, photos and dates of birth. This data is uploaded and managed by the school. Parents and guardians should direct questions about their child's information to the school in the first instance. SchoolBoss will cooperate with the school to fulfill access, correction, or deletion requests within a reasonable timeframe.

6. Data Security

We take reasonable administrative, technical and physical safeguards to protect your information, including:

• Encryption in transit (HTTPS/TLS) for all client–server communication
• Password hashing using industry-standard algorithms — we never store plaintext passwords
• Role-based access control (RBAC) enforced on every request
• Activity audit logs reviewable by school owners
• Image uploads are auto-compressed before storage to reduce exposure of large files
• Regular dependency updates and security reviews

No method of transmission or storage is 100% secure. We will notify affected schools and the National Privacy Commission as required by law in the event of a personal-data breach that may put rights and freedoms at risk.

7. Data Retention

• School records remain on the platform for as long as the school account is active and for up to 90 days after cancellation, to allow recovery.
• After 90 days from cancellation, the school's data is permanently deleted from active databases.
• Backups containing previously-deleted data are rotated out within 12 months.
• Aggregated, non-identifiable analytics may be retained indefinitely.

8. Your Rights

Subject to the Data Privacy Act of 2012, you have the right to:

• Be informed of how your data is processed
• Access your data and obtain a copy
• Request correction of inaccurate data
• Object to certain processing
• Request erasure or blocking of your data
• Be indemnified for damages caused by inaccurate, false, unlawfully obtained or unauthorized use of personal data
• Lodge a complaint with the National Privacy Commission

To exercise any of these rights, contact the school that uploaded your data first. If you cannot reach a resolution, email us at privacy@schoolboss.ph.

9. Cookies & Local Storage

SchoolBoss uses local storage (not cookies) to keep you signed in across page reloads. We do not use third-party advertising or cross-site tracking cookies. Clearing your browser's local storage will sign you out.

10. International Transfers

Some of our infrastructure providers operate data centers outside the Philippines. When personal information is transferred internationally, we put in place contractual safeguards consistent with the Data Privacy Act of 2012.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be announced in-app at least 14 days before they take effect.

12. Contact

Data Protection Officer
SchoolBoss.Ph
Governors Drive, Sampaloc 1, Dasmariñas, Philippines, 4114
Email: privacy@schoolboss.ph
Phone: +63 908 908 4776