Skip to content

Privacy Policy

Last updated: [DATE — update on publish]

Draft template.This document has not yet been reviewed by a lawyer. Remove this notice only after legal review, particularly given Phlox handles minors' school records and payment data.

1. Overview

This Privacy Policy explains how Phlox (“we”, “us”) collects, uses, stores, and protects information when a school (“Customer”), and the staff, parents, and students associated with that school, use the Phlox platform.

2. Information we collect

We collect information provided directly by schools and their users, including:

  • School details: name, address, contact information
  • Staff details: name, role, contact information, login credentials
  • Student records: name, class, attendance, results, and fee payment status
  • Parent/guardian details: name, contact information, relationship to student
  • Payment data processed through Paystack (Phlox does not store full card details)
  • Usage data: log-in activity, device/browser information

3. Children's data

Phlox processes student records on behalf of schools, and students are, in most cases, minors. Student data is collected and managed by the school as the responsible party (data controller), with Phlox acting as a processor. Schools are responsible for obtaining any necessary parental consent required under applicable law before entering student data into Phlox. We do not knowingly collect data directly from students without school or parental involvement.

4. How we use information

  • To provide and maintain the Phlox platform for schools
  • To process fee payments and generate receipts via Paystack
  • To send notifications by email (via Resend) and SMS (via Termii)
  • To generate results, broadsheets, and attendance records
  • To provide customer support and respond to inquiries
  • To improve and secure the platform

5. How we share information

We share data only as needed to provide the service, including with: Paystack (payment processing), Termii (SMS delivery), and Resend (email delivery). We do not sell school, staff, parent, or student data to third parties.

6. Data retention

We retain school data for as long as the school maintains an active subscription, and for a reasonable period afterward to allow for data export, unless a longer period is required by law. Schools may request deletion of their data subject to applicable record-keeping obligations.

7. Your rights

Depending on applicable law, including Nigeria's Data Protection Act (2023), individuals may have rights to access, correct, or request deletion of their personal data. Requests regarding student data should generally be directed to the relevant school in the first instance, as the school controls that data.

8. Security

We use industry-standard measures, including encrypted data transmission and role-based access controls, to protect data stored on Phlox. No system is completely secure, and we encourage schools to use strong, unique passwords for staff accounts.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to schools in advance where reasonably possible.

10. Contact us

Questions about this policy can be sent to privacy@phlox.ng.