Privacy Policy

Your Data, Protected by Design

How Idora handles student, staff, and financial data with enterprise-grade security, row-level isolation, and immutable audit trails. NDPA 2023 compliant.

Last updated: September 8, 2026

What Data We Collect

We collect only what's necessary to run your school efficiently. Here's exactly what we store:

Students (Minors)
  • Name, date of birth, gender
  • Registration number, admission date
  • Class enrollment, attendance records
  • Academic results, terminal reports
  • Medical info (blood group, allergies) — optional
  • Photos — optional
Parents/Guardians
  • Name, contact info (phone, email)
  • Relationship to student
  • Financial responsibility status
  • Payment history
Staff
  • Name, contact info, staff ID
  • Role, department, employment type
  • Attendance records, leave requests
  • Assignment history
Financial Data
  • Invoice amounts, payment methods
  • Transaction history, receipt numbers
  • Wallet balances, settlement records
  • Note: Full card numbers never stored (Paystack handles this)
Technical Data
We also collect IP addresses, browser type, and device info for audit logs and security. This data is used solely for system administration and is never used for marketing or profiling.

How We Use Data

Every piece of data has a specific, legitimate purpose. We never use your data for anything outside these purposes:

Student Data
Enrollment management, class assignments, attendance tracking, result computation, parent communication (with consent)
Financial Data
Fee invoicing, payment processing, double-entry accounting, financial reporting
Staff Data
Role assignment, access control, attendance tracking, leave management
Technical Data
Security, fraud prevention, audit trails, system administration
We NEVER:
  • • Sell your data to third parties
  • • Use children's data for marketing or advertising
  • • Share data without consent (except legal requirements)
  • • Use data for behavioral profiling

Data Storage & Security

Your school's data is protected by enterprise-grade security measures built into the foundation of Idora:

Row-Level Security (RLS)
Data isolation at the database level. Each school's data is cryptographically separated. Even our engineers can't access your data without explicit permission.
Encryption
In transit: TLS 1.3 for all connections. At rest: Supabase encryption (AES-256). API keys encrypted, never stored in plain text.
Audit Logs
Every action is logged with timestamps and user IDs. Immutable records — can't be deleted or altered. Accessible to school admins for compliance.
Access Control
Role-based permissions (tenant_admin, principal, teacher, accountant, etc.). Multi-factor authentication available. Session timeouts for inactive users.
Backups
Automated daily backups. Point-in-time recovery. Geographic redundancy.

Children's Privacy

We take extra care with data belonging to minors (students under 18). Here's how we protect them:

Parental Consent
Schools act as data controllers. Parents/guardians have rights to access, correct, or request deletion of their child's data. We provide tools for schools to manage consent.
Data Minimization
We only collect what's necessary for educational administration. Medical info and photos are optional. No unnecessary data collection.
No Marketing
Children's data is never used for marketing or advertising. No third-party tracking or analytics on student data. No behavioral profiling.
Age Restrictions
Platform is designed for school use, not direct child accounts. Students access data through parent/guardian accounts or school-managed portals.
NDPA 2023 Compliance
We comply with the Nigeria Data Protection Act 2023 and follow international best practices for children's data protection, including GDPR principles where applicable.

Third-Party Processors

We work with trusted partners who help us deliver the service. All processors are contractually bound to protect your data:

Supabase
Purpose: Database hosting, authentication, realtime, storage
Location: AWS eu-central-1 (Frankfurt, Germany)
Compliance: SOC 2 Type II compliant
Paystack
Purpose: Payment processing (cards, bank transfers, USSD, mobile money)
Location: Nigeria
Compliance: PCI DSS Level 1 compliant
SMS/Email Providers
Purpose: Communication delivery (attendance alerts, broadcasts)
Location: Various
Compliance: Encrypted in transit. No data retention beyond delivery confirmation.
Cloud Storage
Purpose: File uploads (photos, documents, report cards)
Location: AWS us-east-2 (Ohio, USA)
Compliance: Encrypted at rest. Access logs maintained.
No Data Selling
We do not sell, rent, or trade your data. We do not use data for advertising. Third parties only process data on our behalf, under strict contracts.

Data Retention

Your school's history is preserved permanently. Here's our retention policy:

Student Records
Retained indefinitely
Schools need historical records for alumni verification, transcript requests, and legal compliance
Financial Records
Retained indefinitely
Audit requirements, tax compliance, and financial reporting needs
Audit Logs
Retained indefinitely
Security, compliance, and accountability requirements
Account Deletion
Data purged within 30 days
If a school closes or cancels, data can be exported (CSV, JSON, PDF) and then permanently deleted upon request
Why Permanent Retention?
Schools operate across decades. A student who graduated in 2010 may need their transcript in 2030. Financial records must be available for audits years later. Your school's legacy is preserved, not deleted.
Data Portability
Export all your data anytime in standard formats (CSV, JSON, PDF). No vendor lock-in. Your data belongs to you.

Your Rights

Schools and parents have specific rights regarding their data:

Access
Request a copy of all data held about a student, staff member, or parent. Respond within 30 days.
Correction
Update inaccurate information (name, contact details, results). Schools can correct data directly; parents can request corrections.
Deletion
Request data deletion (with caveats for financial/legal records). Right to be forgotten (except where legal obligations require retention).
Portability
Export data in standard formats (CSV, JSON, PDF). Transfer to another system if needed.
Objection
Opt out of certain processing (e.g., SMS broadcasts). Withdraw consent for optional data collection (photos, medical info).
How to Exercise Rights
Email: info@idora.ng
Response time: Within 30 days
No fee for legitimate requests

International Data Transfers

Idora uses international infrastructure to ensure reliability and performance. Here's where your data lives:

Supabase (Database)
AWS eu-central-1 (Frankfurt, Germany)
Your primary database, authentication, and realtime data
Serverless Functions & Storage
AWS us-east-2 (Ohio, USA)
Background jobs, file uploads, and serverless processing
Data Residency: International
Your data is stored across multiple international regions. We use Standard Contractual Clauses (SCCs) and other legal mechanisms to ensure your data remains protected regardless of where it's processed.
Safeguards: Encryption in transit (TLS 1.3) and at rest (AES-256), strict access controls, regular security audits, and compliance with international data protection standards.
Future Integrations
We may integrate with Google Analytics and Cloudflare in the future for performance monitoring and analytics. If we do, we'll update this policy and ensure all integrations comply with data protection regulations.

Changes to This Policy

We'll keep you informed of any changes to this privacy policy:

1
Material Changes
Significant changes (new data collection, changes to data sharing) require email notification to all school administrators.
2
Minor Changes
Clarifications, typo fixes, and non-material updates are posted here with an updated "Last Updated" date.
3
Continued Use
Continued use of Idora after changes are posted constitutes acceptance of the updated policy.
Policy Changelog
We maintain a complete changelog of all policy updates. Contact us if you'd like to review the history of changes.

Contact Us

Have questions about this privacy policy or how we handle your data? We're here to help.

Privacy Inquiries
info@idora.ng
General Support
info@idora.ng
Physical Address
No 2007, Tsamiyar Zubau,
Bachirawa, Kano,
Nigeria
Response Time
Within 30 days for data subject requests
Within 5 business days for general inquiries