Privacy Policy

Last updated: 6 September 2026.

iEasySR ("we", "us", "our") is a company registered in Australia. This Policy describes how we collect, use, share and protect personal information when you use the iEasySR platform ("Service"). By using the Service you agree to the practices described here.

1. Data controller and processor roles

iEasySR is the data controller for account-level information (teacher and staff profiles, billing records). For the school and student data that you upload, you (the school owner or teacher) are the data controller and we act as a data processor on your documented instructions. Together with our Terms of Agreement, this Policy sets out the data-processing terms on which we process school and student data as your processor, including the sub-processors we use (section 4) and the safeguards for international transfers (section 10).

2. What we collect

Account information: full name, email address, bcrypt-hashed password, profile photo, MFA preference, and sign-in method (email/password or Google OAuth).
School and student data you upload: school name and details, student names, dates of birth, gender, photos, guardian names and parent email addresses, academic scores, attendance, and generated report cards.
Special-category and sensitive data you may enter: student health notes (for example allergies, medical conditions and dietary needs) and, where you use statutory census reporting, disability information; and, if you use the Staff module, staff statutory identifiers (national ID, tax and social-security numbers, bank details) and next-of-kin. This information is treated with extra care and processed only on your instructions.
Payment records: payment status, amount, currency, and the Stripe payment reference. Raw card data is handled exclusively by Stripe and is never stored on our servers.
Usage data: server logs (IP address, user-agent, timestamps) retained for security and abuse prevention.
Session cookies: encrypted JWT tokens required to keep you signed in (7-day lifetime).

3. How we use your information

To create and manage your account and authenticate your sessions.
To generate and deliver student report cards to the parent email addresses you provide.
To process payments via Stripe and maintain your billing history.
To send transactional emails (OTP codes, payment receipts, magic-link access for parents).
To detect and prevent abuse, fraud, and unauthorised access.
We do not sell your data or student data to third parties.
We do not use student data for advertising or profiling of any kind.

4. Where your data is hosted and controlled

iEasySR is the data controller: we are a company registered in Australia that decides how and why your personal data is processed. Your account, school, student and payment records are stored in a managed PostgreSQL database hosted by Neon in the United Kingdom (London region, on AWS eu-west-2). The application runs on Vercel's cloud platform and uploaded files are stored on Vercel Blob. We share data with the sub-processors below only to the extent necessary to operate the Service, and each is bound by appropriate data-protection terms. Some operate from other countries (including the United States); where your data is processed across borders, we rely on providers that maintain appropriate safeguards for international transfers, as described in section 10.

Vercel: cloud hosting and serverless functions. Processes request traffic to run the application.
Neon: managed PostgreSQL database, hosted in the United Kingdom (London region, AWS eu-west-2). Stores account, school, student and payment records.
Vercel Blob: object storage (United States). Stores profile photos and student photos.
Resend: transactional email delivery (United States). Receives recipient address and email body for each outbound email.
Stripe: payment processing (United States). Handles all card-level data under PCI-DSS compliance.
OpenAI: AI provider (United States), used only for the optional in-app assistant (iLex+) and AI content drafting. It receives the text you type and limited context (such as your school name and relevant help articles) to generate a reply; it is advice-only and your inputs are not used to train its models. Student personal records are not sent to it.
Google: optional OAuth sign-in. If you sign in with Google, your Google profile email and name are shared with us by Google.

5. Storage and security

Passwords are stored as bcrypt hashes; plaintext passwords are never stored or logged.
All data in transit is encrypted via TLS.
Uploaded files are stored in per-account folders in Vercel Blob with access controls.
Multi-factor authentication (OTP by email) is available and enabled by default.
We apply principle of least privilege for internal data access.
Offline mode: on screens designed to work with a weak connection (such as attendance and score entry), some data (class rosters and any changes not yet synced) is stored on your device using your browser's local storage. It is cleared automatically when you sign out, so a shared device does not retain it.

6. Data retention

Account data is retained for as long as your account is active.
Generated reports are retained until you delete them from the app, at which point they are permanently removed.
Payment records are retained for a minimum of 7 years to meet Australian financial record-keeping obligations.
Server logs are retained for up to 90 days.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data. You can:

Access and edit your account information from your Profile page.
Export your data on demand from Settings → Export your data: a ZIP of all your schools' data (one CSV per area), for backup or migration. Because it holds personal data, the download requires your password plus a one-time code emailed to you.
Delete reports directly from the dashboard.
Request account deletion: email support@ieasysr.com. All account data and associated student data is permanently deleted within 7 days.
Object or restrict processing by contacting us at the address below.

Australian residents may direct complaints to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. You may also lodge a complaint with the data-protection authority in your own country (for example, in Ghana, the Data Protection Commission).

8. Children's data and safeguarding

Schools use the Service to process the personal data of children (students). In some cases this includes special-category data, such as health notes and, where you use statutory census reporting, disability information. We treat children's data with particular care:

Children do not have accounts, and we never collect data directly from a child. Report cards and other communications are sent only to the parent or guardian email address that the school provides.
We never use children's data for advertising, marketing or profiling, and we never use it to train AI models.
The same security, access controls and data minimisation apply to children's data as to all other data, and it is deleted when the school's account is deleted.
As the data controller, the school is responsible for having a lawful basis and, where local law requires, parental or guardian consent, and for informing parents and guardians (through the school's own privacy notice) about this processing, including the international transfer and sub-processors described in sections 4 and 10.
When a school generates a statutory or ministry census return (for example a Ghana EMIS or a francophone SIGE return), the school discloses that data to its education ministry under the school's own legal obligation. iEasySR produces the document at the school's instruction and is not responsible for the onward disclosure.

9. Data breach notification

In the event of a data breach likely to cause serious harm, we will notify affected users and, where required, the Office of the Australian Information Commissioner within 72 hours of becoming aware of the breach. We will provide details of the breach and steps taken to mitigate it.

10. International data transfers

iEasySR operates across borders, so personal data (including children's data) is transferred internationally. This flow matters, especially for schools whose pupils' data originates outside the regions where it is stored:

Origin: data is entered by your school in the country where you operate (for many of our schools, Ghana and elsewhere in Africa, and worldwide).
Primary storage: it is stored in the United Kingdom (Neon, London region), a jurisdiction recognised for strong data-protection standards.
Sub-processing: some sub-processors operate from the United States (Vercel Blob, Resend, Stripe, OpenAI) and process only the limited data described in section 4.
Controller oversight: iEasySR is established in Australia.

We protect these transfers with appropriate safeguards: contractual data-protection terms with every sub-processor (including Standard Contractual Clauses or the UK International Data Transfer Agreement and Addendum where applicable, and providers' own compliance frameworks such as the EU-US Data Privacy Framework), encryption in transit (TLS) and at rest, and data minimisation so each provider receives only what it needs.

Where your school operates under Ghana's Data Protection Act 2012 or a comparable regime elsewhere, this cross-border processing is carried out on your documented instructions as the data controller and under the safeguards described here. You remain responsible for any registration, notice or consent your local law requires before student data leaves your country. If you need a signed data-processing agreement, or details of our current sub-processors and their locations for your own compliance records, contact us at the address below.

11. Changes to this policy

We may update this Policy from time to time. Material changes will be communicated via the dashboard or email at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

12. Contact

Privacy questions, data requests, or complaints: support@ieasysr.com.