Last updated: September 2026. This privacy policy explains how BentoSMS collects, uses, and protects your school's data.
When you register a school, we collect your name, email, phone number, school name, and address. We use this to create your account and provide platform access.
You provide information about your school structure: classes, subjects, fee schedules, and term dates. This data belongs to you and is used to configure your portal.
You upload student names, ID numbers, dates of birth, contact information, and class assignments. Parents and teachers contribute additional data like photos and documents.
Teachers enter attendance records, exam scores, and curriculum plans. This data is used to generate reports and results portals for students and parents.
Fee structures, payment records, and billing information are collected to manage school finances. Payment processor data (PixPay, Flutterwave) is handled separately by those providers.
We automatically collect login times, pages visited, features used, and interaction patterns to improve the platform and track adoption.
We collect IP addresses, browser type, operating system, and device identifiers for security and troubleshooting purposes.
If your school uses biometric attendance systems, we store attendance data linked to biometric records. You control whether this feature is enabled.
We use your data to operate the platform: manage portals, generate reports, send notifications, and maintain school records.
We send updates about your account, features, and platform changes. We only send marketing emails if you opt in.
We access your data when troubleshooting issues, answering support questions, and improving platform reliability.
We analyze usage patterns to improve features, identify issues, and develop new tools. This analysis is aggregated and anonymized.
We may disclose data if required by law, court order, or to protect against fraud or security threats.
All data is stored on secure servers in Nigeria (Supabase infrastructure). We do not transfer data outside Nigeria unless required for technical reasons.
Data is encrypted in transit using HTTPS. Sensitive data (passwords, biometric records) is encrypted at rest.
Access is restricted by role: admins see everything, teachers see their classes, students see themselves, parents see their children. Staff members sign agreements protecting confidentiality.
We maintain encrypted backups for disaster recovery. Backups are retained for 30 days then deleted.
PixPay and Flutterwave process payments. Their privacy policies apply to payment data. We do not store credit card numbers.
Termii and Resend send SMS and email notifications on your behalf. Contact information is shared only to deliver messages you initiate.
Supabase provides database and hosting. They comply with data protection standards.
We use analytics tools to track feature adoption and platform performance. These tools do not identify individuals.
Schools collect student data with parental consent (via admission forms). Parents can access their child's data through the parent portal.
Students access only their own results, attendance, and timetable. They cannot view other students' data.
We collect only information necessary for school operations. Date of birth is optional; student ID and class assignment are required.
You can view, export, or request a copy of all your school data at any time through your admin portal.
You can edit student names, contact information, and other records directly in the platform.
You can delete individual records. When you close your account, all school data is deleted within 30 days unless required by law.
You can disable features (biometric attendance, WhatsApp notifications) to restrict how your data is processed.
You can opt out of optional communications. Opting out does not affect service delivery.
While your account is active, we retain all school data indefinitely. This is necessary for historical records, compliance, and audit trails.
After account closure, data is retained for 30 days to allow recovery. Then it is permanently deleted.
Encrypted backups are retained for 30 days for disaster recovery, then deleted.
Data required for legal proceedings may be retained longer to comply with court orders.
BentoSMS complies with the Nigeria Data Protection Regulation (NDPR). We have appointed a Data Protection Officer (DPO) available at privacy@bentosms.com.
This policy and all data processing activities are subject to Nigerian law. Any disputes are resolved under Nigerian jurisdiction.
We process data only for lawful purposes: delivering the service, maintaining security, and complying with regulations.
We may update this policy to reflect changes in our service or legal requirements. Material changes will be communicated via email.
Continued use of BentoSMS after policy changes constitutes acceptance of the new policy.
If you have privacy questions or concerns, contact our Data Protection Officer at privacy@bentosms.com. We respond to all inquiries within 10 business days.