Privacy Policy

1. Who is responsible for your information

Two different roles apply, depending on the information:

• Your school decides what student, guardian and staff information is entered into Scholr and why. For that information the school is the data controller, and Lync Systems acts as its data processor, handling it only to provide the service and on the school's instructions.
• Lync Systems is the controller for information we collect ourselves: account requests, the sign-in details of platform users, and technical data needed to run and secure the service.

If you are a student, parent, guardian or teacher and want to know what a school holds about you, or want it corrected or removed, contact the school first. It controls that information and we will assist it in responding.

2. Information we handle

Account and sign-in information. Name, email address, username, role, the school you belong to, and your password. Passwords are stored only as a one-way cryptographic hash, never in readable form.

School records entered by schools. This can include:

• Student details: name, date of birth, gender, nationality, class and stream, enrolment status, category and sponsorship, and limited health information (blood type).
• Guardian details: name, relationship to the student, phone number and email address.
• Academic records: subjects, assignments, grades, rankings, report cards and comments, and timetables.
• Finance records: fee items, fee payments and related balances.
• Staff details: teacher profiles and their class and subject assignments.
• School branding such as logos, and other files a school uploads.

Account requests. When a school asks for an account we collect the requester's name, email address and phone number, the school's name, and the plan selected.

Technical information. Our servers record IP addresses and request details in operational logs. Short-lived counters keyed to an IP address or email address are kept to limit abuse, such as repeated password reset requests.

Emails. Where the service sends you a message, such as a password reset link, your email address and the message content are passed to our email delivery provider.

3. How we use information

• To provide Scholr: sign you in, apply your school's permissions, and store and show the records your school manages.
• To review and act on account requests, and to communicate with you about the service.
• To send service messages such as password resets and security notices.
• To keep the platform secure, prevent misuse, diagnose faults and back up data.
• To meet legal obligations.

We do not sell personal information, we do not use it for advertising, and we do not use student information to build marketing profiles. Where the law requires a legal basis, ours are performing our agreement with the school, our legitimate interest in running a secure service, compliance with law, and consent where it is required.

4. Children's information

Most student information relates to minors. It is entered and managed by schools, which are responsible for having the right to do so, including any parental or guardian consent required by law. Students do not create their own accounts through the public website, and we do not knowingly collect information from children outside a school's use of the service.

5. Who can see it

• Within a school.Access depends on the role the school assigns (for example administrator, head teacher, teacher). Each school's data is kept in its own separate database and is not visible to other schools.
• Lync Systems staff. Limited to those who need it to operate, support and secure the service.
• Service providers that help us run Scholr, under obligations to protect the information: email delivery (Resend), spam protection on the account request form (Cloudflare), website analytics on our public pages if you accept it (Google), server hosting and infrastructure, and, if a school enables it, external file storage.
• Authorities and advisers where the law requires it or to protect rights and safety, and a successor if the business is transferred, with the same protections continuing to apply.

Some providers may process information outside Malawi. Where that happens we expect them to protect it to a comparable standard.

6. Cookies and similar technologies

Inside the school portal, Scholr uses only cookies needed for the service to work. We do not use advertising cookies anywhere, and we never use analytics in the school portal.

• auth_token: keeps you signed in (up to 8 hours); not readable by page scripts.
• user_name and user_roles: your display name and role, used to show the right screens.

Our pages load fonts from Google Fonts, so your browser contacts Google's servers to fetch them, which shares your IP address with Google.

Analytics on our public pages. On our public website (the home, pricing, about, learn, legal and account request pages) we use Google Analytics to understand how visitors find and use the site, but only if you choose Accept in the cookie banner. It sets cookies named _ga and _ga_<id> and sends Google information such as the pages you visit, your approximate location and your device and browser type. Advertising features are switched off. If you choose Decline, or do nothing, Google Analytics does not load. You can change your choice at any time using Cookie settings at the bottom of our public pages; declining removes the analytics cookies.

The account request form uses Cloudflare Turnstile to check that submissions come from a person rather than an automated program. To do this, Cloudflare processes technical information about your browser and connection.

7. How long we keep information

Schools' records are kept while the school's account is active, and afterwards for a limited period so that the school can export its data, after which they are deleted or anonymised, subject to any legal duty to retain them. Backups are overwritten in the normal backup cycle. Password reset links expire after 30 minutes and can be used once. Account requests are kept for as long as needed to handle them and to keep records of who we have dealt with.

8. Security

We protect information with encrypted connections (HTTPS), hashed passwords, role-based access, separate databases for each school, rate limiting on sign-in-related requests, and restricted administrative access. No system is perfectly secure. If a breach affects personal information, we will notify the affected school and, where the law requires, the relevant authority, without undue delay. You can help by keeping your password private and signing out on shared devices.

9. Your rights

Subject to applicable law, you may ask to access the personal information held about you, have it corrected, have it deleted, restrict or object to certain uses, and receive a copy. For school records, please contact your school. For information we hold as controller, contact us using the details below. You may also complain to the data protection authority that applies to you.

10. Changes to this policy

We may update this policy as the service or the law changes. The effective date above shows when it last changed, and we will give schools reasonable notice of significant changes. The Terms of Use also apply to your use of Scholr.

11. Contact

Questions or requests about privacy: developers@lyncsystems.tech, or via lyncsystems.tech.