This Privacy Policy explains how Rehnuma (“Rehnuma”, “we”, “us”, “our”) — a school-management platform operated from Attock, Punjab, Pakistan — collects, uses, shares, and protects personal information when a school uses our web dashboard and mobile apps (the “Service”).
Contents
1. Information we collect
The information in the Service is entered by the school and its staff. We collect the following categories:
Staff & account information
- School owners, administrators, and teachers: name, email address, phone number (optional), role, and a securely hashed password.
- Sign-in security data: verification codes, session and refresh tokens, and device push-notification tokens (for the mobile app).
Student information (children)
- Identity & profile: name, date of birth, gender, photograph (if uploaded), B-Form/CNIC or admission number, address, previous school, admission date and status.
- Academic & operational records: class/section, attendance, exam marks and grades, fee amounts and payment history, and school-generated notes.
- AI-derived information: weekly progress summaries and dropout-risk indicators generated from the above (see §4).
Guardian / parent information
- Name, phone number, email address (optional), relationship to the student, and communication preferences.
Admissions inquiries
- Prospective student name, desired class, guardian name and phone, inquiry source, and follow-up notes.
Communications & usage
- Records of messages the school sends through the Service (e.g. fee receipts, reminders, results, weekly reports, announcements) and their delivery status.
- Technical/log data needed to operate and secure the Service (e.g. timestamps, error logs, IP address at the network layer).
We do not intentionally collect special categories of data (such as health or religion) beyond what a school may voluntarily enter in free-text notes; schools are asked to avoid entering sensitive data that is not necessary.
2. Children’s data
The Service is used by schools to manage records about their students, many of whom are children under 18. We take this seriously:
- Children’s data is provided to us by the school, which is responsible for having the appropriate legal basis and parental consent under applicable law.
- We process children’s data only to provide the Service to the school, on the school’s instructions.
- We do not sell children’s data, use it for advertising, or build advertising profiles.
- We do not knowingly allow children to create their own accounts; the Service is operated by school staff and guardians.
- Parents may exercise rights over their child’s data through the child’s school (see §9).
3. How we use information
- To provide and operate the Service — record fees and generate receipts, mark attendance, record results and produce result cards, manage admissions, and run the school dashboard.
- To send communications the school chooses to send to guardians (receipts, reminders, results, weekly reports, announcements) via WhatsApp, email, or push notification.
- To generate AI-assisted content for the school (Urdu fee-recovery messages, weekly parent reports, dropout-risk indicators, curriculum-pacing suggestions, teacher summaries) — see §4.
- To provide support, maintain security, prevent abuse, and improve reliability.
- To comply with legal obligations and enforce our Terms.
We do not sell personal information, and we do not use it for third-party advertising.
4. AI features
Some features use a third-party AI provider to generate text (for example, Urdu parent messages and reports). To do this, we send the provider the limited, relevant information needed to generate the output (such as a student’s first name, attendance count, fee status, and the school name). We aim to minimise the data sent, and — where the provider offers such controls — we do not permit your data to be used to train the provider’s models. AI-generated text may occasionally be imperfect; schools review and control what is sent to guardians.
5. Sharing & sub-processors
We do not sell your data. We share it only with service providers (“sub-processors”) that help us run the Service, under agreements that require them to protect it and use it only for that purpose:
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Supabase | Database & file storage (records, receipts, logos) | All Service data |
| Render | Application & API hosting | All Service data (in transit/processing) |
| OpenAI / OpenRouter | AI text generation | Limited fields needed to generate messages/reports (§4) |
| Meta (WhatsApp Business API) | Sending WhatsApp messages to guardians | Guardian phone number + message content |
| Resend | Transactional email (invites, sign-in codes, resets) | Staff email + email content |
| Google Firebase | Mobile push notifications | Device token + notification content |
We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a business transfer (e.g. merger or acquisition), subject to this Policy.
6. International transfers
Some of our sub-processors operate servers outside Pakistan (for example, in the United States or European Union). Where your information is transferred internationally, we take steps intended to keep it protected to a standard consistent with this Policy and applicable law.
7. Data retention
We retain school and student records for as long as the school maintains an active account, so the school can access its historical data. When a school’s account ends, we will delete or return the school’s data within a reasonable period, except where we must retain limited information to comply with law, resolve disputes, or enforce our agreements. Backups are cycled out on a rolling basis.
8. Security
- Data is encrypted in transit (HTTPS/TLS). Passwords are stored only as secure hashes.
- Access is scoped by role and by school: owners see their school(s), teachers see their classes, and guardians see only their own children.
- Database-level access controls (row-level security) and least-privilege access are used.
No system is completely secure. If we become aware of a breach affecting your data, we will act promptly and notify the affected school(s) as required by applicable law.
9. Your rights
Subject to applicable Pakistani law, you may request to access, correct, or delete personal information, or object to certain processing.
- Parents & students: please contact your school, which controls the records. The school can update or remove data directly, and we will assist the school as its processor.
- School staff (owners/teachers/admins): contact us using the details in §12, or ask your school owner.
We will respond to verified requests within a reasonable time.
10. Cookies & local storage
Our dashboard uses your browser’s local storage to keep you signed in (session tokens). We do not use third-party advertising cookies or cross-site tracking. The mobile app stores session tokens securely on your device. Our public website loads fonts from Google Fonts.
11. Changes to this Policy
We may update this Policy from time to time. We will change the “Last updated” date above and, for material changes, notify schools through the Service or by email. Continued use of the Service after an update means you accept the revised Policy.
12. Contact us
For privacy questions or requests, contact us at:
- Email: privacy@rehnuma.online
- Rehnuma, Attock, Punjab, Pakistan
See also our Terms of Service.