Privacy Policy

1. Who we are

Luminescent (“we”, “us”) makes Lumio School OS, an online service that helps private schools in Nigeria manage student results and send them to parents. We are based in Lagos, Nigeria.

This policy explains what personal data we handle, why we handle it, and how we protect it. It follows the Nigeria Data Protection Act 2023 (NDPA).

2. Who is responsible for the data

For student, parent and staff records, the school is in charge. The school decides what to enter and why. Under the NDPA, the school is the data controller, and we are the data processor: we store and process this data only to provide Lumio School OS to the school, and only as the school instructs.

For school owner accounts, billing and this website, we are in charge. For this data, we are the data controller.

3. What we collect

About the school

School name, address, state, phone number, logo, academic sessions, classes, subjects and grading settings.

About school staff

Name, email address, phone number (optional), role, staff ID (optional), photo (optional), the classes and subjects they are assigned to, and when they last signed in.

About students

Name, admission number, class, date of birth (optional), gender (optional), photo (optional), CA and exam scores, totals, grades, class positions, and teachers' and principal's comments.

About parents and guardians

Name, WhatsApp phone number, email address (optional), and which student they are linked to. We also keep a record of whether each result message was sent.

About payments

The plan chosen, number of students, amount, payment reference and payment status. Card details go straight to Paystack, and we never see or store them.

About how the service is used

A record of important actions, such as who submitted scores, who approved them and who published results, so schools can see what happened and when. We also keep basic technical records, such as sign-in attempts, to keep the service secure.

Cookies

We use your browser's storage only to keep you signed in to the app. We do not use advertising or tracking cookies.

4. How we use it

• To provide the service: score entry, automatic grades and positions, report cards, the parent result page and WhatsApp messages.
• To take payments and keep billing records.
• To keep the service secure and prevent misuse.
• To give support when a school asks for help.
• To meet our legal duties, such as keeping tax records.

We do not sell personal data, use it for advertising, or use student or parent data to market anything. We use the contact details of school owners and staff only to run the service and to send important notices about it.

5. Who can see it

• Other schools: never. Each school's data is separated at the database level, not just hidden on screen.
• Teachers: only the classes and subjects they are assigned to.
• Admins, principals and owners: their own school's records. Only admins can see parents' phone numbers.
• Parents: only the result of their own child, through the private link sent to them. Anyone who has that link can open that one result, so parents should not share it publicly. Each link is long and random, so it cannot be guessed.
• Lumio staff: only when needed for support, security or billing. Our management dashboard shows totals such as how many students a school has, not individual student records.

6. Companies that help us

We use a small number of trusted service providers. Each one receives only the data it needs to do its job:

• Supabase — stores the database, files such as logos and photos, and handles sign-in. Passwords are stored in scrambled (hashed) form, and nobody at Lumio can read them.
• Vercel — hosts this website and the app.
• Paystack — processes card, bank transfer and USSD payments.
• Termii — sends the WhatsApp result messages. It receives the parent's phone number and the message text.

Some of these providers store data on servers outside Nigeria. Where that happens, we rely on the safeguards the NDPA requires, such as contracts that protect the data.

7. How we protect it

• Each school's data is kept separate by rules in the database itself.
• Every connection is encrypted (HTTPS).
• Each person's access depends on their role, and the database enforces it, not just the screen.
• Published results are locked, so they cannot be changed without anyone noticing.
• Important actions are recorded in a log that cannot be edited.
• Secret keys for payments and messaging are kept on our servers, never in the app on your phone.

8. How long we keep it

We keep a school's data for as long as the school uses Lumio School OS. Students who leave are marked inactive rather than deleted, so their past results stay available to the school.

If a school closes its account and asks us in writing to delete its data, we will delete it within 90 days. The exception is payment records, which we keep for as long as Nigerian tax law requires. Before deleting anything, we can give the school a copy of its data if asked.

9. Your rights

Under the NDPA, you have the right to:

• ask what data is held about you and get a copy,
• have wrong data corrected,
• ask for data to be deleted,
• object to, or ask us to limit, how your data is used,
• withdraw consent, where consent was the reason for using your data,
• receive your data in a format you can take elsewhere,
• complain to the Nigeria Data Protection Commission (NDPC).

Parents and staff: the school controls your records, so please contact the school first. You can also write to us and we will pass your request to the school and help them answer it.

10. Children's data

Lumio School OS is used by school staff, not by children. Students do not have accounts in this version. Schools enter student records, and each school is responsible for having a lawful reason to do so, such as the consent of parents or guardians where the law requires it.

We use student data only to produce results and reports for the school and the student's parents. We treat it with extra care because it belongs to children.

11. If something goes wrong

If we discover that personal data has been lost, stolen or seen by someone who should not have seen it, we will tell the affected schools without delay. We will explain what happened and what we are doing about it, and help them meet their legal duty to report it to the NDPC within 72 hours.

12. Changes to this policy

If we change this policy, we will update the date at the top. If the change is important, we will tell school owners by email or WhatsApp before it takes effect.

13. Contact us

For any question about privacy, or to make a request about your data:

Email: matthewfolaweogunnaike@gmail.com
WhatsApp: +234 908 338 7814
Luminescent (makers of Lumio School OS), Lagos, Nigeria

We aim to reply within 7 days, and to complete data requests within 30 days.