Privacy Policy

This Privacy Policy explains how Pensbase (“Pensbase”, “we”, “our”) collects, uses, and protects information when a school and its staff, students, and parents/guardians use the platform.

1. Who this policy covers

This policy applies to every school subscribed to Pensbase, and to the people who use it on that school's behalf: proprietors, Head Teachers, ICT Admins, Bursars, Teachers, parents/guardians, and prospective applicants. Each school's data is a separate, isolated tenant — accessible only to that school's own staff and Pensbase's platform administrators.

2. Information we collect

• Account information — name, email, phone number, and role, for anyone invited to a school's portal.
• Student records — admission details, class and arm assignment, attendance, results, and guardian/parent contact information, entered by the school.
• Payment records — fee amounts, balances, and payment history. Card and bank details are handled directly by our payment processors (Paystack, Flutterwave) — Pensbase never stores full card numbers.
• Communications — messages sent through “Book a Demo” or “Contact Us”, and system emails/SMS (invitations, admission decisions, attendance notices).
• Usage data — basic technical logs (e.g. sign-in activity) used to operate and secure the platform.

3. How we use information

Information is used to operate the platform a school has subscribed to: running admissions, timetables, attendance, results, and payments; sending the notifications a school configures; responding to support requests; and improving the product. We do not sell any school's or student's data.

4. Data isolation and security

Every school's records are isolated at the database level using PostgreSQL Row-Level Security — not merely hidden by the interface. The application's own database connection has no default access to another school's data; cross-school access is restricted to the narrow set of platform operations that genuinely require it (e.g. resolving a payment before a school context exists). Data in transit is encrypted (HTTPS/TLS).

5. Third-party service providers

We rely on a small number of providers to operate the platform, each processing only what their function requires:

• Paystack and Flutterwave — online payment processing.
• Termii — SMS delivery.
• Resend — transactional email delivery.
• Our cloud hosting and database providers — to run and store the application.

6. Children's data

Pensbase is used by schools to manage records belonging to students, including minors. A school acting as the data controller is responsible for obtaining any consent required from parents or guardians before entering a student's information. Pensbase acts as a data processor on the school's behalf and only accesses student data to operate and support the platform.

7. Data retention

Records are retained for as long as a school's account is active, and for a reasonable period afterward to allow a school to export its data or resume its subscription. A school may request deletion of its data by contacting us.

8. Your rights

Requests to access, correct, or delete personal information should go through the school first, since the school controls its own records. If that is not possible, you may reach us directly at our contact page.

9. Cookies

Pensbase uses only the cookies necessary to keep you signed in and to remember basic preferences. We do not use third-party advertising or tracking cookies.

10. Changes to this policy

We may update this policy as the platform evolves. Material changes will be reflected by updating the “Last updated” date above.

11. Contact us

Questions about this policy can be sent through our contact page.