Contents
1. Overview
RedeemOS is a cloud-based School Management System operated by RedeemOS Ltd. This Privacy Policy explains how we collect, use, store, and protect information when schools, administrators, teachers, parents, and students use the RedeemOS platform.
We act as a data processor on behalf of the subscribing school, which acts as the data controller for all student, staff, and parent data entered into the platform. This means the school is responsible for determining how personal data is collected and used; RedeemOS processes that data only on the school's instructions.
Last updated: June 2026.
2. Data We Collect
RedeemOS collects only the data necessary to provide school management services.
Account and school data: School name, address, contact information, and subscription details provided during sign-up.
Student data: Names, date of birth, class enrollment, academic records, attendance history, fee balance, and any additional information entered by the school (e.g., medical notes, emergency contacts).
Staff data: Names, contact information, employment records, payroll data, leave records, and attendance history.
Parent data: Names, contact information, and communication preferences linked to student accounts.
Usage data: Log data including IP addresses, browser type, pages visited, and session duration — used for security monitoring and platform improvement.
Payment data: Payment method details for school subscriptions are processed by Paystack and are not stored on RedeemOS servers. We receive only transaction confirmation and reference data.
3. How We Use Data
Data processed through RedeemOS is used exclusively for:
- Providing and operating the school management platform
- Sending notifications and communications as configured by the school
- Processing fee payments on behalf of the school
- Generating reports and analytics for authorised school staff
- Providing customer support and responding to enquiries
- Improving platform performance and security
- Complying with legal obligations
We do not use school data for advertising, profiling, or sale to third parties. We do not share student data with any third party without explicit written consent from the subscribing school, except where required by law.
4. Data Storage and Isolation
Each school on RedeemOS is assigned a dedicated, isolated database. Your school's data is stored separately from every other school and cannot be accessed through another school's account.
Data is stored on cloud infrastructure located in [region to be confirmed]. Backups are taken daily and retained for 30 days. Backup data is stored in encrypted format in geographically separate locations.
All data transmitted between the RedeemOS application and your device is encrypted using TLS 1.3. Data at rest is encrypted using AES-256.
5. Data Retention
RedeemOS retains school data for as long as the school's subscription is active.
Upon cancellation of a subscription, the school's database is retained for 90 days during which the school can request a full data export. After 90 days, the database is permanently deleted.
Schools may request deletion of specific records at any time through the platform's data management tools or by contacting support@redeemos.com.
Usage logs are retained for 12 months for security and audit purposes.
7. User Rights
Subject to applicable data protection law, individuals whose data is processed through RedeemOS have the right to:
- Access: Request a copy of personal data held about them
- Rectification: Request correction of inaccurate personal data
- Erasure: Request deletion of personal data (subject to legal retention obligations)
- Portability: Request personal data in a portable format
- Objection: Object to processing in certain circumstances
Requests relating to data held within a school's RedeemOS account should be directed to the school administration, as the school is the data controller for that data. For requests relating to RedeemOS's own processing of personal data, contact privacy@redeemos.com.
8. Third-Party Services
RedeemOS uses the following third-party services in the operation of the platform:
Paystack: Payment processing for school fee collection and platform subscriptions. Paystack processes payment data according to their own Privacy Policy and PCI DSS compliance standards.
Cloud infrastructure provider: Hosting of the RedeemOS platform and school databases. Infrastructure providers process data only as instructed by RedeemOS and are bound by data processing agreements.
Email service provider: Transactional email delivery (account notifications, receipts). Email content generated by schools is transmitted via this service.
We do not share personal data with any other third parties without the explicit consent of the relevant data controller (the school).
9. Security
RedeemOS implements technical and organisational security measures including:
- Per-school database isolation
- TLS 1.3 encryption in transit
- AES-256 encryption at rest
- Role-based access control
- Tamper-evident audit logging
- Secure session management with HttpOnly cookies
- Regular security reviews
For details, see our Security page at redeemos.com/security.
To report a security vulnerability, contact security@redeemos.com or view our security.txt file at /.well-known/security.txt.
10. Contact
For privacy enquiries:
Email: privacy@redeemos.com
General: support@redeemos.com
Website: redeemos.com
For data subject requests relating to data held within a school account, contact your school's administrator directly.
This Privacy Policy may be updated periodically. Subscribing schools will be notified of material changes by email with 30 days notice before changes take effect.