Privacy Policy
The short version
- We hold the information the school needs to run classes, reports and fees: pupils' details and results, staff and parent contact details, and payment records.
- Each person sees only what their role needs. A parent sees only their own approved children.
- We never sell information or use it for advertising.
- The database is hosted by Supabase in Frankfurt, Germany (EU).
- You can ask to see or correct the information we hold about you or your child.
1. Who we are
Ridge Valley Hybrid School ("the school", "we") runs this portal and decides how the information in it is used. We follow the Data Protection Act, 2012 (Act 843) of Ghana. This policy explains what the portal holds, why, and your choices. It should be read with the Terms of Use.
2. What information we collect
About people with an account (staff and parents)
- Account details: full name, email address, account type (administrator, teacher, accountant or parent) and whether the account is approved. Parents also give a phone number, which they can use to sign in.
- Password: your password is handled by our sign-in provider and stored only in a scrambled (hashed) form. School staff cannot see it.
- Teaching details: the class a teacher is assigned to.
- Parent links: which pupils a parent has asked to be linked to, and whether the school approved the link.
- Your agreement: the date and version of these terms you agreed to.
About pupils
- Identity and enrolment: name, date of birth, age, sex, admission number, class, academic year, enrolment status, a parent's phone number, and promotion or graduation history.
- Academic reports: class and exam scores, totals, grades, class positions, attendance figures, teachers' and head teacher's remarks, and dates such as when the next term begins.
- Early-years development (crèche, nursery and kindergarten): developmental observations, ratings, and height and weight measurements recorded on the report.
About fees and payments
- Fees and bills set for each pupil or class.
- Payment records: amount, method (Mobile Money or cash), date, status (pending, confirmed or rejected) and which staff member verified it.
- Payment proofs: screenshots of Mobile Money payments uploaded by parents. These may show a phone number, name and transaction reference.
Messages and technical information
- Notifications and announcements sent through the portal, and whether you have read them.
- If you turn on device alerts: a technical address for your browser's push service and the encryption keys for it, plus your browser type (see section 9).
- Error reports and limited session recordings (see section 10), and the standard technical details any website receives, such as your IP address and browser type.
3. How we use information
- To run the school: classes, enrolment, promotions, graduation and records.
- To prepare, review and share pupils' end-of-term reports with their parents.
- To set fees, record and verify payments, issue receipts and produce financial reports.
- To send announcements and notifications, and device alerts if you turn them on.
- To create and approve accounts, keep the portal secure and fix problems.
- To meet our legal and regulatory duties as a school.
We use information because it is needed to educate pupils and to run the school, because the law requires it, or because you have agreed (for example, to device alerts). We do not sell information, use it for advertising, or make automated decisions about anyone.
4. Children's information
Pupils do not use the portal. Their information comes from the school and from their parents or guardians, and we take extra care with it. A parent can see a child's information only after the school has approved the link between them. Teachers see only the pupils in their own class.
5. Who can see what
Access is enforced by the database itself, not just by what each screen shows.
| Account | Can see |
|---|---|
| Administrator | All pupil, staff and parent records, all reports, and school settings. |
| Teacher | Their own account; the pupils in their assigned class and those pupils' reports and bills. |
| Accountant | Fees, bills, payments and payment proofs; the pupil and parent details needed for billing; other accountant accounts (to approve them). |
| Parent | Their own account; their approved children's details, fees, payments, and reports once published. |
6. Service providers we use
We use these companies to run the portal. They handle information only to provide their service to us.
- Supabase: the database, sign-in, file storage (payment proofs and report templates), sign-up and password emails, and the service that sends device alerts. Hosted in Frankfurt, Germany.
- GitHub Pages: hosts the portal's web pages. It does not receive the information stored in the database.
- Sentry: error monitoring (see section 10).
- Push services (Google, Apple or Mozilla, depending on your browser): deliver device alerts if you turn them on. The alert's content is encrypted on its way to your device.
- Content delivery networks (Cloudflare cdnjs, jsDelivr, Tailwind CSS and Google Fonts): supply the fonts, icons and code libraries the pages use. Like any website your browser contacts, they receive your IP address and browser details, but not portal data.
7. Where information is stored
The portal's database and files are stored by Supabase in the European Union (Frankfurt, Germany). Some providers listed above may also process technical information in other countries, including the United States. We use established providers that protect information with encryption and access controls.
8. Browser storage and cookies
The portal does not use advertising or tracking cookies. It stores a few items in your browser so it works properly:
- your sign-in session, so you stay signed in until you sign out;
- your light or dark mode choice;
- which announcements you have already read;
- for teachers, the class, term and name used on the report page;
- a copy of bill information, so reports can show upcoming bills;
- a small background script that shows device alerts.
You can remove these by signing out and clearing your browser's data for the site.
9. Notifications and device alerts
Notifications always appear under the bell in the portal. Device alerts, which can arrive even when the portal is closed, are optional. You choose whether to allow them, and you can change this at any time in your browser's site settings or from the bell panel. When you sign out, the device is unregistered and stops receiving your alerts. Registrations a browser no longer accepts are deleted automatically.
10. Error monitoring
We use Sentry to find and fix errors. When something goes wrong, Sentry receives a technical error report. It also records a replay of what happened on screen for sessions that hit an error, and for a small sample (about 1 in 10) of other sessions, so problems can be reproduced. Sentry's privacy settings hide on-screen text and anything typed into forms in these recordings. They are used only to fix problems.
11. How long we keep information
- Pupil records, reports and payment records: kept while the pupil is at the school, and afterwards for as long as the school needs them for its educational, financial and legal records. Graduated pupils' records are kept as part of the school's archive.
- Accounts: kept while the account is in use. Rejected account requests are deleted.
- Notifications and announcements: kept until deleted by the school.
- Device alert registrations: removed when you sign out, or when your browser stops accepting alerts.
12. How we protect information
- All connections to the portal are encrypted (HTTPS).
- Database security rules limit each account to the information its role needs (see section 5).
- Payment proofs and reports are stored privately and opened only through short-lived links.
- Staff accounts must be approved before they work, and the finance section asks for an extra email verification code.
- Passwords are stored only in hashed form.
No system is completely secure. If a breach affects your information, we will notify you and the Data Protection Commission as the law requires.
13. Your rights
Under the Data Protection Act, 2012 (Act 843) you can ask us to:
- tell you what information we hold about you or your child, and give you a copy;
- correct information that is wrong or out of date;
- delete information we no longer have a reason to keep, or stop using it in a particular way;
- withdraw a choice you made, such as device alerts.
To make a request, contact the school using the details below. We may need to confirm your identity first. If you are unhappy with how we handle your information, you can complain to the Data Protection Commission of Ghana.
14. Changes to this policy
We will update this policy when the portal or the law changes. Each version has a date at the top. When we make a change you need to know about, the portal will ask you to agree again before you continue.
15. Contact
For privacy questions and requests, including questions about fees and payment records, email hybridridgevalley@gmail.com or speak to the school office.
See also the Terms of Use.