Privacy Policy & Student Data Protection

Schools maintain 100% legal ownership of all student records, academic performance data, financial transactions, and parent communications.

• Acadely acts solely as a Data Processor on behalf of the educational institution (the Data Controller).
• We never sell, monetize, or license student or parent data to any third parties or advertising networks.
• Data residency is guaranteed within the school's local region (e.g. KSA sovereign cloud zones in Riyadh/Dammam, UAE in Dubai, and India in Mumbai).
• Institutions can export their entire dataset in standardized open formats (JSON, CSV, SQL dump) at any time without restriction.

Recognizing that schools manage sensitive minor data, Acadely applies strict specialized protections for student information.

• Parental consent is verified and managed through authenticated parent portals and school admissions workflows.
• Student profiles are strictly isolated; cross-school tracking, profiling, or behavioral advertising is structurally impossible.
• Medical records, special educational needs (SEN) notes, and disciplinary records have granular zero-knowledge role encryption.
• Automated data purging policies allow schools to set retention timelines following student graduation or transfer.

When schools integrate biometric, RFID, or AI facial recognition attendance devices, raw biometric templates are never stored on cloud servers.

• Attendance hardware converts biometric scans into irreversible mathematical hashes locally on campus hardware.
• Only timestamp logs and encrypted student IDs are synchronized with the central attendance module.
• Parent notifications via WhatsApp or mobile push are dispatched instantly with end-to-end transport encryption.

Acadely's AI capabilities (Question Paper Maker, Daily Briefings, Parent Progress Summaries) are built on enterprise-isolated AI pipelines.

• Student data, exam answers, and financial records are NEVER used to train foundational AI models.
• All AI queries execute within isolated, stateless memory contexts that terminate immediately upon query completion.
• AI output generation adheres strictly to the teacher or administrator's permission tier.

All data processed by Acadely is shielded using international enterprise security benchmarks.

• 256-bit AES encryption at rest for all database partitions, attachments, and backup snapshots.
• TLS 1.3 protocol enforced for all client-to-server and API communications.
• Role-Based Access Control (RBAC) ensures teachers only access their assigned classrooms and students.
• Mandatory multi-factor authentication (MFA) and Single Sign-On (SSO) integration via Google Workspace and Microsoft 365.

Parents and students can exercise their rights to access, correct, or request deletion of personal information directly through their school administration.

• Right to rectification: Request immediate updates to contact or emergency information.
• Right to data portability: Parents can download historical grade sheets, fee receipts, and attendance certificates.
• Data Protection Officer (DPO) Contact: privacy@acadely.online for privacy queries or regional regulatory verifications.