Privacy Policy

Last updated: 8 October 2026

This notice explains how Modern Innovation Solutions operates SchoolNotify Ghana ("SchoolNotify", "we", "us" or "our") and how personal data is handled when people visit or use the service. It is intended to be read with any service agreement between us and a school. It is not a substitute for a school's own privacy notice to parents, guardians or students.

1. Who is responsible for the data?

Modern Innovation Solutions operates SchoolNotify Ghana. For school administrator accounts, service operations, support and platform security, Modern Innovation Solutions generally determines how the relevant personal data is used and acts as the data controller, subject to applicable law.

For parent, guardian and student contact records and the messages a school creates, the school will generally determine the purpose and means of processing and is responsible for those decisions. Where we handle that data only to provide the school's instructions, the school is generally the controller and we act as its service provider or processor. The precise roles depend on the facts and any agreement with the school. The school and Modern Innovation Solutions should document the applicable roles and processing instructions in their service arrangements.

SchoolNotify is designed for use by schools and their authorized administrators. Parents, guardians and students should normally direct questions about why a school collected their details or sent a particular message to that school. We can help route a request to the relevant school where appropriate.

2. Personal data we handle

The information depends on how a school or administrator uses the service. It may include:

• School and account details: school name and type, school address, region and district, school phone number and email, headteacher or proprietor name, administrator name, email address, phone number, role, sender ID, account status and password credential (stored as a password hash, not as the original password).
• Parent and guardian contact details supplied by a school: name, mobile number, email address, relationship to a student and contact status.
• Student and school record details supplied by a school: student name, student ID, class and fee balance. A school may also include personal data in a message, template, campaign name or uploaded contact file.
• SMS and delivery records: message text, sender ID, intended recipient phone number, campaign and template details, provider references, delivery or rejection status, timestamps and error information.
• Payments and account balances: payment reference, amount, currency, status, SMS credits, provider transaction reference and transaction response metadata received from Paystack. Card and other payment credentials are handled by the payment provider; do not send full card numbers or security codes to SchoolNotify.
• Security and service activity: IP address, browser user-agent, account or school identifier, audit action and timestamp. Hosting and web server logs may also contain request, status and connection information.
• Support communications: information you choose to include when you contact us by email, telephone or through another support channel.

We receive information directly from administrators, from schools that create or manage accounts, and from contact lists or messages a school enters or uploads. We also receive payment and delivery information from the relevant providers. Please do not upload information that is not needed for school communications.

3. Why we use personal data

We use relevant information to:

• create and administer school and administrator accounts and authenticate users;
• store school-managed contacts, classes, templates, campaigns and communication records;
• personalize, submit and report on SMS messages requested by a school;
• manage credit balances, transactions, payment verification and payment-related records;
• provide support, maintain the service, diagnose faults and protect accounts and systems;
• investigate misuse, enforce service terms, respond to lawful requests and meet legal obligations; and
• communicate important operational or security notices to school administrators.

We do not sell school contact lists or use parent and student contact records for our own unrelated advertising. A school administrator may use the service to send a school-authorized message; the school is responsible for the message, its audience and its legal basis.

4. Schools, children and SMS permissions

School contact lists can contain information about children, including names, student identifiers, class details and fee balances. We do not design SchoolNotify as an account service for children. A school must minimize the student information it enters, protect administrator access and give parents or guardians any notice required by law. A school must obtain parental or guardian authorization where required and must not upload a list unless it is entitled to do so.

SchoolNotify is not designed to collect health, biometric, religious, political, disciplinary or other highly sensitive student information. Do not add such information to contact records, message text or uploads unless it is strictly necessary, lawfully authorized and covered by appropriate safeguards.

Before sending SMS, the school must ensure it may lawfully use each number for the stated purpose, provide required information, honor objections and opt-outs, and avoid sending unnecessary confidential or sensitive information in a text message. SMS can be visible on a shared or locked device and may be handled by telecom networks and the messaging provider. SchoolNotify currently has no built-in recipient-consent register or automatic STOP/opt-out suppression mechanism. Schools must manage permissions and suppression outside the platform and must not send further messages when a recipient has validly objected.

If you received a school message and want it to stop, contact the school named in the message. You may also contact us at the details below; we can refer the request to the relevant school, but the school controls its contact list and sending decisions.

5. Providers and other disclosures

We disclose only information relevant to providing the service, responding to a lawful request or protecting rights and systems. Depending on use, recipients may include:

• Fly.io: hosting the application and its persistent database infrastructure. The current production application and database volume are configured in Fly.io's London region.
• BMS / mNotify: the configured SMS gateway. To request SMS delivery, the service sends the recipient number, sender ID and message content to the gateway, which may return delivery, reference and error information.
• Paystack: payment initiation and verification. We send information needed to initiate a school payment, such as the school's email, amount, currency, reference and relevant school or credit metadata. Paystack returns transaction information that we use to reconcile payments.
• Content delivery providers: some pages request libraries, styles, scripts or fonts from providers such as jsDelivr and Bunny Fonts. Those providers may receive ordinary connection information, such as your IP address and browser details, when your browser requests those resources.
• Authorities and advisers: regulators, law enforcement, courts, professional advisers or other parties where disclosure is required by law or reasonably necessary to protect people, the service or legal rights.

These providers may process information under their own terms and privacy notices. Their systems may be located outside Ghana. Contact us if you need more information about a particular transfer or provider. We do not control the independent processing practices of those providers. The school and Modern Innovation Solutions are each responsible for meeting any cross-border transfer requirements that apply to their respective processing.

6. Cookies and similar technologies

The service uses essential session and security cookies needed for functions such as keeping an administrator signed in and protecting forms. The production site is configured to use secure cookies over HTTPS. The application templates inspected for this notice do not include an advertising cookie or analytics tracking pixel. Your browser may separately store or send information when loading third-party page resources described above.

7. Retention

We keep personal data only for as long as reasonably needed for the purposes described here, to provide the service, resolve disputes, protect the service and meet applicable legal or accounting requirements. The period depends on the type of data and the school's instructions.

The application does not currently publish or enforce a fixed deletion schedule for all account, campaign, SMS, payment and audit records. School administrators can manage contact records in the service, but deleting a contact does not necessarily remove separate campaign, delivery, transaction or audit records. For account closure or a data deletion request, contact us and identify the school/account concerned. We may retain information that must be kept by law or is needed to establish, exercise or defend legal claims, and will restrict it to that purpose where appropriate.

8. Security

We use measures intended to protect information, including password hashing, HTTPS for the production service, access controls and school-level access boundaries. Access may be available to authorized school administrators and to our personnel or service providers when needed to operate, support, secure or maintain the service. No website, device, transmission or storage system can be guaranteed completely secure. Please use a unique password, protect administrator accounts and tell us promptly if you suspect unauthorized access. We will notify affected schools or individuals where and as required by applicable law.

9. Your privacy choices and requests

Subject to the Ghana Data Protection Act, 2012 (Act 843) and other applicable law, you may ask about personal data concerning you, request access or correction, object to or ask us to stop certain processing where the law allows, or raise a complaint. The rights available can depend on the data and whether the school or Modern Innovation Solutions is the controller.

For parent, guardian or student records, contact the relevant school first because it generally decides why those records are used. For an account, security or payment-data request, contact us using the details below. We may need to verify your identity and authority, and may need to refer a school-record request to the school. You may also contact Ghana's Data Protection Commission through dpc.gov.gh.

We will respond within the time required by applicable law. A request does not require us or a school to disclose another person's information or delete records that must be retained by law.

10. Changes to this notice

We may update this notice when the service, our data practices or applicable law changes. We will update the date at the top of this page. If a change materially affects how an account or school data is handled, we will take steps to give affected administrators notice as appropriate.

11. Contact us