1. Who we are
Edubaze is school-management software for Nigerian schools, operated by EDUBAZE DIGITAL SYSTEMS LTD (RC 9617722), House 30 Janet Fajemigbesin Street, Diamond Estate, Amuwo Odofin, Lagos, Nigeria. In this policy, “we”, “us” and “Edubaze” refer to that company.
2. Our two roles: controller and processor
Edubaze plays two different roles under the NDPA, and it matters for your rights:
- When a school uses Edubaze, the school is the data controller of its students’, parents’ and staff’ personal data (for example names, dates of birth, guardian contacts, photographs, results, attendance and fees). Edubaze acts as the school’s data processor— we process that data only on the school’s instructions, to provide the service. If you are a parent or student, please contact your school first to exercise your rights; we will support the school in responding.
- Edubaze is the data controller for the personal data of the account holders who sign up with us directly — school owners and partners — including their contact details, login information, partner bank details, and how they use the platform.
3. The personal data we collect
Account & contact data (we are controller)
- Name, username, phone number and email address.
- A password, which is stored only as a secure one-way hash — we never see or store it in plain text.
- For partners: state, city and the bank details you give us so we can pay your commission.
School data (the school is controller; we process it)
- Student records: names, other names, gender, date of birth, admission number, class, guardian name/phone/email, and an optional passport photograph.
- Academic data: scores, grades, positions, report cards and attendance.
- Fees data: invoices, and the proof-of-payment documents (bank-transfer receipts) that families upload, which may show bank details.
- Staff records the school creates (name, role, contact details).
- BazeAI tutor chats(Max-plan schools): when a student uses the built-in AI learning companion (“BazeAI”), we store the questions the student types and the answers BazeAI gives, linked to the student and the piece of school work they were asking about. These chats are visible to the student’s teachers and school — students are told this before they start.
- BazeAI for Admins chats(all plans): when a school administrator uses the built-in admin assistant (“BazeAI for Admins”), we store the questions they type and the answers BazeAI gives, linked to that administrator and school.
Technical data
- Strictly necessary cookies that keep you signed in and protect the service, plus optional analytics cookies on our public marketing pages only — set only with your consent, and never inside the school, partner or admin portals (see our Cookie Policy). We do not use advertising trackers.
- Basic security logs (for example sign-in events and an audit trail of sensitive actions) and limited technical information such as IP address, needed to keep accounts secure.
4. How we use personal data, and our lawful basis
Under the NDPA we must have a lawful basis for each use. Ours are:
- Performance of a contract — to create and run your account, provide the service to schools and partners, and process subscriptions and commissions.
- Legitimate interests — to keep the platform secure, prevent fraud and abuse, maintain audit logs, and improve the service — balanced against your rights.
- Legal obligation — to comply with Nigerian law, including tax, record-keeping and the NDPA itself.
- Consent— where we rely on consent (for example a school obtaining a parent’s consent to process a child’s data), it can be withdrawn at any time.
5. Children’s data
Edubaze necessarily processes the data of children (students under 18) on behalf of schools. The NDPA requires the consent of a parent or legal guardian to process a child’s personal data. The school, as controller, is responsible for obtaining and recording that consent and for only entering data it is entitled to. Edubaze provides the security and controls to protect this data and processes it solely on the school’s instructions. We do not market to children or use children’s data for any purpose other than delivering the school’s service. Where a school enables the BazeAI tutor, students’ chats with BazeAI are children’s data and are handled with the same protections: we send our AI provider only the minimum described in section 6A, the school’s teachers can see every conversation, and students are clearly told so before they start. Where a school administrator uses BazeAI for Admins, answers about the school’s own records may include children’s academic and fees data the school already holds; that data is processed under the same safeguards, as described in section 6B.
6. Sharing and disclosure
We do not sell personal data. We share it only as follows:
- Service providers (sub-processors) who help us run the platform — principally our hosting provider, Hetzner Online GmbH, in data centres located in the European Union (Germany/Finland), and, for our AI features (the BazeAI tutor and BazeAI for Admins), our AI provider Anthropic, PBC (see sections 6A and 6B) — under contracts that require them to protect the data and use it only as we instruct.
- Between a school and its partner:a partner who onboards a school can see that school’s subscription and billing status, but never its students, results, fees records or staff data.
- Legal and safety: where required by law, court order, or a lawful request from a regulator such as the Nigeria Data Protection Commission (NDPC), or to protect rights, safety and security.
Each school’s data is technically isolated so that no other school — and no partner — can access it.
6A. The BazeAI tutor and our AI provider
Schools on our Max plan get BazeAI, an AI learning companion that helps a student who is stuck on an assignment. BazeAI is designed to guide like a teacher — it does not give students the answers to graded work — and every conversation is visible to the school’s teachers. Students are told this before they start, and each student has a daily limit on questions.
To generate BazeAI’s replies we use an artificial-intelligence service provided by Anthropic, PBC, a company in the United States, as our sub-processor. We deliberately send our AI provider the minimum needed for a helpful answer: the student’s first name only, their class and school name, the subject and the assignment text, and the messages in the chat. We do not send surnames, admission numbers, dates of birth, guardian contact details, photographs, results or fees data.
Our AI provider processes this data only to provide the service: under its commercial terms it does not use the data to train its AI models, and it automatically deletes the data from its systems within 30 days (content flagged for abuse may be kept longer, as its policy allows). Because our AI provider is based in the United States, this involves a transfer of personal data outside Nigeria; we rely on a data-processing agreement with appropriate safeguards, in line with the NDPA (see section 7).
The chat transcripts we keep on our own servers are school data like any other: isolated per school, visible only to that school, and deleted under the retention rules in section 8.
6B. BazeAI for Admins and our AI provider
Every school also gets BazeAI for Admins, an assistant for the school’s administrators. It answers two kinds of questions: how to use Edubaze, and questions about the school’s own records (for example fees collection, class performance or attendance). BazeAI is read-only: it can look up and summarise, but it cannot create, change or delete anything. It can only read the records of the school whose administrator is asking — it has no access to any other school — and each school has a daily limit on questions. Schools can switch the assistant off in Settings.
BazeAI’s replies are generated by the same AI provider as the BazeAI tutor, Anthropic, PBC in the United States, acting as our sub-processor. To answer a question we send the administrator’s first name, the school’s name and plan, the messages in the chat, and — only where the question requires it — summaries of the school’s own records, which may include student names, academic results and fees figures the school already holds. The same contractual protections as in section 6A apply: our AI provider does not use this data to train its AI models and deletes it from its systems within 30 days, and the transfer is covered by the same data-processing agreement and safeguards described in sections 6A and 7.
The chat transcripts we keep are school data like any other: isolated per school, visible only within that school, and deleted under the retention rules in section 8.
7. Where your data is stored, and international transfers
Our servers are provided by Hetzner Online GmbH, in data centres located in the European Union (Germany/Finland). This means personal data is transferred to and stored outside Nigeria. The NDPA permits such transfers where the destination provides adequate protection or appropriate safeguards are in place. Our host operates under the European Union’s General Data Protection Regulation (GDPR), which provides a high standard of protection, and processes data for us under a data-processing agreement that includes the European Commission’s Standard Contractual Clauses. We keep this safeguard available on request, and we transfer only the data needed to run the service.
For schools using our AI features, the data described in sections 6A (the BazeAI tutor) and 6B (BazeAI for Admins) is also transferred to our AI provider, Anthropic, PBC, in the United States, under a data-processing agreement with appropriate safeguards. Our AI provider deletes this data from its systems within 30 days.
8. How long we keep data
We keep personal data only as long as needed for the purposes above and to meet legal obligations. School data is retained for as long as the school uses Edubaze; when a school leaves, we return or delete its data on request, and otherwise within about 90 days, subject to any legal retention requirement. Financial and billing records (such as invoices and payment confirmations) are kept for up to 6 years to meet Nigerian tax and company-law obligations, after which they are deleted. BazeAI tutor chats and BazeAI for Admins chats are part of the school’s data and follow the same rule; our AI provider separately deletes its copies within 30 days as described in sections 6A and 6B. Backups rotate out of our system on their normal cycle, after which residual copies are overwritten.
9. How we protect personal data
We apply data-protection-by-design and a range of technical and organisational measures, including:
- Strict tenant isolation— every school’s data is walled off at the data layer so it cannot be accessed by another school.
- Passwords stored as secure one-way hashes; encryption of data in transit (HTTPS).
- Role-based access control — people see only what their role allows — plus sign-in rate-limiting against guessing.
- Uploaded files (photos, payment proofs) held in a private store, served only to authorised users of the same school.
- An audit log of sensitive actions, and regular encrypted backups.
10. Your rights under the NDPA
You have the right to:
- be informed about how your data is used (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted in certain circumstances;
- restrict or object to certain processing;
- data portability where applicable;
- withdraw consent at any time where we rely on consent; and
- lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise these rights, email privacy@edubaze.com. If your data was entered by a school (for example a student or parent), please contact your school first, as the school controls that data; we will assist the school in responding.
11. Data breaches
We maintain procedures to detect and respond to personal-data breaches. Where a breach is likely to result in a risk to people’s rights, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours where feasible, and inform affected data subjects (or the relevant school) where the law requires.
12. Changes to this policy
We may update this policy as the service or the law changes. We will revise the “Last updated” date above and, for material changes, give notice in the app.
13. Contact us & our DPO
For any privacy question, or to reach our Data Protection Officer, email dpo@edubaze.com (privacy enquiries: privacy@edubaze.com). You may also contact the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng.