Privacy notice

1. Who is responsible

RaksoEd Solutions operates SchoolAide Lite and is the personal information controller for the accounts, logs and documents the platform itself creates. Our Data Protection Officer can be reached at privacy@schoolaide.ph.

The teacher who uploads a class list is the person who decides which learners are recorded and why. For that learner data, the teacher acts in the course of their work for their school, and we process it only on the teacher's instructions: to compute grades, produce report cards, and deliver them to the learners and guardians the teacher names.

2. What we collect, and why

Teachers. Name, email address, password (stored hashed), the school you say you teach at, an optional PRC licence number (stored encrypted, used only to verify that you are a teacher), and a log of the actions you take in the app. Legal basis: the contract between you and us when you open an account, and our legitimate interest in keeping the service for teachers only.

Learners. Only what a gradebook needs: name, sex, optional Learner Reference Number (stored encrypted), optional email address, optional birthdate, scores, computed grades, attendance summaries, and the report cards generated from them. We never ask for addresses, photos, or contact numbers. Legal basis: the teacher's lawful mandate to keep learner records under DepEd rules; a learner or guardian who opens a portal account also consents to that account.

Guardians. Name and email address, only when a teacher lists one for report card delivery or when a guardian gives consent for a learner's portal account. We also record the time, IP address and browser of a consent decision, because that record is what makes the consent verifiable.

Technical data. A session cookie to keep you signed in and one cookie remembering whether the sidebar is collapsed. There are no advertising or analytics trackers.

3. Children

A learner under 18 cannot open a portal account without a parent or guardian's verified consent. Nothing renders in that account until consent is recorded. The guardian may withdraw consent at any time using the link in the confirmation email, and the account then shows nothing. Report cards emailed to a guardian's address, or printed, do not require a learner account at all.

4. Who else sees the data

We use the following service providers, each bound by contract to process data only for us: a hosting provider in Singapore (AWS ap-southeast-1) for servers, databases and encrypted file storage, and a transactional email provider that carries the emails we send (one-time codes, report card links, notices). Report cards are rendered on our own servers. We do not sell, rent or share personal data with anyone else, and we do not share it with DepEd or a school unless the teacher exports it themselves.

Because our hosting is outside the Philippines, personal data is stored abroad under safeguards required by the National Privacy Commission: encryption in transit and at rest, access limited to named staff, and contractual obligations on the provider.

5. How long we keep it

An account untouched for 12 months is archived and becomes read-only. After 24 months of continued inactivity it is purged: roster, scores, documents and every learner record with it. We warn you by email four times before that happens, and one click keeps the account. Deleting your account yourself starts a 30-day grace period, after which the same purge runs. Audit logs of security-relevant events are kept for 24 months after the account they concern is purged.

6. Your rights

Under the Data Privacy Act you may access the data we hold about you, have it corrected, have it erased, receive a copy in a portable format, and object to processing. Teachers can export everything they own from Settings at any time and delete their account there. Learners and guardians can ask the teacher to correct or remove a record, or write to our DPO if the teacher cannot be reached. You may also file a complaint with the National Privacy Commission.

We answer requests within 15 working days. Reach the DPO at privacy@schoolaide.ph; general questions go to our Facebook page during Monday to Friday, 8:00 AM to 5:00 PM.

7. How we protect it

Learner Reference Numbers and PRC numbers are encrypted at rest. Passwords are hashed. Generated documents live on private storage and are served only through signed, expiring links sent to one address. Every change to a grade, a roster, a release or a permission is written to an append-only audit log. Staff access is limited to named accounts and every staff action is logged the same way.

If a breach is likely to harm the people whose data is involved, we notify the National Privacy Commission within 72 hours of discovering it and tell the affected teachers, who are best placed to reach their learners and guardians, at the same time.

8. Changes

Material changes to this notice are announced inside the app before they take effect. The date below is the date counsel last reviewed it.