Privacy Policy

Information you provide directly

When you contact us through our website, request a quote, or engage our services, we collect information you voluntarily provide — including your name, email address, company name, phone number, and any details you share about your project or business.

Information collected automatically

When you visit our website, we may automatically collect certain technical information including your IP address, browser type and version, pages visited, time spent on pages, referring URLs, and device information. This data is used solely to understand how visitors interact with our site and to improve the user experience.

Information from our products

If you use our SaaS products (Invaura or Aurasis), we collect account registration information, usage data, and any content you input into those platforms. This data is governed by the specific terms of each product and is handled with strict confidentiality. Aurasis — our school result management system (SRMS) — collects the additional categories described below, given the nature of running a school on the platform.

School and staff data (Aurasis)

When a school registers for Aurasis, we collect the school's profile information (name, address, email, phone, logo, brand colour) and, for its staff accounts (school administrators, head teachers, principals, teachers, bursars), their name, email address, phone number, role, and password (stored as a salted hash, never in plain text). If a staff member connects Google Meet to host online classes, we also store the OAuth tokens needed to create and manage those meetings on their behalf.

Student data (Aurasis)

A school inputs and manages student records on Aurasis, which may include a student's name, gender, admission number, email, academic results and grades, attendance, behavioural trait ratings, teacher and principal comments, report cards, and uploaded documents (e.g. certificates, ID photos). This data is provided and controlled by the school — see "Whose Data This Is: Schools, Guardians, and Students" below for how responsibility for it is divided between the school and AuraStacks Technology.

Guardian/parent data (Aurasis)

Schools may invite a student's parent or guardian to Aurasis's guardian app, which collects the guardian's name, email address (their login identifier — guardians sign in with a one-time passcode sent by email, not a password), phone number, their relationship to the student(s), and their fee/shop payment history on the platform.

Payment and financial data (Aurasis)

Aurasis lets schools collect tuition fees and shop-item payments from guardians online, and lets a school's bursar record physical (cash/transfer/POS) payments. We store the amount, payment channel, timestamp, and — for online payments — a reference to the transaction. We do not collect or store card numbers, bank login credentials, or other raw payment credentials; those are entered directly into our payment processor's (Paystack's) own secure checkout. See "Payment Processing" below for more detail, including how the processing fee shown at checkout is calculated. A school's own payout account details (bank name, account number, account name) are collected once to set up fee collection and are used only to route the school's share of each payment to them via Paystack.

AI-processed data (Aurasis)

Aurasis offers an optional AI-generated academic insight feature. When a school, teacher, student, or guardian requests this for a specific student, we send the relevant academic data — the student's name, admission number, gender, term scores and grades, attendance, behavioural trait ratings, and teacher/principal comments — to a third-party AI provider (Anthropic, maker of Claude) solely to generate that insight. See "AI-Generated Insights" below.

Device and technical data

Our mobile app registers a device push-notification token (via Expo's push service) so we can deliver app notifications, and our web dashboard collects standard technical data (IP address, browser type, pages visited) the same way our marketing website does.

For data a school inputs about its own students, staff, and the guardians it invites, the school is the data controller — it decides what data to collect and why, and is responsible for having a lawful basis for collecting and sharing it (including, where required, obtaining appropriate consent from a guardian before their or their child's data is entered onto the platform). AuraStacks Technology acts as a data processor for this data: we process it only to provide the Aurasis service, following the school's instructions, and we do not use it for our own independent marketing or sell it to third parties.

This means requests to access, correct, or delete a student's or guardian's personal data are generally best directed to the student's school first, since the school controls that record. We will still assist with any request made directly to us — including verifying it with the relevant school — and will honour requests we are legally required to fulfil directly.

For data about you personally that you provide to us directly — such as when you contact us, request a quote, or register your own Aurasis account as a school administrator — AuraStacks Technology is the data controller, and the rest of this policy applies to you directly.

Aurasis is a school management platform used by schools to manage the academic records of their enrolled students, many of whom are minors. We do not market Aurasis to children, and we do not solicit personal information directly from a child independent of their school. Student data on Aurasis is entered and managed by the school as part of its own academic administration, and a guardian's access to their child's data is granted by the school, not obtained by us soliciting the guardian directly.

Because a school controls the lawful basis for enrolling a student and inviting a guardian (see "Whose Data This Is" above), we rely on the school to ensure it has the appropriate authority and, where applicable, guardian consent, before adding a student's or guardian's data to Aurasis. If you are a parent or guardian with concerns about your child's data on the platform, please contact your child's school directly, or reach out to us at hello@aurastacks.com and we will assist, including by contacting the school on your behalf where appropriate.

Our own marketing website (aurastacks.com) is not directed at children, and we do not knowingly collect personal information from children through it.

Aurasis's AI insight feature is optional and only runs when a school, teacher, student, or guardian requests it for a specific student's report card. When requested, we send the academic data listed under "AI-processed data" above to Anthropic's Claude API, which generates a narrative summary (e.g. strengths, areas to work on, an attendance/behaviour read-out) that is then shown back in Aurasis and cached against that student's record for reuse.

Anthropic processes this data under its own API terms and does not use data submitted via its API to train its models. We do not send this data to Anthropic for any purpose beyond generating the requested insight.

AI-generated content can be inaccurate or incomplete. It is intended to support — not replace — a teacher's or school's own professional judgement, and should be reviewed before being relied on for any decision about a student.

All payments on Aurasis — school subscription billing, tuition fee payments, and shop-item purchases — are processed by Paystack, a licensed payment service provider. When you pay by card, bank transfer, or another channel Paystack supports, your payment details are entered directly into Paystack's own secure checkout page; AuraStacks Technology never receives or stores your card number, expiry date, CVV, or bank login credentials.

Processing fee

For online tuition fee and shop payments, a processing fee — covering Paystack's own transaction fee plus a capped platform fee for AuraStacks Technology — is added to the amount owed and shown to the payer before they confirm checkout, so the school receives the full amount invoiced. This fee does not apply to fees a bursar records as paid physically (e.g. cash, bank transfer to the school directly, POS).

School payout accounts

A school's share of each fee/shop payment settles directly to the bank account the school connects via Paystack — it does not pass through an account held by AuraStacks Technology. We store the bank details a school provides (account number, bank, account name) solely to configure this payout routing with Paystack.

We use the information we collect for the following purposes:

To respond to your inquiries

When you contact us, we use your information to understand your needs, respond to your questions, and provide relevant information about our services and products.

To deliver our services

For clients who engage us for software development or consulting, we use project-related information to scope, plan, build, and support the work we deliver on your behalf.

To operate Aurasis for schools

We use school, staff, student, guardian, and payment data to provide Aurasis's core functionality — academic record-keeping, report card generation, attendance, fee and shop payment collection, online classes, and school-to-guardian notifications — as instructed by the subscribing school.

To generate AI insights, when requested

As described under "AI-Generated Insights" above, we send relevant academic data to our AI provider only when an insight is explicitly requested for a student.

To operate and improve our products

We use product usage data to maintain service reliability, fix issues, and develop new features that better serve our users.

To communicate with you

We may send transactional emails and notifications (such as project updates, one-time passcodes, payment receipts, report card availability, invoices, or support responses) and occasional product announcements. You can opt out of non-transactional communications at any time.

To comply with legal obligations

We may process your information where required by the Nigeria Data Protection Act 2023, other applicable Nigerian law, or another relevant regulation.

AuraStacks Technology does not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

Service providers (subprocessors)

We rely on the following third-party providers to operate our business and our products. Each is contractually or contextually limited to handling your data only for the purpose listed, and only to the extent needed: • Paystack — payment processing for subscriptions, tuition fees, and shop payments. • Cloudinary — storage for uploaded files and images (school logos, student documents, class materials, shop item images, support attachments). • Mailgun — delivery of transactional email, including one-time passcodes and notifications. • Anthropic (Claude) — generates AI academic insights, only when requested (see above). • Zoom and Google (Meet) — power optional online-class video conferencing when a school chooses to use them. • Expo — delivers push notifications to our mobile app.

Legal requirements

We may disclose your information if required to do so by law, court order, or governmental authority in Nigeria or another applicable jurisdiction.

Business transfers

In the event of a merger, acquisition, or sale of business assets, your information may be transferred as part of that transaction. We will notify you before your information is subject to a different privacy policy.

With your consent

We may share your information for any other purpose with your explicit consent.

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, maintain our business records, and comply with applicable legal obligations. Specifically:

Contact inquiries

Information submitted through our contact form is retained for up to 2 years, unless you engage us for a project, in which case it becomes part of the project record.

Client project data

Project-related information is retained for the duration of our engagement and for up to 5 years thereafter, in line with standard business record-keeping practices.

Aurasis school and account data

Data held within Aurasis is retained while a school's account is active. If a school closes its account, we will delete or anonymise its data within 90 days, unless the school requests an earlier deletion or a legal retention requirement applies.

Academic records

Report cards, results, and other academic records may need to be retained longer than a typical account-closure window, since schools and former students sometimes need them years later (e.g. for transcripts). We retain this data for as long as the school's account remains active, and will work with a school on its preferred retention or export arrangement before permanent deletion following account closure.

Payment records

Fee, shop, and subscription payment records are retained for as long as required for financial record-keeping and tax purposes, generally at least 6 years, consistent with standard Nigerian business record-keeping practice.

Under the Nigeria Data Protection Act 2023 and other applicable law, you have the following rights regarding your personal information. To exercise any of these rights, contact us at hello@aurastacks.com — and if the data concerns a student or guardian at a specific school, please mention the school so we can verify and route the request efficiently (see "Whose Data This Is" above):

Right to access

You may request a copy of the personal information we hold about you at any time.

Right to correction

If any information we hold about you is inaccurate or incomplete, you may request that we correct it.

Right to deletion

You may request that we delete your personal information, subject to any legal or record-keeping obligations that require us to retain it.

Right to object

You may object to our processing of your information for marketing purposes at any time. We will honour such requests promptly.

Right to data portability

Where technically feasible, you may request a copy of your data in a structured, machine-readable format.

Right to lodge a complaint

You may lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been violated.

Our website may use cookies and similar tracking technologies to improve your browsing experience. These include:

Essential cookies

Required for the website to function properly — including, on Aurasis, session cookies that keep you signed in. These cannot be disabled.

Analytics cookies

Help us understand how visitors use our site so we can improve it. These are only set with your consent.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our website.

We take the security of your personal information seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These measures include encrypted data transmission (HTTPS) across all our products, hashed (never plain-text) password storage, role-based access controls that scope what each type of Aurasis user can see, and regular security reviews.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information using commercially acceptable means, we cannot guarantee absolute security.

Our website may contain links to third-party websites (such as our product platforms or social media profiles). This Privacy Policy applies only to aurastacks.com. We encourage you to review the privacy policies of any third-party sites you visit, as we have no control over and assume no responsibility for their content or practices.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the 'Last Updated' date at the top of this page. Where you registered for Aurasis after a specific version of this policy, your account records which version you accepted. We encourage you to review this policy periodically. Continued use of our website or services after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal information, please reach out to us:

AuraStacks Technology

Email: hello@aurastacks.com X (Twitter): @aurastacksTech

We aim to respond to all privacy-related enquiries within 5 business days.