How we protect
your data.

We collect information in two ways: directly from you when you interact with our services, and automatically through service use.

Information you provide to us

• Account registration: your full name, email address, phone number, and profile photo.
• Child enrolment: your child's full name, date of birth, gender, photo, medical information (allergies, conditions, medications, special needs), and emergency contact details.
• Admissions enquiries: parent/guardian name, email, phone, child's name and date of birth, and any message you submit.
• Contact forms: name, email, phone, subject, and message content.
• Authorised pick-up persons: name, relationship, phone, and identity document details.
• Bookings: session type, preferred dates, and any special requests.

Information generated through service use

• Daily reports & activities: teacher-logged reports including mood, meals, nap duration, bathroom visits, activities, and notes.
• Attendance records: check-in and check-out timestamps.
• Gallery photos: photographs taken during school activities shared with linked parents.
• Messages: content of conversations between parents and staff on the in-app messaging system.
• Device & usage data: push notification token, app version, and device OS type — collected for operational purposes only.

We use your information only for the purposes for which it was collected:

• Enrolling and managing your child's profile at the school.
• Sending daily reports, activity updates, and attendance notifications through the parent app.
• Communicating important school announcements, events, and invoices.
• Processing session bookings and issuing invoices.
• Verifying the identity of persons authorised to collect your child.
• Sending push notifications for messages, reminders, and alerts — which you can manage in the app's notification settings.
• Responding to enquiries and contact form submissions.
• Maintaining records required by Nigerian education and child-safety regulations.
• Improving our services through anonymised usage analytics.

We do not sell, rent, or trade personal data. We share information only in the following limited circumstances:

• Within the school: teachers, administrators, and authorised staff who need it to provide care and education.
• Service providers: our cloud infrastructure (Cloudflare R2 for file storage, Resend for email delivery) process data on our behalf under strict data-processing terms.
• Legal obligation: if required by Nigerian law, a court order, or a regulatory authority.
• Child safety: when disclosure is necessary to protect the health or safety of a child.

Any third-party provider we use is contractually required to keep your data confidential and to use it solely to deliver services to us.

We retain your personal information for as long as your child is enrolled, plus a reasonable period thereafter to fulfil any outstanding obligations or legal requirements:

• Active accounts: data is retained for the duration of enrolment.
• Inactive accounts: account data is retained for up to 2 years after the last login, then securely deleted.
• Medical & attendance records: retained for a minimum of 5 years to comply with regulatory requirements.
• Financial records: invoices and payment histories are retained for 7 years.
• Contact/enquiry submissions: retained for 12 months, then deleted.

You may request earlier deletion of your data (see Your Rights below), subject to our legal retention obligations.

We take reasonable technical and organisational measures to protect your data:

• All data is transmitted over encrypted HTTPS connections.
• API access is secured with token-based authentication (Laravel Sanctum).
• Files (photos, documents) are stored in access-controlled cloud storage.
• Staff access to the admin panel is protected by individual credentials and role-based permissions.
• Sensitive fields (passwords) are hashed and never stored in plain text.

No system is perfectly secure. If you believe your account has been compromised, please contact us immediately.

Under applicable Nigerian data protection law (NDPR), you have the right to:

• Access: request a copy of the personal data we hold about you or your child.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request erasure of your data, subject to our legal retention obligations.
• Objection: object to how we process your data in certain circumstances.
• Portability: receive a copy of your data in a structured, machine-readable format.

To exercise any of these rights, contact our Data Protection Officer at info@toddlersandscholarsacademy.com. We will respond within 30 days.

Our services are directed at parents and guardians, not children. We collect information about children solely to provide educational and care services, and only with the knowledge and consent of a parent or legal guardian. Children below the age of 18 may not create accounts or submit personal data directly.

If you believe we hold data about a child without appropriate parental consent, please contact us and we will investigate and take corrective action promptly.

Our public website uses only essential cookies required for navigation and form submission. We do not use advertising or tracking cookies.

The parent and teacher mobile apps do not use browser cookies; they use secure local storage and token-based sessions.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective" date at the top of this page. If the changes are significant, we will notify you via the app or by email before they take effect. Continued use of our services after the effective date constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy or how we handle your data, please reach out to us: