Privacy
Version 2026-09-02, in effect from 2 September 2026. Most of what GradeFlex holds is information about children, so this page is written to be read by a parent, not only by a lawyer.
The full notice follows. It describes how the system actually behaves; where you think it does not, tell us and one of the two is wrong.
Every company outside GradeFlex that handles any part of it, what they do, and which country they are in. The last column matters: sending personal data outside Uganda is restricted, and your data protection officer will ask.
| Who | What they do | Where |
|---|---|---|
| Namecheap (Hostwinds infrastructure) | Runs the server GradeFlex itself is installed on. All learner records, marks and photographs live here. | Phoenix, Arizona, United States |
| Backblaze B2 | Holds the off-site backups - a copy of every school's records and uploaded files, so a lost server is not a lost term. | United States |
| Brevo | Delivers email: password resets, invitations to parents and staff, and emailed report cards. Sees the recipient's address and the message. | European Union |
| Yoola SMS | Delivers text messages to parents. Sees the parent's phone number and the text of the message - never a learner's other records. | Uganda |
| Pesapal | Takes online payment from schools. Sees the school's own billing details. No learner information is sent to it. | Uganda and Kenya |
Under Uganda's Data Protection and Privacy Act, your school is the data controller and GradeFlex is the data processor. The school decides what information about a learner is collected and why; GradeFlex holds it and acts on the school's instructions, and for nothing else.
That division decides who a parent should ask. Questions about why the school collects something, or a request to correct or remove a child's record, go to the school - it is the school's decision to make. If a school asks us to act, we act.
This notice describes what GradeFlex does as processor. Your school may have its own privacy notice covering what it decides as controller.
About learners: name, class and stream, sex, admission number, date of birth if the school records it, marks and comments, attendance, fees owed and paid, and a photograph if the school uploads one.
About parents and guardians: name, phone number, email address, and which learners they are linked to.
About staff: name, role, login name, email address, phone number, and a record of what they did in the system.
About the school itself: its name, contact details, logo, the head teacher's signature and the school stamp.
Passwords are never held in a form anyone can read, including us. They are stored hashed, which is one-way: we can replace a password, never reveal one.
To do the things the school signed up for: produce report cards, keep marks and attendance, track fees, let parents see their own children's results, and send the messages the school chooses to send.
To keep the service secure and working - logs of who signed in and what changed, and rate limits that stop somebody guessing at passwords or report card codes.
To take payment from the school and to answer its support questions.
Not to advertise anything to anybody. We do not sell data, we do not share it with advertisers, and a learner's records are never used to market to their family.
GradeFlex runs on a server in Phoenix, Arizona, in the United States, and its off-site backups are held in the United States as well. Email is delivered through a provider in the European Union. Text messages are delivered through a provider in Uganda.
So learner data is stored outside Uganda. We would rather say that plainly than describe it as “the cloud”. Uganda's Data Protection and Privacy Act restricts sending personal data abroad, and a school satisfying itself about that is a reasonable thing to do before signing up - not an obstacle we want to hide.
The reason it is abroad is honest and unglamorous: reliable hosting inside Uganda, at a price a school can afford, with backups in a second country, is not something we could offer today. If that changes we will move, and tell you before we do.
Wherever it sits, the protections are the same: encrypted in transit, access limited to the school it belongs to, and no provider given more than its job requires.
Only the service providers needed to run GradeFlex, each receiving only what its job requires. They are listed above with what they do and where they are.
Our own operators can sign into a school's account to give support. Every such sign-in is written to that school's audit log, with who and when, so a school can always see that it happened. We would rather that be visible than convenient.
Nobody else. We do not share a school's data with other schools, with government except where the law requires it, or with anyone who asks nicely.
Most of what GradeFlex holds is about children, and photographs are the most sensitive part of it. They are shown on report cards and identity cards, are never listed in a public directory, and are not shared outside the school.
Files are stored under randomly generated names rather than the name they were uploaded with, so a photograph cannot be found by guessing and a child's name is not carried in the address of their picture.
Being honest about the limit of that: a photograph's address is unguessable, not password-protected. Someone the school gives the link to can open it. Treat those links as you would a printed photograph.
Consent for a child's information to be held, and for a parent's number to receive messages, is the school's to obtain. The school has the relationship with that family; we do not, and we do not claim to obtain it on the school's behalf.
A school's records are kept for as long as the school has an account. Schools keep learner records for years by design - a former learner asking for their results in five years is an ordinary request, and a system that had quietly deleted them would be useless.
When a school asks us to delete its data we delete it, and what remains is a single record that a school of that name was deleted, by whom, when, why, and how many rows went. Counts only - never a learner's name. That record is the evidence the request was carried out.
Deleted data can persist in backups until those backups expire. Ask and we will tell you how long that is for your school.
Everything travels over HTTPS. The server accepts administrative connections by cryptographic key only - there is no password to guess - and is firewalled to the ports the site needs.
Each school's data is separated by the school it belongs to, and every screen checks it. Staff see what their role allows: a subject teacher reaches their own marks and nothing else.
Backups are taken every night, held in a different country from the server, and verified on upload - a copy that arrived corrupted is treated as a failure rather than stored and believed.
No system is perfect and we will not pretend otherwise. If something goes wrong that affects your school's data, we will tell you what happened rather than wait to be asked.
To see what is held about them or their child, to have it corrected if it is wrong, to have it deleted where the school agrees it should be, and to object to how it is used.
Ask the school first. It is the controller, it holds the relationship, and in almost every case it can answer directly from its own screens. Where the school needs us, we help.
If you believe personal data has been mishandled, tell the school, and tell us. You are also entitled to complain to the Personal Data Protection Office of Uganda.
This notice changes when the system changes - a new provider, a new country, a different retention period. Each version is dated, and the current one is shown at the top of this page.
A change that affects where your data lives or who can see it will be told to you directly, not left here to be discovered.
If something here is unclear, or you think it does not match what the system actually does, tell us. Both are worth knowing about.
WhatsApp +256 773 165 408 · hello@gradeflexug.com · Terms of service
