Privacy Policy

ShommyX Education is a school and daycare management service operated by ShommyX Technologies. We’re based in Canada and our production database, application servers, and media storage are hosted in North America.

If you’re a school or daycare administrator, this policy applies to your account. If you’re a parent invited to the platform by a school or daycare, this policy applies to the information stored about you and your child, alongside that institution’s own internal policies, which you should request directly from them.

From staff and administrators

• Name, email, hashed password.
• Role and staff assignment within a school or daycare.
• Time-clock records (clock-in, clock-out, total hours).
• Audit metadata (actions performed, timestamps).

From parents

• Name, email, optional phone number.
• Approved links to your child’s record at a school or daycare.
• Messages exchanged with staff.
• Acknowledgements (e.g. incident reports).
• A record of school fees you have paid — amount, date, term, and the payment reference returned by the payment processor. Never your card or bank details; see Paying school fees.

About children and students (entered by the school or daycare)

• First and last name, date of birth, gender (optional).
• Allergies and medical notes (provided by parents).
• Daily attendance, daily reports, photos and videos taken at the school or daycare.
• Incident reports, medication administration records, immunization records (entered by staff).
• Developmental milestone observations.
• CWELCC enrollment status (Canadian daycares).

About students, in schools (entered by the school)

• Class or grade level, subjects taken, and admission number.
• Test and examination scores, term results, report cards, positions and promotion decisions.
• Fee invoices raised against the student, and the payments recorded against them.

Automatically collected

• IP address and request timestamp (rate limiting + audit logs).
• Application error reports and basic performance diagnostics — captured by Sentry when something goes wrong in the app, so we can find and fix it.
• Basic device info you provide when registering for push notifications.

• We do not sell or rent any personal information to anyone.
• We do not share child information with third parties for advertising, profiling, or analytics purposes.
• We do not use children’s information to train AI models.
• We do not serve third-party advertising on this product.

We use the information you provide solely to operate the product you signed up for: keep attendance, record and publish results, raise and settle fee invoices, share reports with parents, deliver push and email notifications, surface compliance and tax reports, and provide customer support. We do not repurpose it for anything else.

• Staff at your school or daycare — only see records scoped to that institution. They cannot see another school’s data.
• Parents — only see records for children they have an explicitly approved link to.
• Multi-location operators — only see records for the schools and daycares within their own organisation.
• ShommyX Technologies staff — can access your data only when necessary for support or debugging, and only via audited tooling. Impersonation actions are logged with the impersonator’s identity attached.

When a school turns on online fee payments, it connects its own Paystack account. Money a parent pays goes from the parent straight into that school’s account. It does not pass through ShommyX. We never hold, move or take a cut of school fees, and we cannot pay them out or refund them — only the school can.

Card numbers, bank credentials and one-time codes are entered on the payment processor’s own page and never reach our servers. What we store against a payment is the invoice it settles, the amount, the date, the status, and the processor’s reference — enough for a parent to see a receipt and for a school to reconcile its books.

Separately, a school pays ShommyX for its own subscription. That is a transaction between the school and us, handled by Paystack or Stripe, and it is the only money that involves our account. Parents and students are never charged by ShommyX.

• Database: Neon PostgreSQL on AWS (US-East). Backed up automatically.
• Photos and videos: Cloudflare R2, tenant-scoped object paths so one daycare cannot enumerate another’s files.
• Application + API: Fly.io, US region by default.
• Transactional email: Resend.
• Payments: Paystack (school fees, and subscriptions in Nigeria) and Stripe (subscriptions elsewhere). They receive the payer’s name, email and the amount, and they hold the card details we never see.
• Error reporting: Sentry — stack traces, the page an error happened on, and the account id it happened to.
• Push notifications: Firebase Cloud Messaging — the device token your phone registers, so a notification can reach it.

Some of these vendors process data outside Canada. By using ShommyX Education you consent to your data being processed in those locations under the privacy regimes that apply there.

• Active accounts: we retain your data for as long as your school or daycare is using the service.
• After a school or daycare cancels: data is retained for up to 90 days so it can export its records (rosters, attendance, results, incidents). On request, we delete sooner.
• Audit logs: retained for at least 2 years for compliance and security purposes.
• Backups: Neon retains point-in-time backups for 7 days. Cloudflare R2 retains object versions per its standard policy.

You have the right to:

• Access information we hold about you or your child.
• Correct information that’s inaccurate (or ask your daycare to correct it for the child’s record).
• Withdraw consent — for a parent, this means asking your daycare to revoke your link (or contacting us directly if the daycare is unresponsive).
• Delete your account yourself, from Settings in the app, at any time. What that removes and what stays with your school is set out on the delete your account page.
• Request deletion of other personal information we hold when there is no longer a legitimate need to retain it.
• File a complaint with the Office of the Privacy Commissioner of Canada (or your provincial equivalent) if you believe we’ve mishandled your data.

To exercise any of these rights, email [email protected]. We respond within 30 days.

We use Argon2id for password hashing, JWT-based session tokens delivered as httpOnly cookies, and HTTPS everywhere. Webhooks from payment processors are HMAC-verified before we trust them. Internal API endpoints are tenant-scoped at every read so cross-tenant access is hidden as a 404 (not a 403) — we don’t leak which records exist.

More detail is on the security page.

Schools and daycares enrol children and students on the platform on behalf of their legal guardians. The institution is responsible for obtaining the necessary parental consent before entering a child’s information into ShommyX Education. By using the service to enrol a child, it confirms it has that consent.

Parents who are uncomfortable with a particular type of information (e.g. photos) being recorded can ask the school or daycare to withhold it — staff can leave those fields blank, and parents see only what’s recorded.

Accounts on ShommyX Education belong to adults: staff, administrators and parents. Students do not sign in and are not asked for anything by us — what is held about them is entered by their school, and is visible only to that school and to the parents it has approved.

We use a single authentication cookie to keep you signed in and a small number of functional cookies for session management. We do not run third-party advertising trackers, Google Analytics, or social-media pixels on the app.

We’ll update the “Last updated” date at the top of this page when we change it. If a change is material (e.g. new categories of data, new sub-processors, change in retention), we’ll email signed-in administrators before the change takes effect.

Questions or concerns? Email [email protected]. We answer in plain language.