Privacy & Data Protection Policy

PakEducate is a school management platform operated by Wang Lab of Innovation (WALI) PVT Limited. We provide digital tools for Pakistani primary and secondary schools to manage students, teachers, attendance, results, fees, and school operations.

Contact: info@pakeducate.com

Student Data

• Full name (English and Urdu)
• Father's name and phone number
• Date of birth, gender
• Admission number
• Student photograph
• Attendance records
• Exam results and grades
• Fee payment history

Teacher/Staff Data

• Full name, email, phone number
• CNIC (National Identity Card) number
• Qualification, date of joining, address
• Emergency contact information
• Salary and payroll records
• Leave requests and balances
• Photograph

School Data

• School name, address, registration number
• School logo
• Class structures and timetables
• Financial records (fees, expenses, payroll)

Technical Data

• IP address (for security and rate limiting)
• Login timestamps and attempts
• Browser type (user-agent), device model and operating system
• Notification delivery tokens and app installation identifiers used by Expo and Firebase Cloud Messaging
• Android camera and notification library diagnostics, including installation identifiers, device/app versions, scanner-use events, latency and errors used to operate and improve those services
• Foreground GPS coordinates and accuracy when a staff member chooses self check-in and allows location access; no background location tracking

• Camera: Student-card QR codes are read on the device; the decoded card credential is sent to PakEducate to retrieve the child's record. New AI receipt and voucher extraction is temporarily paused; use manual entry. Previously enabled scanning sent captured images to PakEducate and its AI processing providers.
• Selected photos: Images you choose for school pages or profiles are uploaded. The app does not upload your entire photo library.
• Location: Staff self check-in can request precise foreground location. You can refuse permission; the current app still queues check-in without measured coordinates.
• Notifications: When enabled, Expo and Firebase Cloud Messaging process delivery identifiers and message content. Disable notifications in your device settings at any time.
• Website analytics: Our main website and shared web app currently block Google Analytics and Cloudflare Web Analytics collection. Earlier analytics records may remain under those providers’ retention settings. This does not disable security logs or the mobile library diagnostics described here.
• Library diagnostics: QR images are decoded on the device, but Android camera and notification libraries can still send technical data and installation identifiers. Some collection is automatic and is separate from choosing to receive school notifications.
• New AI generation: New AI chat answers, report generation, receipt extraction, captions, backgrounds and narratives are temporarily paused. Saved reports, school records, manual entry and content-reporting tools remain available. Requests to paused generation routes are stopped before new AI-provider calls. This pause does not erase earlier records or change provider retention for previous processing.
• Report audio: Audio generation is not available in this release. Parents can continue reading written reports. The disabled audio feature does not send report text to a speech provider or record your microphone.
• Browser voice assistant: The voice assistant is unavailable while audio features are disabled. Use the written parent portal to view school updates.
• Offline storage: The mobile app stores school records and pending changes locally for offline use. Signing out separates accounts but may retain unsynced work for the original account.

When you choose to report an AI answer, report or receipt-scan result, you can review and edit the excerpt before sending it. PakEducate’s platform team receives that text, your chosen reason, optional explanation and a school reference. This is separate from a complaint to your school. We do not automatically include the full chat, child record, receipt image, QR credential or notification token, and we do not send the report to another AI provider.

We store a hashed reference to the submitting staff account or child record to limit abuse and recognise retries. It is a pseudonymous identifier, not anonymous data. Internal review history records the reviewer’s account, IP address, action, time and review notes. Reports become unavailable in the review queue after 30 days; scheduled cleanup removes them and their review history from the active database. Any recovery copies are handled separately under Section 9.

App-to-server traffic uses HTTPS. Our infrastructure runs on a globally distributed cloud network with built-in DDoS protection, SSL encryption, and edge security.

PakEducate uses school and role checks to restrict access to records:

• School A cannot see School B's students, teachers, or financial data
• Teachers can only see data for their assigned classes
• Staff access to financial records depends on their role; parents with a child’s QR credential can view that child’s fee status
• Super administrators can access school data only for platform management purposes

We use the following external services. We do not sell your data to any third party.

New AI generation is temporarily paused. Before the pause, the selected provider and fallback providers could process the content needed for a requested AI response or scan, including outside Pakistan. The pause does not claim that historical provider copies have been deleted. Existing AI answers can be inaccurate and should be checked against school records. Do not include passwords, identity documents or unrelated personal information in content reports.

• Encryption in transit: All data encrypted via HTTPS
• Password security: Industry-standard hashing with unique salt per password — never stored in plain text
• Secure authentication: Web sessions use HttpOnly cookies; the mobile app uses operating system secure storage for saved credentials
• Brute force protection: Accounts are automatically locked after repeated failed login attempts
• Rate limiting: API requests are limited to prevent abuse
• File security: Schools control what they publish. Public school pages and shared student-card links must be treated as shareable access paths
• Input validation: All inputs are validated server-side to prevent malicious data
• Backups: Scheduled daily copies of selected database records, with dated-backup cleanup; see Section 9 for retention limits
• Emergency controls: System-wide shutdown capability for critical security incidents

PakEducate processes data about children (students) on behalf of schools. We take this responsibility seriously:

• Student data is entered and managed by authorized school staff only
• Student records and photographs may be visible to authorized school staff and people holding the student-card QR credential. Keep the card and QR link private
• We do not use children's data for advertising, marketing, or profiling
• Our infrastructure and optional AI providers process data to deliver the features described in this policy; we do not sell children’s data
• Schools are responsible for obtaining any required consent from parents/guardians for data collection
• Student data can be permanently deleted upon request (see Section 10)

• Active accounts: Data is retained as long as the school's subscription is active
• Deactivated students/staff: Deactivation does not permanently erase the record. Request deletion through the process below; applicable school-record retention requirements are reviewed with the school
• Login attempts: Stored for security monitoring purposes
• Backups: Routine dated backups use a rolling cleanup schedule targeting a 30-day window. Cleanup runs on a schedule, so this is not a guarantee that every copy disappears exactly 30 days after creation. Separately created recovery copies and copies held by service providers need separate retention checks. When handling a deletion request, we confirm which copies remain and their applicable removal dates
• Cancelled accounts: Schools have 30 days after cancellation to request and complete a data export. After that export period, we delete the cancelled school’s data from active systems, except records that must be retained for legal, accounting or security obligations. We explain any exception and its retention period when processing the cancellation. Backup and provider copies are handled as described above; cancelling access alone is not a completed deletion

Schools and individuals have the following rights regarding their data:

• Right to Access: Request an export of your school's records from info@pakeducate.com. The JSON record export does not bundle photos, PDFs or other attachments; request those files separately before your export period ends.
• Right to Deletion: Request permanent deletion of individual student/teacher records or your entire school's data
• Right to Correction: Update or correct any data through the platform's edit features
• Right to Portability: Export your data in standard formats (JSON, CSV, Excel)

To exercise any of these rights, contact us at info@pakeducate.com. We verify the requester and school before providing records or files, including when account access has been disabled.

In the event of a data breach that affects your school's data:

• We will notify affected schools within 72 hours of becoming aware of the breach
• Notification will be sent via email to the school's registered head teacher and owner accounts
• We will provide details of what data was affected and what steps we are taking
• We maintain automated security monitoring and alerting systems

PakEducate operates under:

• Pakistan: Prevention of Electronic Crimes Act (PECA) 2016 and applicable data protection regulations
• Pakistan: As Wang Lab of Innovation (WALI) PVT Limited is incorporated in Pakistan

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered schools via email.

For any questions about this policy or your data:

• Email: info@pakeducate.com
• Website: pakeducate.com