Compliance

Overview

This page explains how Eduformium approaches data protection and security, and, just as importantly, where we honestly stand today as an early-stage product. We'd rather tell you plainly what's in place and what isn't than make blanket claims we can't back up.

Eduformium is not yet certified against any third-party security or privacy standard (such as ISO 27001 or SOC 2), and registration with Ghana's Data Protection Commission is in progress rather than complete. Nothing on this page should be read as a certification of compliance. It's a description of our current practices and our roadmap, offered so schools and teachers can make an informed decision about using the platform.

Roles: Controller & Processor

Under the Data Protection Act, 2012 (Act 843), two roles matter: the Data Controller decides why and how personal data is collected; the Data Processor handles that data on the controller's instructions.

• For an individual teacher's own account details (name, email, login credentials), Eduformium is the Data Controller.
• For any school-level data entered into the platform by a school administrator, the school is the Data Controller and Eduformium acts as Data Processor, consistent with Section 3.4 of our Terms of Service.

This split matters in practice: it's the school's responsibility to have a lawful basis (and any required guardian consent) for the student or staff data it chooses to enter, and it's our responsibility to protect that data and only use it to run the platform.

In line with this, schools are responsible for registering their own use of personal data with Ghana's Data Protection Commission where required by law, the same way a school is responsible for its own data protection registration when using any student information system, paper-based or digital.

Data We Process

Eduformium's products are the AI Timetable Generator, AI Lesson Planner, and School Management System. The personal data these collect ranges from institutional data to individual student records, depending on which product a school uses:

• Account data: name, email address, password (hashed, never stored in plain text), and optional school name.
• Scheduling data: class names, subjects, teacher names, and timetable constraints entered to generate a schedule.
• Lesson-planning data: curriculum topics and lesson details entered to generate a lesson plan.
• School Management System data: where a school chooses to use this product, it may enter student names, enrolment records, class assignments, and academic-progress information. This category of data belongs to the school as Data Controller, as set out in Section 2 above and Section 3.4 of our Terms of Service.
• Payment data: handled entirely by Paystack, a Bank of Ghana-licensed payment service provider. Eduformium never receives or stores card numbers.

A school is not required to use the School Management System to use the Timetable Generator or Lesson Planner; those two products run on institutional scheduling data alone and don't require entering individual student records.

Security Controls In Place

Rather than a generic list, here's what's actually implemented in the product today:

• Password hashing: account passwords are hashed using PBKDF2 with a per-user random salt, never stored or transmitted in plain text.
• Encryption in transit: all traffic between your device and Eduformium is served over HTTPS.
• Encryption at rest: data is stored with our database provider's standard at-rest encryption.
• Access control: administrator actions require a separately-issued admin credential with its own signing key, distinct from ordinary user sessions.
• Rate limiting: login and password-reset flows are rate-limited to reduce brute-force and abuse risk.
• Least-detail error handling: the platform returns generic error messages to users rather than internal system details that could aid an attacker.

Sub-Processors

We rely on a small number of third-party infrastructure providers to run the platform. We don't use your data for anything beyond delivering the feature it was entered for, and we don't sell data or use it for advertising.

• Supabase — database hosting for account and scheduling data.
• Google Gemini API — AI generation for timetables and lesson plans. Only the scheduling/curriculum details needed to generate the requested output are sent; this does not currently include individual student records.
• Paystack — payment processing for coin/credit purchases.
• Cloudflare — hosting and content delivery.

We'll update this list if that changes, and schools may request the current list at any time via eduformium.ceo@gmail.com.

Cross-Border Data Transfer

Some of the sub-processors listed above may store or process data outside Ghana. We rely on each provider's own standard data protection terms and, where offered, their data processing agreements, as our contractual safeguard for these transfers, consistent with Act 843's cross-border transfer provisions.

We have not yet negotiated bespoke, individually-signed data processing agreements with each sub-processor beyond their standard terms; this is an area we intend to formalise as the platform scales.

Retention & Deletion

Account and scheduling data is retained for as long as your account is active. If you close your account or request deletion, we will delete or anonymise your data within a reasonable period, except where we're required to retain limited records for tax, accounting, or fraud-prevention purposes.

To request deletion of your data, email eduformium.ceo@gmail.com from the address associated with your account.

Where We Currently Stand

In the interest of being upfront rather than making blanket compliance claims:

• Data Protection Commission (Ghana) registration: in progress, not yet complete.
• Business/company registration: in progress, not yet complete.
• Third-party certifications (ISO 27001, SOC 2, etc.): not held. Not currently pursued given our stage, but something we'd revisit as the platform scales.
• Independent security audit / penetration test: not yet performed.
• Signed, per-school data processing agreements: available on request (see Section 9); our Terms already include baseline DPA terms that apply automatically on registration.

We'll update this section as each of these moves from "in progress" to "complete"; this page is meant to stay current, not to be written once and forgotten.

Data Processing Agreement

Section 3.4 of our Terms of Service sets out baseline data processing terms that apply automatically when a school registers on the platform, covering roles, sub-processors, cross-border transfer, security, breach notification, and deletion.

If your school's own policies require a separately negotiated, signed data processing agreement rather than relying on the Terms, we're happy to provide one — reach out to eduformium.ceo@gmail.com.

Reporting a Concern

If you believe your data has been mishandled, or you've found a security issue, please tell us directly at eduformium.ceo@gmail.com or WhatsApp +233 20 866 9005. We'll acknowledge reports promptly and keep you informed as we investigate.

View Privacy Policy →   View Terms of Service →   Go to Homepage →