Privacy

Privacy notice

Effective 20 September 2026.

NoviaSMS is school management software for Nigerian schools. Schools keep their registers, results, fees, staff records and payroll in it, and parents sign in to see their own children’s fees and results. This notice says what information that involves, who is responsible for it, where it is kept and what you can ask of us. It is written under the Nigeria Data Protection Act 2023.

Who is responsible for what

Your school decides what it records about its students, guardians and staff, and why. For those records the school is the data controller and NoviaSMS is its processor: we hold and process the records on the school’s instructions, and we do not use them for anything else. Questions about what your school holds about you, or a request to correct it, go to your school first, and the school can act on them in the product itself.

NoviaSMS is the data controller for the details a school gives us when it asks for an account through the form on our home page, for the accounts of our own platform operators, and for the technical logs our systems keep.

What a school records, and why

A school using NoviaSMS records what it needs to run: each student’s name, date of birth, class, admission details, attendance, assessment scores and results; each guardian’s name, phone number, email if given, and their relationship to a student; each staff member’s employment record, leave, attendance, duties and pay; and the school’s fee plans, invoices, receipts and accounts. The school records this to teach, to report to families, to run its finances and to pay its staff, under its own agreements with families and staff.

Students are children. A student’s record is created by the school, and a guardian is linked to it only with the consent the school records at the time. A guardian sees only the children linked to them, and only what the school has released to families.

What NoviaSMS collects directly

• Setting up a school with Start free: the administrator’s name, work email and phone number, the school’s name and, if given, its state; the school type, short name, motto, colours, logo, school code and academic year the administrator chooses; and when they accepted this notice and the terms. We also keep the internet address the first step was sent from, to refuse abuse of the form. We use these details only to confirm who is setting the school up, to set it up, and to tell them how it is going. Requests sent through our earlier sign-up form are handled the same way. A draft nobody finishes stops working 7 days after its last change and is deleted 30 days later. A request we decline is deleted after 90 days.
• Sign-in and security records: when an account signs in, fails to sign in, sets a password or is signed out, we record the time, the account and the internet address, so that a school can see who did what and so that we can stop attacks on accounts.
• Technical logs: our servers record each request’s path, timing and outcome. They are written so as not to contain names, contact details, passwords, messages or the contents of records.

We do not use advertising trackers, and the site does not load scripts from advertising networks.

Where the information is kept

NoviaSMS runs on hosted infrastructure we do not own. Our providers process information only to provide that infrastructure to us:

• Railway runs our application and its database.
• Vercel serves the website and the pages you use in the browser.
• Amazon Web Services stores our encrypted backups in Ireland. A backup is encrypted before it leaves our systems, and the key that can read it is held offline by NoviaSMS, not by the provider.
• Resend sends the email NoviaSMS sends in its own name: confirming an email address, telling a school that its request is with us, one-time links for choosing a password, and telling us that a school is waiting for our call. It receives the address the message goes to and the message itself.
• Our operational alerts, which tell us when something needs attention, carry counts, a school’s code or a request’s reference number only, never a person’s details. The email that tells us a school is waiting carries the school's name, its state and that reference, and no applicant's name, address or number.

These providers keep data outside Nigeria. We choose providers that commit to recognised security standards, and we transfer only what running the service requires. We do not sell information, and we do not share a school’s records with anyone the school has not authorised, except where the law requires it.

Messages to parents and staff about a school’s own records — a child’s absence, a receipt, a result — reach them in the app.Sending those by WhatsApp or SMS, and automatic fee collection through a payment provider, are not switched on. If we switch any of them on for a school, this notice will say which provider is involved and what it receives before it is used.

How it is protected

• Every school’s records are kept apart by the database itself: each table that carries a school refuses rows belonging to another, and the application connects with a role that cannot override this. The separation is checked on every deployment.
• Passwords are stored only as strong one-way hashes. Provider credentials a school gives us are encrypted at rest.
• Sensitive changes, such as transfers, withdrawals, fee discounts, payroll and staff exits, need a second person’s approval, and the history is kept rather than overwritten.
• Access to production systems is limited to named NoviaSMS operators, whose actions are recorded.
• Scheduled off-site backups are in place, encrypted before they leave our systems, and a production backup was restored into an isolated database and checked on 14 September 2026.

How long it is kept

• A school’s records are kept for as long as the school’s account is active. Approved decisions, released results and posted accounting entries are kept rather than edited, and a correction is recorded as a new entry.
• When a school closes its account, we prepare an export of its records on request, and we delete them 90 days after closure unless the school asks us to keep them longer or a law requires it. Backups that contain them expire on their own schedule afterwards.
• A request that becomes a school is kept as the record of how its account was opened and on what terms, for as long as the school’s records are. An unfinished draft is deleted 37 days after its last change at the latest, and a declined request 90 days after it was declined.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask to see the information held about you, to have it corrected, to have it deleted where there is no longer a reason to keep it, to object to a use of it, and to complain to the Nigeria Data Protection Commission. A student’s rights are exercised by their guardian.

For records your school holds about you, ask your school; the school can correct its records in the product, and it can ask us for anything it cannot do itself. For the details NoviaSMS holds directly, contact us as set out below. We answer within thirty days.

How to contact us

• Through your school: every school has a named administrator who can reach NoviaSMS on the channel agreed when the school was set up.
• Through the form on the home page, for a school that has not yet signed up.

A public email address and telephone number will be added here once each is staffed.

Changes to this notice

When we change this notice we change the date at the top, and where a change affects what is collected or who receives it we tell schools before it takes effect. The terms of service say how the service itself is provided.