Privacy Policy

Who this applies to

Edu2U is a school management service used by school owners and their staff (admins, teachers) to run day-to-day operations, and by parents to follow their child’s day and pay fees. This policy covers all of those users.

What we collect

From school owners, admins, and teachers

• Account email and password (the password is stored hashed)
• Name, surname, role (owner / admin / teacher), and contact phone
• Profile photo (optional, uploaded by the user or the school admin)
• Employment details where the role requires it: position, branch assignment, salary configuration, leave balances, attendance records, expense claims

From parents

• Account email and password (stored hashed)
• Name, surname, contact phone
• Relationship to each child
• Payment activity through Billplz (Edu2U does not store card numbers or banking credentials — Billplz handles those directly)

About children

• Name, date of birth, gender
• Class assignment and attendance records
• Photos uploaded by teachers as part of daily logs, assessments, or incident reports
• Daily log entries (activities, meals, sleep, mood, notes)
• Assessment records authored by teachers
• Incident reports authored by staff
• Medical information that parents or admins choose to enter (allergies, blood type, conditions)

Automatically

• Push notification tokens (so the app can deliver reminders and messages)
• Error reports if something crashes (anonymized, sent to Sentry, see below)
• Server logs from your authenticated requests

How we use it

• To run the service you signed up for
• To deliver notifications you and your school configured (daily log updates, payment reminders, announcements)
• To process payments through Billplz on behalf of your school
• To investigate and fix bugs, and to monitor reliability of the service
• To respond when you contact support

We do not sell your data to anyone. We do not use children’s data for advertising or profiling.

Service providers we share data with

We use the following third-party services to operate Edu2U. Each handles the data needed for their function:

• Supabase — database, authentication, file storage, server-side functions. Data is stored in the Southeast Asia (Singapore) region.
• Billplz — payment processing for school fees. Card details and banking credentials go to Billplz directly, never through Edu2U.
• Firebase Cloud Messaging — push notification delivery to mobile devices.
• Sentry — error monitoring. Crash reports may include details about what the app was doing when the error happened. We make best effort to scrub personal data from these reports.
• Cloudflare — DNS and email forwarding for the edu2u.my domain.
• Vercel — hosting for the web portion of the service.

Where data lives

Application data is stored on Supabase infrastructure in the Southeast Asia (Singapore) region. Some service providers (such as Firebase and Sentry) may process data in other regions consistent with their own privacy policies.

How long we keep it

• Account data is kept for as long as the school remains subscribed.
• When a school leaves Edu2U, owner-controlled data (students, staff, payments, daily logs) is retained for a reasonable handover window and then deleted on request.
• Server logs and error reports are typically kept for up to 90 days for diagnostic purposes.
• We may keep records longer where required by Malaysian law (for example, tax records related to payments).

Your rights

You can ask us to:

• See what personal data we hold about you
• Correct anything that’s wrong
• Delete your account and the personal data associated with it (some data may be retained where law requires)
• Stop using the service

Parents may exercise these rights on behalf of their children. School staff data may also be requested via the school’s owner or admin.

Children’s data

Edu2U handles personal data about children. We rely on the school to obtain appropriate parental consent for that data collection in line with Malaysian law (PDPA 2010) and the school’s enrollment process. We do not use children’s data for advertising, profiling, or any purpose outside running the service.

Security

We use industry-standard practices to protect your data: encrypted connections in transit, row-level security in the database, and audit trails for sensitive actions. No system is perfectly secure; we encourage you to use a strong password and keep it confidential.

Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated through the app or by email. The “Last updated” date at the top of this page is the source of truth for the current version.

Contact us

Questions or requests about your data should go to support@edu2u.my.