Privacy Policy

Who this applies to

Edu2U is school management software for Malaysia, made by INOSOFT SDN. BHD. Schools use it to run their day; parents use it to follow their child and pay fees. This policy says what Edu2U collects, why, who else handles it, how long it is kept and what you can ask for.

Who is responsible

Your school is responsible for the records it keeps about its pupils, parents and staff, and for getting parents' consent at enrolment. Inosoft runs Edu2U for the school and uses that data only to provide the service. Inosoft is responsible for the school owner's own account and for billing the school for Edu2U.

What we collect

Everyone with an account

• Name, email address, phone number and password (the password is stored only as a secure hash)
• Profile photo if you add one, and your preferred language
• Sign in records (date, device type and network address), kept for security

Parents

• Home address, identity card number and date of birth if your school asks for them
• Your relationship to each child
• The pickup and emergency contacts you add: their names, phone numbers, identity card numbers and photos
• Messages you send to the school. The school's owners and admins can read messages at their school.
• Bills, payments, receipts and any bank transfer slips you upload. Payments are made by FPX online banking: your bank login goes to your bank through Billplz and never reaches Edu2U.

Staff

• Position, branch, start date and attendance check in and check out times
• Salary, EPF and SOCSO numbers, bank name and account number for payroll, payslips, leave, and expense claims with their receipts
• Documents such as certificates

Children (entered by the school or the parent)

• Name, date of birth, gender, identity card or birth certificate number, nationality, and race and religion if the school records them
• Photo, class and attendance
• Health details such as allergies, medication given, blood type, conditions, immunisation and the family doctor
• Daily logs (meals, naps, activities, notes) with photos
• Assessments written by teachers
• Incident reports written by staff

From your device

• A push notification token, so the app can send you notifications
• Crash reports when the app fails. They do not contain your name or email address.

We do not collect your location, we do not use advertising identifiers, and we do not track you across other apps or websites.

How we use it

• To run the service for your school: records, daily logs, attendance, messages, notifications, fees and payroll
• To take fee payments through Billplz for your school
• To keep accounts secure and to find and fix faults
• To answer you when you contact support

We never sell personal data, and we never use children's data for advertising or profiling.

Who else handles it

Only the companies that run parts of Edu2U for us, each for its own task:

• Supabase: database, sign in, file storage and server functions, in Singapore.
• Billplz: fee payments by FPX online banking. Bank login details go to your bank through Billplz and never reach Edu2U. Billplz receives the payer's name, email, mobile number and the child's name on the bill.
• Expo, Google Firebase and Apple: delivering push notifications to phones.
• Resend: sending email such as invitations and receipts.
• Sentry: crash reports, in the European Union.
• Vercel and Cloudflare: hosting the website and the domain edu2u.my.

Where data lives

Application data is stored in Singapore. Crash reports are processed in the European Union. The push and email providers may process data in other regions under their own privacy policies.

How long we keep it

• While the school uses Edu2U, its records are kept so the school can run.
• When you delete your account, your name, contact details, photo, identity numbers and sign in are erased. Payment and employment records stay for 7 years without your details, because the law requires financial and employment records.
• If your school does not act on a deletion request, the account is deleted automatically 30 days after you ask.
• Server logs and crash reports are kept for up to 90 days.
• When a school leaves Edu2U, it can export its records during a handover period, after which they are deleted.

Your rights

You can:

• See the personal data held about you
• Correct anything that is wrong
• Delete your account in the app (Settings, Privacy and security) or at edu2u.my/delete-account
• Stop using the service

Parents can do this for their children through the school. Ask the school first about its records; ask us about anything else.

Children's data

Edu2U holds personal data about children. The school collects it and is responsible for parents' consent under Malaysian law (PDPA 2010). We use it only to run the service for the school, never for advertising or profiling.

Security

Data is encrypted in transit and at rest. Each school's data is separated from every other school's, and inside a school each person sees only what their role allows. Use a strong password and keep it to yourself.

Changes to this policy

We will tell you in the app or by email before a material change. The date at the top of this page shows the current version.

Contact us

Questions or requests about your data: support@edu2u.my.

Edu2U is operated by INOSOFT SDN. BHD. (registration 202601030569 / 1692664-W), Shah Alam, Selangor, Malaysia. For a school's records, the school is the data user and INOSOFT SDN. BHD. processes them for the school. For school owners' accounts and Edu2U's billing to schools, INOSOFT SDN. BHD. is the data user.