Privacy Policy

1. Who We Are

[Janteh — registered legal entity name] ("Janteh", "we", "us") operates the Janteh school management platform. This Privacy Policy explains how we handle Personal Data.

For most Personal Data on the platform, the School is the data controller (it decides why and how the data is processed) and Janteh is the data processor (it processes the data on the School’s instructions). For our own account, billing, and marketing data, Janteh is the controller. The Data Processing Agreement governs the processing we perform on a School’s behalf.

2. Scope

This Policy applies to School Admins, staff, parents, and students who use the Service, and to visitors of our marketing website. It should be read together with our Cookie Policy and Data Processing Agreement.

3. Personal Data We Collect

Depending on the role, we may collect:

• Staff and administrators: name, email, phone, photo, national ID, employment and qualification details, and login activity.
• Students: name, unique student number, date of birth, gender, photo, contact details, class, enrolment date, attendance, grades, report cards, fees, and content the student submits (homework, messages, social posts).
• Parents/guardians: name, phone number, relationship to the student, and messages exchanged with the School.
• Technical data: IP address, device and browser information, and log data generated when the Service is used, including records of acceptance of legal documents (timestamp and IP address).

4. How We Collect Data

Most data is entered by the School (for example when enrolling a student or creating a staff profile) or generated as the Service is used (for example marking attendance or sending a message). Some technical data is collected automatically. We do not buy Personal Data from third parties.

5. Why We Process Data and Our Legal Basis

We process Personal Data to:

• provide the school-management functions the School has asked for (performance of our contract with the School);
• authenticate users and keep the Service secure (legitimate interests and legal obligation);
• communicate with Schools about their account, billing, and important service notices;
• comply with legal obligations, including the Gambia Data Protection Act 2021;
• produce aggregate, non-identifying statistics for the School and, where a School exports them, for the Ministry of Education.

6. Children’s Data

The Service processes data about students who are minors. We treat the protection of children’s data as a priority:

• The School must obtain parental or guardian consent before any data about a student under 18 is stored, as required by the Gambia Data Protection Act 2021.
• A student’s profile and social activity are visible only within their own school and are never searchable or visible to other schools, enforced at the database level.
• Teachers cannot start private one-to-one messages with a student; student’s academic messaging happens in class channels that are visible to the school administration.
• Student social connections are limited to schoolmates of the same school.

7. How We Use Data

We use Personal Data only to operate, secure, support, and improve the Service, and to meet legal obligations. We do not use student data for advertising, and we do not sell Personal Data to anyone.

8. Sharing and Sub-processors

We share Personal Data only where necessary to run the Service or where required by law. Our sub-processors currently include:

• Supabase (managed PostgreSQL database and storage) — hosting of the application database and uploaded files, in the EU (Frankfurt, Germany) region;
• Render (application hosting) — running the backend service;
• Vercel (web hosting) — serving the web application;
• Resend (email delivery) — sending transactional emails such as password-set and account emails.
• Where a School chooses to export data to the Ministry of Education, that sharing is carried out by the School as controller.

9. Data Residency and International Transfers

Data is hosted in the European Union (Frankfurt, Germany region) as the closest available region at launch. We will evaluate migration to a West Africa region if one becomes available. Where data is transferred outside The Gambia, we rely on appropriate safeguards and the protections offered by the hosting region’s data-protection framework.

10. Data Retention

We keep Personal Data for as long as the School maintains its account and as needed to provide the Service, then delete or return it in accordance with the Data Processing Agreement, subject to any retention required by law. Acceptance logs and audit records may be retained longer as evidence of compliance.

11. How We Protect Data

• Data is isolated per school and protected by row-level security in the database.
• Access is controlled by authenticated sessions; administrators must use two-factor authentication.
• Uploaded files (including student photos) are stored privately and served only through short-lived signed links.
• Sensitive secrets are encrypted, and sensitive actions are recorded in an audit log.
• Traffic is encrypted in transit (HTTPS).

12. Your Rights

Subject to applicable law, individuals have the right to access their Personal Data, correct inaccurate data, request deletion, object to or restrict certain processing, and request portability of their data. Because the School is usually the controller, requests should first be directed to the School; we will assist the School in responding. You may also contact us at privacy@ijanteh.com.

13. Data Breach Notification

If we become aware of a personal-data breach affecting a School’s data, we will notify the affected School without undue delay so it can meet its obligation to notify the relevant authority within 72 hours of discovery, as required by the Gambia Data Protection Act 2021.

14. Cookies and Local Storage

We use only strictly necessary cookies and browser storage to keep you signed in and to remember basic preferences. We do not use advertising or third-party tracking cookies. See our Cookie Policy for details.

15. Changes to this Policy

We may update this Policy. When we make material changes we will update the version and, where required, ask School Admins to re-accept it. The effective date at the top shows when it last changed.

16. Contact

For privacy questions or to exercise your rights, contact us at privacy@ijanteh.com. Postal address: [registered address, The Gambia].

Last updated: 11 July 2026.