Privacy in plain language.
Your school owns its data and decides what happens to it. We hold and process it on your school’s instructions, and nothing here is written to be clever.
Last updated 1 August 2026
Who controls the data
Your school is the data controller. Schoolspine is the processor: we hold and process student, staff and family data on your school's instructions, and we do not decide what is collected or why.
This matters practically. If a parent asks us to correct or delete a record, we direct them to the school, because the school — not us — decides what its records should say.
What we hold
Whatever your school puts into Schoolspine. Typically that means student records and guardians, staff records, attendance, assessment results, fee and payment records, messages and announcements, and documents your school uploads.
We also keep operational data of our own: sign-in times, IP addresses and an audit log of actions taken in the system. That exists so a school can answer “who changed this record” and so we can investigate security incidents.
What we do not do
We do not sell personal data. We do not share it with advertisers. We do not use student data to train machine-learning models. We do not use it for any purpose beyond running the service for your school.
Who can see it
Within your school, access follows the roles and permissions your administrators configure. Between schools there is no access at all — each school is isolated, and that boundary is enforced on every request.
Within Schoolspine, access to production data is limited to the small number of staff who need it to operate or support the service, and every such access is logged.
How long we keep it
For as long as your school asks us to. Schools have their own retention obligations for student records, so we do not impose a schedule. When your school ends its contract we provide a full export and then delete the data on the timetable agreed with you.
Backups are retained for thirty days, after which deleted data ages out of them too.
Security
Data is encrypted in transit and at rest, passwords are hashed and never recoverable, and each school is isolated from every other. The security page describes the controls in more detail.
Your rights
Parents, students and staff may ask to see, correct or delete their data. Those requests go to your school, which will action them and instruct us where our involvement is needed. We will always support a school in responding.
Contact
Questions about this page can be sent to privacy@schoolspine.app. Requests about a specific person's data should go to the school that holds the record.