Privacy Policy
Draft date: 16 August 2026
Effective date: 16 August 2026
This Privacy Policy explains how Foregate Technologies Limited collects, uses, discloses, retains and protects personal data in connection with the MySchoolPilot website, accounts, hosted platform, support and related services (together, the Services).
1. Who we are
MySchoolPilot is a product of Foregate Technologies Limited, a company incorporated in Nigeria with registration number RC 7941211 (Foregate, we, us or our).
- Registered office: 1 Iludun Street, Osogbo, Osun State, Nigeria
- Privacy enquiries and data-rights requests: contactus@myschoolpilot.com
- Support: support@myschoolpilot.com
- WhatsApp: +234 807 618 2936
If a school or other institution provides your MySchoolPilot account, that institution is normally the controller of the student, parent, guardian, applicant, staff and school records it places in the platform. It decides why and how those records are used. Foregate normally processes those records on the institution's documented instructions where it hosts the platform or has authorised support access.
Foregate is an independent controller for data it uses for its own purposes, including website enquiries, School Owner accounts, contracting, billing, security, fraud prevention, service administration, support management and its legal obligations. In a self-hosted deployment, the institution operates its own environment and Foregate may not receive platform records unless they are deliberately shared for support or another agreed service.
2. Scope
This Policy applies to visitors, prospective customers, School Owners, authorised users and individuals whose data Foregate controls. An institution's own privacy notice governs its use of school-controlled records. A contract, order form or data processing agreement (DPA) may provide additional terms. If there is a conflict about school-controlled data, the DPA controls to the extent of that conflict.
The Services are designed for institutional use. Children and students should receive an age-appropriate privacy notice from their institution. They should ordinarily ask their school or guardian about school-controlled records.
3. Personal data we process
Depending on how the Services are used, we may process:
| Category | Examples |
|---|---|
| Website and enquiry data | name, school or organisation, email, telephone, country, region, institution type, message, module interests and approximate student count |
| Account and identity data | name, work email, telephone, account role, institution, username, password hash, verification status, authentication and two-factor settings |
| Commercial data | subscription, plan, active-student count, order, invoice, payment status, currency, promotion and business correspondence |
| Support data | ticket content, screenshots, diagnostic information, server environment, PHP version, log excerpts and call or training records |
| Device, usage and security data | IP address, browser and device type, timestamps, pages or features used, session and authentication events, audit trails, error logs and suspected misuse |
| Communications and preferences | email/SMS preferences, consent choices, survey responses and notification history |
| School-controlled platform data | student and applicant records; parent/guardian details; attendance; behaviour; examinations and reports; admissions; fees and receipts; staff, HR, payroll and leave data; medical, counselling, safeguarding, transport, hostel, library, cafeteria, visitor and alumni records; messages and user-generated content |
| Integration data | identifiers, transaction references, webhook data and configuration needed to connect payment, email, SMS, AI, hosting, database, cache or other services selected by the institution |
School-controlled data may include children's data, financial information and sensitive or special-category data such as health, counselling, disability, welfare or safeguarding information. Institutions must collect and configure only what is necessary and lawful.
We generally obtain data from you, your institution or its authorised users, your device, connected services, payment and communications providers, or authorised implementation partners. We do not intentionally collect payment-card details directly where checkout is handled by a payment provider.
4. Why we use personal data and our lawful bases
Where Foregate is controller, we use data only where a lawful basis applies:
| Purpose | Typical lawful basis |
|---|---|
| Create and administer accounts; provide a trial, subscription, demo, onboarding or support | contract or steps requested before a contract |
| Respond to enquiries and manage business relationships | contract steps and legitimate interests in operating and developing our business |
| Bill customers, reconcile payments and keep tax/accounting records | contract and legal obligation |
| Authenticate users, secure the Services, prevent fraud or abuse, investigate incidents and maintain audit logs | contract, legal obligation and legitimate interests in protecting users, institutions and our systems |
| Operate, troubleshoot and improve the Services | contract and legitimate interests, using aggregated or de-identified data where reasonably possible |
| Send essential service, security and account communications | contract and legal obligation |
| Send optional marketing | consent where required; otherwise legitimate interests where applicable and subject to an easy opt-out |
| Use optional analytics or similar device storage | consent where required by applicable cookie/e-privacy law |
| Establish, exercise or defend legal claims and comply with regulators or lawful requests | legal obligation and legitimate interests |
| Protect a person's vital interests or support safeguarding | vital interests or another lawful basis available under applicable law |
For sensitive or special-category data, the institution must identify both an ordinary lawful basis and any additional condition required by applicable law. Foregate processes such data only under the institution's instructions, except where law requires otherwise. We do not use student health, counselling or safeguarding data for advertising.
Where consent is the basis, it must be specific, informed and affirmative. Consent may be withdrawn at any time without affecting earlier lawful processing. We will not make a core service conditional on consent to unrelated processing.
5. Children's data
MySchoolPilot is used by schools and may be accessed by children through institution-managed accounts. The institution is responsible for its authority to create those accounts, provide clear age-appropriate information, involve a parent or guardian where required, and enable children to exercise their rights in a manner appropriate to their age and capacity.
We expect institutions to apply high-privacy defaults, data minimisation and role-based access. We do not knowingly use children's school records for behavioural advertising, sell them, or make solely automated decisions producing legal or similarly significant effects unless expressly agreed, lawful, explained and appropriately safeguarded. Suspected safeguarding emergencies may be handled or disclosed where necessary and lawful to protect a child or another person.
6. Automated features and AI
Some plans may offer analytics, natural-language queries, automation or optional AI-enhanced insights. Unless an institution has enabled and configured a relevant integration, the optional third-party AI feature should not be used. Institutions must not submit data to an AI integration unless their lawful basis, transparency, risk assessment, vendor terms, retention controls and international-transfer safeguards permit it.
AI output may be incomplete or inaccurate and must not replace qualified human judgement. Foregate does not intend AI output alone to determine admission, grading, discipline, employment, safeguarding, medical care, access to education or another decision with legal or similarly significant effects. The institution remains responsible for meaningful human review and an appropriate challenge route.
7. Sharing and subprocessors
We may share personal data only as needed with:
- the institution and its authorised users;
- hosting, infrastructure, database, backup, email, SMS, customer-support, security and analytics providers;
- payment providers such as Paystack for institution-selected payment services;
- optional integration providers selected or configured by the institution, which may include OpenAI, SMTP/Resend services, SMS gateways and Redis-based infrastructure;
- professional advisers, auditors, insurers and implementation partners subject to appropriate duties;
- regulators, courts, law-enforcement or public authorities where disclosure is required or lawfully justified; and
- a buyer, investor or successor in a genuine corporate transaction, subject to confidentiality and lawful safeguards.
We do not sell school-controlled personal data. Customers may request our current list of subprocessors and relevant processing locations by emailing contactus@myschoolpilot.com. Where Foregate is a processor, subprocessor appointment and change notices are governed by the DPA.
Third-party integrations can also act as independent controllers under their own notices. The institution chooses whether to enable them and must assess their suitability.
8. International transfers
Foregate is based in Nigeria and may use providers or support personnel in other countries. Data may therefore be processed outside the country where an individual is located. Before a restricted transfer, the relevant controller must use a lawful transfer mechanism and assess the destination and recipient as required. Depending on the applicable law, safeguards may include an adequacy decision, approved contractual clauses, binding corporate rules, an approved certification or code, explicit consent in limited circumstances, or another permitted derogation.
Customers may request information about applicable transfer safeguards by contacting us. Self-hosted customers choose and control their own hosting location, subject to their agreement and the law.
9. Retention
We keep personal data only for as long as necessary for the stated purpose, contractual commitments, security, dispute resolution and legal, tax or accounting duties. We apply our retention schedule to sales and support records, accounts, invoices, payments, security logs, consent records and school-controlled hosted data. Hosted school data is retained, returned or deleted as directed by the customer agreement or DPA, subject to ordinary backup cycles and legal obligations.
Self-hosted institutions set and implement retention in their own environments. Data may remain in encrypted, access-restricted backups until the ordinary backup cycle expires. We may retain a minimal record where necessary to establish legal compliance, resolve disputes or prevent a person from being contacted after opting out.
10. Security
We use risk-appropriate technical and organisational measures, which may include HTTPS in production, password hashing, role-based access, optional two-factor authentication, idle-session locking, account-status controls, audit logging, restricted welfare records, backups, monitoring and staff confidentiality controls. No internet service is completely secure. Institutions are responsible for secure configuration, user permissions, endpoint security, backups and credential management in their environments, especially for self-hosted deployments.
If you suspect unauthorised access, contact support@myschoolpilot.com promptly. Where Foregate is processor, we will notify the relevant institution of a qualifying personal-data breach without undue delay as required by the DPA. The controller is responsible for regulator and individual notifications unless the law assigns that duty differently.
11. Your rights
Depending on applicable law and circumstances, you may have rights to:
- be informed and receive a copy of your personal data;
- correct inaccurate or incomplete data;
- request deletion;
- restrict or object to processing;
- receive portable data;
- withdraw consent;
- object to direct marketing;
- obtain information about, and challenge, qualifying automated decisions; and
- complain to a competent data-protection authority or seek a judicial remedy.
Rights are not absolute. We may need to verify identity, authority or guardianship and may retain information where an exemption or legal duty applies. We will respond within the period required by applicable law and explain any lawful refusal.
For school-controlled records, contact the school first. We will assist the school as processor. For data Foregate controls, email contactus@myschoolpilot.com with the subject "Data rights request". Do not send unnecessary identity documents by ordinary email; we will provide a proportionate verification method.
Individuals in Nigeria may complain to the Nigeria Data Protection Commission. Individuals elsewhere may complain to their local supervisory authority, including the UK Information Commissioner's Office where applicable. Please contact us first if you would like us to try to resolve the concern.
12. Marketing
You may unsubscribe through the link in a marketing message or by contacting us. Opting out of marketing does not stop essential account, service, security, billing or legal notices. Institutions control communications they send through their own MySchoolPilot accounts and must comply with applicable direct-marketing rules.
13. Cookies and similar technologies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential technologies will not be activated until valid consent is obtained where applicable. You can change choices at any time through the Cookie settings control in the site footer.
14. External links
The Services may link to third-party sites. Their operators control their own processing, and their privacy notices apply. A link does not imply that Foregate endorses their privacy or security practices.
15. Changes to this Policy
We may update this Policy to reflect changes in law, vendors or the Services. We will post the revised version and update the effective date. We will provide additional notice where a change is material or consent is required. Archived versions will be available on request.
16. Contact
Foregate Technologies Limited (RC 7941211)
1 Iludun Street, Osogbo, Osun State, Nigeria
Email: contactus@myschoolpilot.com
WhatsApp: +234 807 618 2936