Privacy Policy

Our commitment

Schools trust Attend with information about the children in their care. That is not information we take lightly.

This policy explains what information Attend holds, why we hold it, and what we do and do not do with it. We have written it to be read, not filed away unread. If anything here is unclear, we would rather you asked us than guessed.

One principle sits underneath everything else in this document: the information your school enters into Attend belongs to your school. We hold it so your school can use it, and we act on your school's instructions.

Why schools trust Attend

Attendance is not administrative paperwork. It is a record of where children were, and of who confirmed it.

That record does real work. When a child is marked absent and no one knows why, a school needs to find out quickly — that is a safeguarding question, not a data-entry question. When a building has to be evacuated, the register is the list of people who must be accounted for. When a family needs to be contacted about their child, the school needs the right details immediately, not eventually. And when a question about a child's attendance arises months later, a school needs to give an accurate answer rather than a reconstruction.

Attend was built for schools specifically, and that shaped decisions a general-purpose system would have made differently. Attendance records are kept as a dependable history rather than something that can be quietly overwritten. Every register is attributed to the person who recorded it, and later changes are recorded rather than hidden. Access to a child's information is limited to the staff a school authorises, because in a school not everyone needs to see everything.

We do not think privacy in education is a compliance exercise. It is part of doing the job properly.

1. Who we are

Attend is an attendance and school operations platform for schools.

Attend is developed and operated by Childrens House.

For any question about this policy, or about the organisation behind Attend, contact us at info@childrenshouse.co.za. Formal legal and registration details are available on request, including as part of a school's procurement process — we keep the public version of this policy simple by design, not because those details do not exist.

2. Who this policy is for

This policy applies to:

• Visitors to our website.
• Schools that hold an Attend account.
• People who use Attend on a school's behalf — owners, heads of school, business managers, administrators, guides, and teachers.
• People whose information a school records in Attend — principally the children a school enrols.

Attend does not offer accounts to parents or guardians today. If that changes, we will update this policy before the feature is released.

3. How responsibility is divided

This section matters more than it might first appear, because it determines who decides what.

Your school decides. Your school chooses what information to record in Attend, which staff may see it, how long to keep it, and what to do with it.

We act on those decisions. Attend stores and processes that information so your school can use the platform. We do not decide what a school records, and we do not use a school's information for our own purposes.

In data protection law, this makes your school the controller of the information it records, and Attend the processor acting on the school's behalf. The terms matter for contracts and for compliance, but the practical meaning is simpler than the language suggests:

• We do not add, change, or remove records in a school's account except at the school's request, or where it is necessary to provide or protect the service.
• We do not share a school's information with other schools. Ever.
• If you are a parent, a guardian, or a member of staff and you want to see or correct information a school holds about you, your school is the right place to ask. We will help the school respond, but we cannot make those decisions on its behalf.

For our own website visitors, and for our direct dealings with the people who hold Attend accounts, those decisions are ours — and so is the responsibility.

4. Our privacy principles

Schools own their information. You can export it, and you can ask us to delete it.

We collect only what the platform needs. Attend does not ask for information it has no use for.

Access is controlled by role. Your school decides who can see what. Access to a child's records is limited to the staff your school authorises.

Each school is separate. Your school's information is kept separate from every other school's, and is not visible to them.

We do not sell personal information. We never have, and we do not intend to.

Information entered into Attend is never used to train generative AI models and is never shared with third parties for AI training purposes.

5. Information we collect

Account information. Names, work email addresses, and roles, for the people your school authorises to use Attend. Where email and password sign-in is used, we store passwords in a form that cannot be read or reversed. We cannot see your password, and we cannot recover it — we can only help you reset it.

School information. Your school's name and contact details, academic years, terms, calendar, operating days, classrooms, and configuration.

Child information. The information your school chooses to record about the children it enrols. This typically includes name, date of birth, classroom, and enrolment status. Where a school chooses to record them, it may also include a profile photograph, and health-related information such as medical information, allergies, medications, dietary requirements, and emergency information. None of these additional fields are required to use Attend — each school decides what is relevant to record for the children in its care.

Attendance information. Daily attendance records, including status, time, the person who recorded them, and any later changes.

Technical information. When you use Attend, we automatically record limited technical information — sign-in times, IP address, browser and device type, and error and activity logs. We use this to keep accounts secure and to diagnose problems.

Support requests. If you contact us for help, we keep your message and our reply so we can assist you and improve.

6. How we collect it

Entered by your school. Almost all information in Attend is entered by school staff.

When an account is created. Either directly, or through an invitation from your school.

Automatically, as you use the platform. The technical and audit information described above.

Through cookies, in limited ways. See section 9.

We do not buy personal information, and we do not gather it from social media or data brokers.

7. Why we use it

We use information to:

• Run the platform — recording attendance and managing children, staff, classrooms, and the academic calendar.
• Confirm who people are and keep accounts secure.
• Maintain a reliable history, so a school can see who recorded or changed a record and when. This matters particularly for attendance, which is often a legal record: it should be possible to show how it was made.
• Provide support when you ask for it.
• Keep the service working — monitoring, diagnosing faults, and preventing misuse.
• Improve Attend — understanding which features are used and where people get stuck. Where we can do this without identifying anyone, we do.
• Communicate with you about your account, changes to the service, and security matters.
• Meet legal obligations where they apply to us.

We do not use school or child information for advertising, and we do not build profiles of children.

8. Lawful basis

We process information because schools use Attend to provide educational and administrative services — recording attendance, managing enrolment, and running the day-to-day operations of a school. That is the simple reason information is collected and used: to make the service your school has chosen to use actually work.

Where data protection law requires a formal lawful basis to be identified, this processing is generally carried out to perform our contract with your school, and in some cases to meet a legal obligation the school itself is subject to (such as keeping accurate attendance records). We do not rely on advertising-related bases, and we do not ask individuals to consent to processing on our behalf — that relationship sits between a school and the people whose information it records.

9. Cookies

Attend uses cookies for a small number of purposes.

Essential cookies keep you signed in and keep the platform secure. Attend cannot work without them.

Attend currently uses only essential cookies required for authentication, security, and operation of the platform. Attend does not currently use advertising cookies. If analytics cookies are introduced in the future, this policy will be updated accordingly.

10. When we share information

We share information only where it is necessary to run Attend, and only with organisations contractually required to protect it.

Service providers who help us operate the platform:

We keep this list current, and we will tell schools before we add a provider that handles their information.

When the law requires it. If we are legally obliged to disclose information, we will. Unless we are prohibited from doing so, we will tell the affected school first.

If our business changes. If Attend is ever sold or merged, information may transfer as part of that. Schools would be told, and the protections in this policy would continue to apply until a new policy replaced it.

Attend does not sell personal information. We do not sell, rent, or trade it, and we do not share it for advertising.

11. Security

What follows is what we actually do. We have deliberately not claimed certifications or independent audits we do not hold.

Encrypted connections. Information travelling between you and Attend is encrypted.

Separation between schools. Each school's information is securely separated from every other school's. Someone signed in to one school cannot reach another school's records.

Access controlled by role. Your school decides which staff hold which role, and what each role can do. These limits are enforced by the platform itself — a restriction is a real restriction, not simply a hidden button.

Sign-in protection. Passwords are stored in a form that cannot be read or reversed.

A record of significant actions. Attend records who did what and when, including changes to attendance and to who has access.

Ongoing maintenance. We keep the platform and the services it depends on up to date, and we monitor for problems.

Honesty about limits. No platform is without risk, and we would rather say so than imply otherwise.

If something goes wrong. If a security incident affects your school's information, we will investigate, act to contain it, and notify your school without undue delay, with what we know and what we are doing. Because your school is responsible for deciding what happens to that information, it may also have its own duty to inform parents, staff, or a regulator — we will give your school what it needs to do that.

12. How long we keep information

While your school's account is active, we keep the information your school has entered, because your school needs it. Attendance records in particular are often kept for several years to meet a school's own obligations. That is your school's decision, not ours.

You can export your information at any time. Attendance and other records can be exported from the platform.

When an account closes, we keep information for [Retention period] so your school can still export it or reactivate the account. After that, we delete or anonymise it.

Your school can ask us to delete information sooner, and we will, apart from anything we are legally required to keep.

Backups are kept for a shorter period and are overwritten in the normal course of operating the service. Deleted information may remain in a backup briefly before it is removed.

13. Children's information

This deserves its own section, because it is the most sensitive information Attend holds.

Your school decides, and remains responsible. Your school chooses what to record about a child, who may see it, and how long to keep it. We hold it on your school's behalf and act on your school's instructions.

What may be recorded. Beyond name, date of birth, classroom, and enrolment status, a school may choose to record a child's profile photograph, and health-related information such as medical information, allergies, medications, dietary requirements, and emergency information. None of these fields are required to use Attend — each school decides what is relevant for the children in its care.

Only authorised people can see it. Access to a child's records is limited to the staff your school has authorised, according to their role and — where your school's setup requires it — the classrooms they are assigned to.

We never use children's information for advertising. Not for our own marketing, and not for anyone else's.

We never use children's information to train AI models.

We do not contact children. Attend does not send messages to children and does not offer them accounts.

If you are a parent or a guardian and you want to know what your child's school records in Attend, or to correct it, please contact the school. The school holds that information and makes those decisions. We will support the school in responding to you.

14. Decisions about people

Attend does not make automated decisions about children or staff that carry legal or otherwise significant consequences. Where Attend suggests something, a person reviews and confirms it before it becomes part of a record.

15. Where information is processed

Attend runs on cloud infrastructure, which means information may be stored and processed in a country other than your own, depending on the provider and the region.

Attend's application is hosted on Vercel. Attend's database, authentication, and storage are provided by Supabase, with production infrastructure located in North Virginia, USA. Information may therefore be processed in the United States depending on the services used.

We rely on the contractual and security safeguards our infrastructure providers have in place to protect personal information when it is transferred internationally.

16. Schools that need a formal agreement

Many schools have their own legal duty to hold a written data processing agreement with providers like us. If your school needs one, contact us at info@childrenshouse.co.za.

This policy explains our practices. It is not a substitute for that agreement.

17. Your rights

Depending on where you live, you may have the right to:

• See the information held about you.
• Correct it if it is wrong.
• Delete it, in some circumstances.
• Export it in a portable format.
• Object to or limit certain uses of it.
• Complain to a data protection regulator.

Where to ask matters. For information your school has recorded in Attend — including anything about a child — contact your school. Your school holds it and makes those decisions. If you contact us instead, we will point you to the school and help them respond.

For information we hold about you directly — your Attend account, or a support conversation with us — contact us at info@childrenshouse.co.za and we will respond within 30 days.

You may also lodge a complaint with the data protection authority or privacy regulator responsible for your jurisdiction if you believe your personal information has not been handled in accordance with applicable law.

18. Changes to this policy

We will update this policy as Attend changes. When we make a significant change, we will tell account holders before it takes effect, and we will update the effective date at the top.

19. Contact us

We believe transparency builds trust.

If your school has questions about privacy, safeguarding, compliance, or data protection before implementing Attend, we encourage you to contact us. We are happy to explain how Attend works and discuss your school's specific requirements — including telling you plainly where we can and cannot meet them.

Privacy enquiries: info@childrenshouse.co.za

Support: info@childrenshouse.co.za

If you are not satisfied with our response, you may contact the data protection authority or privacy regulator responsible for your jurisdiction.