Privacy Policy

Our commitment

Schools trust Attend with information about the Children in their care. That is not information we take lightly.

This policy explains what information Attend holds, why we hold it, and what we do and do not do with it. We have written it to be read, not filed away unread. If anything here is unclear, we would rather you asked us than guessed.

One principle sits underneath everything else in this document: the information your school enters into Attend belongs to your school. We hold it so your school can use it, and we act on your school's instructions.

---

Why schools trust Attend

Attendance is not administrative paperwork. It is a record of where Children were, and of who confirmed it.

That record does real work. When a Child is marked absent and no one knows why, a school needs to find out quickly — that is a safeguarding question, not a data-entry question. When a building has to be evacuated, the register is the list of people who must be accounted for. When a family needs to be contacted about their Child, the school needs the right details immediately, not eventually. And when a question about a Child's attendance arises months later, a school needs to give an accurate answer rather than a reconstruction.

Attend was built for schools specifically, and that shaped decisions a general-purpose system would have made differently. Attendance records are kept as a dependable history rather than something that can be quietly overwritten. Every register is attributed to the person who recorded it, and later changes are recorded rather than hidden. Access to a Child's information is limited to the staff a school authorizes, because in a school not everyone needs to see everything.

We do not think privacy in education is a compliance exercise. It is part of doing the job properly.

---

1. Who we are

Attend is an attendance and school operations platform for schools, available at attendmontessori.com.

Attend is provided by Childrens House, a company registered in South Africa.

We do not publish our registration number or registered address, because business-impersonation fraud is a persistent problem in our jurisdiction. We will provide them in full, in writing, to any school, regulator, or auditor who asks. Email attend@childrenshouse.co.za.

For any question about this policy, or about information we hold, contact us at attend@childrenshouse.co.za.

We have an Information Officer registered with the Information Regulator of South Africa, as required by law. Their contact details are available on request at the address above.

---

2. Who this policy is for

This policy applies to:

• Visitors to our website.
• Schools that hold an Attend account.
• People who use Attend on a school's behalf — owners, heads of school, business managers, administrators, guides, and teachers.
• People whose information a school records in Attend — the Children a school enrolls, and the Guardians a school records for them.

Children do not use Attend. There are no accounts for Children, Attend does not communicate with Children, and no Child ever interacts with the service. Information about a Child is entered by school staff. This matters, and section 13 explains why.

Attend does not offer accounts to parents or Guardians today. Guardian records exist so that schools can hold contact and collection information. If that changes, we will update this policy before the feature is released.

---

3. How responsibility is divided

This section matters more than it might first appear, because it determines who decides what.

Your school decides. Your school chooses what information to record in Attend, which staff may see it, how long to keep it, and what to do with it.

We act on those decisions. Attend stores and processes that information so your school can use the platform. We do not decide what a school records, and we do not use a school's information for our own purposes.

In data protection law, this makes your school the responsible party (or controller) for the information it records, and Attend the operator (or processor) acting on the school's behalf. The terms matter for contracts and for compliance, but the practical meaning is simpler:

• We do not add, change, or remove records in a school's account except at the school's request, or where it is necessary to provide or protect the service.
• We do not share a school's information with other schools. Ever.
• If you are a parent, a Guardian, or a member of staff and you want to see or correct information a school holds about you, your school is the right place to ask. We will help the school respond, but we cannot make those decisions on its behalf.

For our own website visitors, and for our direct dealings with the people who hold Attend accounts, those decisions are ours — and so is the responsibility.

---

4. Our privacy principles

Schools own their information. You can export it, and you can ask us to delete it.

We collect only what the platform needs. Attend does not ask for information it has no use for.

Access is controlled by role. Your school decides who can see what. Access to a Child's records is limited to the staff your school authorizes.

Each school is separate. Your school's information is kept separate from every other school's, and is not visible to them.

We do not sell personal information. We never have, and we do not intend to.

We do not use school information to train AI models. Information your school records in Attend is not used to train or improve AI models — ours or anyone else's.

---

5. Information we collect

Account information. Names, work email addresses, and roles, for the people your school authorizes to use Attend. Where email and password sign-in is used, we store passwords in a form that cannot be read or reversed. We cannot see your password, and we cannot recover it — we can only help you reset it.

School information. Your school's name and contact details, academic years, terms, calendar, operating days, classrooms, capacity, and configuration.

Child information. The information your school chooses to record about the Children it enrolls. This typically includes name, date of birth, classroom, enrollment status, and enrollment history. Your school may also record medical conditions, allergies, and collection restrictions where it judges that necessary for the Child's care and safety.

Guardian information. The Guardians a school records for each Child — names, contact details, their relationship to the Child, and whether they are permitted to collect the Child.

Attendance information. Daily attendance records, including status, time, the person who recorded them, when it was recorded, and any later changes and who made them.

Technical information. When you use Attend, we automatically record limited technical information — sign-in times, IP address, browser and device type, and error and activity logs. We use this to keep accounts secure and to diagnose problems.

Support requests. If you contact us for help, we keep your message and our reply so we can assist you and improve.

We do not collect biometric information. Attend does not use facial recognition, fingerprints, voiceprints, or any other biometric identifier, for attendance or for anything else.

---

6. How we collect it

Entered by your school. Almost all information in Attend is entered by school staff.

When an account is created. Either directly, or through an invitation from your school.

Through Google Sign-In, where your school uses it. See section 8.

Automatically, as you use the platform. The technical and audit information described above.

Through cookies, in limited ways. See section 9.

We do not buy personal information, and we do not gather it from social media or data brokers.

---

7. Why we use it

We use information to:

• Run the platform — recording attendance and managing Children, Guardians, staff, classrooms, and the academic calendar.
• Confirm who people are and keep accounts secure.
• Maintain a reliable history, so a school can see who recorded or changed a record and when. This matters particularly for attendance, which is often a legal record: it should be possible to show how it was made.
• Provide support when you ask for it.
• Keep the service working — monitoring, diagnosing faults, and preventing misuse.
• Improve Attend — understanding which features are used and where people get stuck. Where we can do this without identifying anyone, we do.
• Communicate with you about your account, changes to the service, and security matters.
• Meet legal obligations where they apply to us.

We do not use school or Child information for advertising, and we do not build profiles of Children.

---

8. Google Sign-In

Where your school enables it, you can sign in to Attend with a Google account instead of a password.

We never receive your Google password. Google confirms your identity to us. Your password stays with Google.

We receive only basic identity information — your name, your email address, whether Google has confirmed that email address belongs to you, and a link to your Google profile photo if you have one. We do not ask Google for access to your email, files, calendar, or contacts.

Your profile photo is displayed, not stored. If Google provides one, Attend shows it directly from Google. We do not copy it onto our systems. If you upload your own photo to Attend, yours is used instead.

Connecting to an existing account. If you already have an Attend account with the same email address, and Google has confirmed that address belongs to you, signing in with Google connects to your existing account rather than creating a second one. If Google has not confirmed the address, we will not connect them. This protects your account from anyone who claims your email address without being able to prove it.

Signing in is not the same as being given access. Signing in with Google proves who you are. It does not give you access to any school. Access comes only from a school inviting you, or from creating a school of your own.

Email and password sign-in remains available where your school enables it.

One practical note: signing out of Attend does not sign you out of Google. Worth remembering on a shared office computer.

Google's own handling of your information is governed by Google's privacy policy.

---

9. Cookies

Attend uses cookies for a small number of purposes.

Essential cookies keep you signed in and keep the platform secure. Attend cannot work without them.

Analytics and support cookies. Our public website uses HubSpot to understand how visitors find us and to run the support chat. These run on our marketing pages only — not inside Attend itself. Once you sign in, no analytics or support tracking follows you into your school's records.

---

10. When we share information

We share information only where it is necessary to run Attend, and only with organizations contractually required to protect it.

Service providers who help us operate the platform:

Each of these providers is contractually restricted to processing information only as needed to provide their service to us. None of them is permitted to use a school's information for their own purposes.

We keep this list current, and we will tell schools before we add a provider that handles their information.

When the law requires it. If we are legally obliged to disclose information, we will. Unless we are prohibited from doing so, we will tell the affected school first.

If our business changes. If Attend is ever sold or merged, information may transfer as part of that. Schools would be told, and the protections in this policy would continue to apply until a new policy replaced it.

Attend does not sell personal information. We do not sell, rent, or trade it, and we do not share it for advertising.

---

11. Security

What follows is what we actually do. We have deliberately not claimed certifications or independent audits we do not hold.

Encrypted connections. Information travelling between you and Attend is encrypted.

Separation between schools. Each school's information is securely separated from every other school's. Someone signed in to one school cannot reach another school's records.

Access controlled by role. Your school decides which staff hold which role, and what each role can do. These limits are enforced by the platform itself — a restriction is a real restriction, not simply a hidden button.

Sign-in protection. Passwords are stored in a form that cannot be read or reversed. Where Google Sign-In is used, Google confirms identity. We limit repeated sign-in and password-reset attempts to protect accounts from automated guessing.

A record of significant actions. Attend records who did what and when, including changes to attendance and to who has access.

Encrypted backups. We take a daily backup of the database, encrypt it, and store it separately from the platform itself. Backups are automatically deleted after 30 days.

Ongoing maintenance. We keep the platform and the services it depends on up to date, and we monitor for errors and problems.

Honesty about limits. No platform is without risk, and we would rather say so than imply otherwise. We do not currently hold an independent security certification such as SOC 2 or ISO 27001.

If something goes wrong. If a security incident affects your school's information, we will investigate, act to contain it, and notify your school within 7 days of becoming aware, with what we know and what we are doing. Because your school is responsible for deciding what happens to that information, it may also have its own duty to inform parents, staff, or a regulator — we will give your school what it needs to do that. We will also notify the Information Regulator of South Africa where required.

---

12. How long we keep information

While your school's account is active, we keep the information your school has entered, because your school needs it. Attendance records in particular are often kept for several years to meet a school's own obligations. That is your school's decision, not ours.

You can export your information at any time. Attendance and other records can be exported from the platform.

When an account closes, we keep information for 90 days so your school can still export it or reactivate the account. After that, we delete or anonymize it.

Your school can ask us to delete information sooner, and we will, apart from anything we are legally required to keep.

We do not retain information indefinitely. Backups are encrypted and automatically deleted after 30 days. Deleted information may remain in a backup for up to 30 days before it is removed.

---

13. Children's information

This deserves its own section, because it is the most sensitive information Attend holds.

Your school decides, and remains responsible. Your school chooses what to record about a Child, who may see it, and how long to keep it. We hold it on your school's behalf and act on your school's instructions.

Only authorized people can see it. Access to a Child's records is limited to the staff your school has authorized, according to their role and — where your school's setup requires it — the classrooms they are assigned to.

Children do not use Attend. There are no Child accounts. Attend does not communicate with Children, does not advertise to them, and collects nothing from them directly. Everything Attend holds about a Child was entered by an adult at their school.

We never use Children's information for advertising. Not for our own marketing, and not for anyone else's.

We never use Children's information to train AI models.

We do not use biometric information. No facial recognition, no fingerprints, no voiceprints — for attendance or anything else.

If you are a parent or a Guardian and you want to know what your Child's school records in Attend, or to correct it, please contact the school. The school holds that information and makes those decisions. We will support the school in responding to you.

For schools in the United States

Two US laws are commonly raised in school procurement, and neither applies to Attend.

FERPA governs educational institutions that receive US Department of Education funding, and their handling of education records. Where it applies to your school, Attend operates under your school's direction: we hold records on your behalf, use them only to provide the service, and do not disclose them to anyone other than the service providers listed in section 10.

COPPA governs online services that collect personal information from children under 13. Attend collects nothing from Children. There are no Child accounts, Children do not use the service, and everything Attend holds about a Child was entered by an adult at their school.

We are happy to sign a data processing agreement, a student data privacy agreement, or an NDPA where your school or district requires one. Contact us at attend@childrenshouse.co.za.

---

14. Decisions about people

Attend does not make automated decisions about Children or staff that carry legal or otherwise significant consequences. Where Attend suggests something, a person reviews and confirms it before it becomes part of a record.

---

15. Where information is processed

Attend is operated from South Africa, and runs on cloud infrastructure located in the United States. Our database, authentication, application hosting, email delivery, backup storage and error monitoring providers are all United States based.

This means information you record in Attend is transferred to and processed in the United States, regardless of where your school is.

How we make that lawful. South African law permits information to leave the country where the recipient is bound to protect it to a standard at least equal to POPIA. Every provider we use is bound by a written agreement requiring exactly that:

• They must protect your school's information to a standard at least equal to POPIA.
• They may not pass it on to anyone else unless that party is bound by the same terms.
• Where information originates in South Africa, those protections extend to schools as organizations, not only to the individual people recorded in them. South African law protects both, and many data protection regimes elsewhere protect only individuals — so we say so explicitly rather than relying on the narrower default.

We respect the data protection law that applies to your school. Schools operate under different rules in different countries — the GDPR in the European Union, the UK GDPR, POPIA in South Africa, and comparable laws elsewhere. Where your school is subject to one of these, we work with you to meet the obligations it places on you: we act only on your instructions, we will enter into the written agreement your law requires, and we will provide the information you need to answer your own regulator.

If your school's jurisdiction has requirements we cannot meet, we will tell you plainly rather than leave you to discover it. Contact us at attend@childrenshouse.co.za before implementing Attend and we will work through it with you.

---

16. Schools that need a formal agreement

Many schools have their own legal duty to hold a written data processing agreement with providers like us. If your school needs one, contact us at attend@childrenshouse.co.za.

This policy explains our practices. It is not a substitute for that agreement.

---

17. Your rights

Depending on where you live, you may have the right to:

• See the information held about you.
• Correct it if it is wrong.
• Delete it, in some circumstances.
• Export it in a portable format.
• Object to or limit certain uses of it.
• Complain to a data protection regulator.

Where to ask matters. For information your school has recorded in Attend — including anything about a Child — contact your school. Your school holds it and makes those decisions. If you contact us instead, we will point you to the school and help them respond.

For information we hold about you directly — your Attend account, or a support conversation with us — contact us at attend@childrenshouse.co.za and we will respond within 30 days.

You can also complain to the Information Regulator of South Africa, or to your own local data protection authority.

---

18. Changes to this policy

We will update this policy as Attend changes. When we make a significant change, we will tell account holders before it takes effect, and we will update the effective date at the top.

---

19. Contact us

We welcome questions about privacy, safeguarding, and how Attend protects school information.

If your school has particular privacy or data protection requirements, we encourage you to contact us before implementing Attend. We are happy to explain how the platform works, walk through your school's requirements, and tell you plainly where we can and cannot meet them.

Privacy questions: attend@childrenshouse.co.za Support: attend@childrenshouse.co.za Telephone: +1 (325) 313-5451 Information Officer: contact details on request, at the email above

Registration details and registered address are available in writing on request. We do not publish them because business-impersonation fraud is a persistent problem in our jurisdiction. Any school, regulator, or auditor who asks will receive them in full.

If you have raised something with us and are not satisfied with our response, you can contact the Information Regulator of South Africa.

This policy is governed by the laws of South Africa.