Effective Date: March 26, 2026
Thesylink ("Company", "we", "us", or "our") operates the EduFlow platform ("Platform" or "Service"), a school management system. This Privacy Policy describes what personal data we collect, how we use it, who we share it with, and your rights regarding your data.
This policy applies to all users of the EduFlow platform, including school administrators, teachers, staff, and any individuals whose data is entered into the system by authorized school users.
We collect and process the following categories of personal data, which is entered into the Platform by authorized school users:
Account Data: School name, administrator name, email address, and password (stored in hashed form only — we never store plain-text passwords).
Student Data: Student names, enrollment records, attendance records, grades, examination results, and related academic information.
Staff and HR Data: Employee names, contact details, salary information, Social Security and National Insurance Trust (SSNIT) numbers, bank account details, and leave records.
Financial Data: Fee structures, invoices, payment records, receipts, and transaction records processed through Paystack.
AI-Generated Data: Examination questions, lesson plans, student risk assessments, and curriculum content generated through the Platform's AI features.
Usage Data: Login timestamps and feature usage data collected solely for the purpose of operating and maintaining the Service, not for analytics or profiling.
We use your data solely to provide and operate the EduFlow Service. Specifically, we process data for the following purposes: displaying information within the Platform, generating reports and PDF documents, sending notifications via email and SMS as configured by the school, processing payments, and providing AI-powered features requested by the school.
We do not sell, rent, trade, or share your data with third parties for advertising, marketing, analytics, artificial intelligence training, or any other purpose beyond the direct provision of the EduFlow Service.
To provide the Service, we engage the following third-party data processors, each of whom receives only the minimum data necessary for their specific function:
Paystack (payment processing) — receives payer name, email address, payment amount, and transaction references for the purpose of processing financial transactions.
Resend (email delivery) — receives recipient email addresses and email content for the purpose of delivering email notifications and communications.
Kairos SMS (SMS delivery) — receives phone numbers and message content for the purpose of delivering SMS notifications and reminders.
Google Gemini (AI features) — receives contextual academic data necessary to generate examination questions, lesson plans, and risk assessments. We minimize the personal information sent to this service and do not send student names or identifying information unless specifically required by the requested feature.
Each third-party processor is bound by their own privacy policies and applicable data protection obligations. We select processors that maintain appropriate security and data protection standards.
Your data is stored on secured servers with access restricted to authorized personnel only. We implement the following security measures to protect your data:
All passwords are hashed using the bcrypt algorithm and are never stored in plain text. The Platform enforces multi-tenant data isolation, meaning all database queries are scoped by school identifier — schools cannot access, view, or modify another school's data under any circumstances. Access to production systems is restricted to authorized Thesylink personnel through secured authentication mechanisms.
EduFlow processes personal data of students, who may be minors under the age of eighteen (18). We process this data solely on the instruction and authority of the school, which acts as the data controller for student information.
The school is responsible for obtaining all necessary consents from parents or legal guardians prior to entering any student personal data into the Platform, in compliance with the Data Protection Act, 2012 (Act 843) of Ghana. We do not knowingly collect personal data directly from children. Parents or legal guardians who wish to access, correct, or request deletion of their child's data should contact the school directly.
We retain your data for as long as your school's account remains active on the Platform. Schools may request a full data export at any time during the term of their active account.
Upon termination of a school's account, we will notify the school via email and provide a period of ninety (90) days to export or back up all data. After the expiration of this 90-day period, all school data will be permanently and irreversibly deleted from our systems, including all backups. This deletion is final and cannot be reversed.
Under Ghana's Data Protection Act, you have the following rights regarding your personal data:
Right of Access: You may request a copy of the personal data we hold about you or your institution.
Right to Correction: You may request correction of any inaccurate or incomplete personal data.
Right to Object: You may object to the processing of your personal data under certain circumstances as provided by law.
Right to Deletion: You may request deletion of your personal data, subject to any contractual obligations and legal retention requirements.
Right to Complain: You have the right to lodge a complaint with the Data Protection Commission of Ghana if you believe your data protection rights have been violated.
To exercise any of these rights, please submit a written request to the contact information below. We will respond to all valid requests within thirty (30) days.
EduFlow uses browser session storage and local storage to store authentication tokens necessary for Platform functionality. We do not use third-party tracking cookies, advertising cookies, or any analytics tracking tools. Only essential storage mechanisms required for the Platform to function are used.
We may update this Privacy Policy from time to time. We will provide a minimum of thirty (30) days advance notice of any material changes via email to the address associated with your account. Previous versions of this policy are available upon request. Your continued use of the Platform after the effective date of the updated policy constitutes your acceptance of the changes.
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:
Thesylink
Email: support@thesylink.com
Accra, Ghana
For complaints regarding data protection, you may also contact the Data Protection Commission of Ghana at www.dataprotection.org.gh.