Privacy Policy

1. Overview

Academy+ is school and academy management software. It is built and operated by Two Bit Digital (SMC-Private) Limited, a company registered with the Securities and Exchange Commission of Pakistan (SECP), trading as Two Bit Digital (“we,” “us,” or “our”). This policy explains what information Academy+ processes when a school or academy runs it for their own operations, and how we handle it.

2. Who this policy covers

This policy applies to three groups of people, differently:

• The institution and its staff (admins, teachers, accountants, receptionists): the people who sign up for and operate Academy+. We deal with this group directly.
• Students and guardians: the people whose records a subscribing institution enters into the product. We process this data on the institution’s behalf and under its instructions, not our own; the institution is the party responsible for that data under applicable law.
• Visitors to this site, including anyone using the evaluation demo described in section 10.

3. Information we collect

When an institution subscribes to and operates Academy+, the following information is processed:

• Institution details: the subscribing school’s name, address, and the contact details of whoever administers the account
• Staff records: name, contact details, qualifications, subject, salary, and employment status for teachers and other staff
• Student records: name, date of birth, gender, address, contact details, class and batch assignment, admission date, and enrollment status
• Guardian and parent contact details linked to a student
• Attendance records, exam results, and academic performance
• Fee invoice and payment records that the institution enters for its own bookkeeping: amounts, due dates, and a payment method label such as cash or bank transfer
• Notifications and messages sent through the platform
• Basic technical data such as sign-in activity, needed to keep accounts secure

Academy+ is not a payment service. It does not process payments, and it does not collect or store card numbers, bank account numbers, or other payment credentials, whether for an institution’s own subscription or for the fees a school collects from its students. Subscription fees are arranged directly with Two Bit Digital, and a school’s own fee collection from parents and guardians happens entirely outside Academy+, as described in our Terms of Service.

4. How we use this information

We process this information to provide the service: to let a subscribing institution record and manage attendance, fees, exams, timetables, and communication with families, to authenticate users and enforce the role-based permissions the institution sets, to provide support, and to maintain the security and reliability of Academy+. We do not sell this data, use it to train models, or share it with other institutions.

5. Who controls this data

The subscribing institution decides what data to enter into Academy+ and who at the institution can access it. In data protection terms, the institution is the controller of student, guardian, and staff data, and we act as its processor, handling that data only to provide the service and on the institution’s instructions. Institutions are responsible for having a lawful basis, such as parental or guardian consent where required, to enter personal data about students and staff.

6. Children’s and students’ data

Academy+ is built to hold records about students, who are frequently minors. We do not collect this data directly from students; it is entered by the subscribing institution as part of its own administrative records, under the consent and safeguarding arrangements that institution already has in place with parents and guardians. We do not use student data for advertising, profiling, or any purpose beyond operating the service for that institution.

7. Where data is stored

Academy+ is hosted on Vercel and stores data using Supabase. Depending on the region configured for a deployment, data may be stored and processed outside Pakistan. We select infrastructure providers who maintain independent security and compliance programs, and an institution is welcome to request details of the specific hosting region used for its deployment as part of its own due diligence.

8. Data retention

We retain an institution’s data for as long as its subscription is active, so the product continues to work as expected. If a subscription ends, we retain the data for a limited period to allow the institution to export it, after which it is deleted, unless we are required to keep it longer by law or the institution asks us to delete it sooner.

9. Security

Access to a subscribing institution’s data is restricted by the roles that institution’s admin assigns (admin, teacher, accountant, receptionist), and connections to Academy+ are encrypted in transit. No system is completely secure, and we cannot guarantee absolute security, but we take reasonable, industry-standard steps to protect data against unauthorized access, loss, or misuse.

10. The evaluation demo

A separate, publicly accessible demo of Academy+ is available for evaluation before subscribing. The demo runs on temporary, in-memory sample data that is not linked to any real person and resets independently of anything a visitor does in it. Choosing a role on the demo’s login screen sets a small cookie that remembers the chosen identity; it holds no personal information. Real student, guardian, or staff data should never be entered into the public demo.

11. Cookies

We use only the cookies needed to keep a user signed in to their account, or, on the demo, to remember the chosen demo identity. We do not currently run third-party analytics or advertising trackers on this site.

12. Your rights

If you are a student, guardian, or staff member whose data has been entered into an institution’s use of Academy+, requests to access, correct, or delete that data should go to that institution’s administrator, who controls the data and is best placed to action the request. If you are an institution using Academy+ directly, or have a question about this policy, contact us using the details in section 14.

13. Changes to this policy

We may update this policy as the product and applicable law evolve. Material changes will update the date at the top of this page.

14. Contact

Two Bit Digital (SMC-Private) Limited, registered with the Securities and Exchange Commission of Pakistan (SECP).
Registered address: 37-P Block 6 PECHS, Karachi
Email: sales@twobitdigital.com