Privacy Policy

1. Who we are

The Smart Campus app and the website smartcampuspk.com are run by BURHAN TECHNOLOGIES("we", "us"), a proprietorship registered in Pakistan. On Google Play, the app is developed and published by Burhan Technologies.

• Address: Post Office Moil, Tehsil Barnala, District Bhimber, Azad Jammu & Kashmir, Pakistan
• Email for privacy questions: smartcampuspakistan@gmail.com

2. Your school and us

Smart Campus is used by schools, colleges and other institutions ("your institution" or "your school"). There are two kinds of information, and the person in charge is different for each:

• School records: for example class enrolment, attendance, marks and results, fee records, timetables and notices. Your institution decides what to record and who sees it. Your institution is in charge of these records and is the "data controller". We store and process them on the institution's behalf, following its instructions.
• Account and app information: for example your login, contact details, uploaded registration documents, device push tokens and security logs. We are in charge of this information and are the controller for it.

If you have a question about school records (for example a wrong mark or an attendance entry), please ask your school first. We will help your school answer it. We will sign a data processing agreement with any institution that asks for one.

3. What we collect

a) Information you give us when you register

Everyone who registers gives us:

• First and last name
• Date of birth and gender
• Email address and mobile phone number
• The institution you want to join

Depending on your role, you also give us:

• Students: your class and section (and subject group, if your school uses one).
• Teachers: the classes, sections and subjects you teach.
• Parents and guardians: your child's student ID, so we can link you to your child. Your child or your school must approve the link.
• Institution administrators: the institution's name, city and area, branch, and your position there.
• Teachers, guardians and administrators: photos or PDF copies of the front and back of your government ID, and supporting documents such as education certificates. We check these before your account is approved. Students do not upload ID documents.

To check that your contact details are really yours, we send one-time codes to both your email address and your WhatsApp number, and you confirm both before your account can be approved.

Your profile also has some optional fields (such as admission number, blood group, religion, nationality, previous school, qualification and specialisation). The app does not currently ask for these. If they are ever filled in, they are treated as part of your profile and deleted with your account.

b) Information your school creates about you

• Your institution-issued login ID (for example STU-2026-00012) and your account status (pending, approved, suspended)
• Class and section enrolment, promotions and transfers
• Attendance records for students, and staff attendance including check-in time for staff
• Tests, marks, results and teacher feedback
• Fee records: the monthly fee for your class and payments the school has recorded (amount, month, paid in cash or by bank transfer, remarks)
• Timetables, teaching assignments, holidays, events and notices
• Roles your school gives you (for example fee manager)

c) Information created as you use the app

• Profile photo, if you choose to add one
• Group chat: messages, photos and PDF files posted in your school's groups (teachers and administrators can post, students can react, guardians can read their child's groups), emoji reactions, which messages you have read, and whether you muted a group
• Safety tools: messages you report (with the reason and any note you add) and people you block
• Notifications sent to you and which ones you have read
• Guardian link requests and the answer to them
• Sign-in information: when you last signed in and how many times you have signed in
• Activity log: a record of important actions (sign-in, registration, password changes, approvals and changes made by administrators) with the date, time and the IP address the request came from

d) Device and technical information

• Push notification token and whether your phone is Android or iOS. We only get this if you allow notifications. It is removed when you sign out.
• IP address, which our servers receive with every request. We keep it in the activity log for security. We do not use it to work out your location.
• On your phone only: if you tick "Remember me", the app saves your login ID and institution on your phone to fill in the login form next time. Your password is never saved. Your sign-in session is kept in your phone's secure storage.

e) Website-only information

This website itself collects no personal data: it uses no cookies, no analytics and no tracking of any kind. When you contact us through WhatsApp, phone or email to book a demo, you voluntarily share your contact details, and we use them only to arrange and follow up on that conversation.

f) What we do not collect

• No location (GPS) data
• No contacts, call logs, calendar or SMS from your phone
• No microphone or audio recording
• No advertising ID, no analytics tools and no crash-reporting tools in the app
• No card or bank details. School fees are not paid in the app: staff record payments made at the school.

4. How we use information

• To run the app: create your account, show you your timetable, attendance, results, fees, notices and groups, and let staff manage school work
• To check who you are: your school's administrators review registrations and documents, and our team reviews new institutions and their administrators
• To confirm your contact details: one-time codes sent to your email and WhatsApp number, your login details after approval, and password-reset codes
• To send notifications: for example new group messages, results, notices and fee reminders
• To keep the service safe: stop misuse, look into reports, and keep an audit trail of important actions
• To run and improve the service: for example counting how many people sign in each day, so we can plan capacity. We use our own database for this, not third-party analytics
• To meet legal duties and respond to lawful requests

We do not use your information for advertising, and we do not sell it or rent it to anyone.

5. When we are allowed to use it

• To provide the service your school has signed up for, and that you have asked to use
• Consent: for example when you allow notifications, the camera or photos, or upload optional content. You can withdraw consent at any time (see Your rights)
• Legitimate interests: keeping the service secure and preventing misuse
• Legal obligations: where the law requires us to keep or share information

Children: student accounts are created to join a specific institution and must be approved by it. Many students do not have their own phones, so a parent or guardian often creates and runs the student account for a child. In every case, the institution is responsible for having the consent of a parent or guardian where the law requires it. Parents and guardians can link to their child's account through their own guardian account, and can ask for access or deletion of a child's data (see Children's privacy).

6. Who can see your information

People inside your institution

• Your institution's administrators can see the registration details and documents of people who apply to join, and the school records they manage
• Teachers see information about the classes and subjects they teach (for example attendance and marks)
• Staff with a module role (for example fee manager) see what that role needs
• Parents and guardians who are linked to a student can see that student's attendance, results, fees, timetable and groups
• Group members can see your name, profile photo and the messages, files and reactions you post in that group

Our team

A small number of our staff can access account information and documents to review new institutions, give support, and investigate safety or security problems.

Service providers who work for us

We use these companies to run the service. They process data only on our instructions and only to provide their service to us.

• Render: hosts our servers and database
• Cloudflare: stores uploaded files (documents, profile photos and chat attachments) in Cloudflare R2, a private storage bucket, and runs our domain name (DNS)
• Brevo: delivers our emails (verification codes, login details, password resets)
• WhatsApp (Meta): delivers one-time verification codes through WhatsApp
• Expo: passes push notifications on to Google and Apple
• Google Firebase Cloud Messaging: delivers push notifications to Android phones
• Apple Push Notification service: delivers push notifications to iPhones
• Vercel: hosts our website and our internal administration dashboard

Push notifications contain a short preview. For a group message, this is the sender's name and the first part of the message. This preview passes through Expo and Google or Apple to reach your phone.

The law: we may share information if the law requires it, or to protect someone's safety, for example reporting child sexual abuse material to the authorities (see our Child Safety Standards).

No selling, no advertising: we never sell personal information, and we never share it with advertising networks or data brokers.

7. Phone permissions

The app asks for these permissions only when you use the feature. You can say no, or turn them off later in your phone's settings.

• Camera: to take a photo of your ID or documents when you register, or to share a photo in a group
• Photos and media: to choose a profile picture, attach registration documents, or share a photo in a group. The app only gets the photos you pick
• Notifications: to tell you about new messages, results, notices and other school updates

The app does not ask for microphone, location or contacts permission.

8. Featured cards

The app shows a small "Featured" carousel of cards written by the Smart Campus team (for example announcements). Everyone sees the same cards. They are not chosen using your data, and we do not track who views or taps them. A card may open a web page; that website's own privacy policy then applies.

9. How long we keep information

• Your account: while your account is open. When you delete it, we erase your personal account data straight away (see Deleting your account)
• School records: for as long as your institution keeps them, because they are the institution's records. Your institution can ask us to remove them
• Activity and security logs: for 12 months, to keep the service secure. Older entries are deleted automatically
• Backups: deleted data can stay in our backups for up to 30 days, until the backups are replaced
• If an institution leaves Smart Campus: we can delete all of its data when it asks us to
• Registrations that were never approved: you can ask us to delete them using the form at smartcampuspk.com/delete-account

10. Deleting your account

In the app:

1. Go to Settings.
2. Tap Delete account.
3. Enter your password and confirm.

Your account is closed immediately and you are signed out on all your devices.

If you are the only administrator of your institution, you cannot delete your account in the app, because that would close the institution's account. Please contact us.

If you cannot open the app, or your registration was never approved, use the account deletion request form at smartcampuspk.com/delete-account. That page also has the full list of what is erased and what is kept.

11. Security

• All data between the app and our servers is sent over encrypted HTTPS connections
• Passwords are stored only as secure hashes (bcrypt). We cannot see your password
• One-time verification codes are stored only as hashes, expire after 10 minutes, and allow a limited number of tries
• After approval, your first password is temporary. You are asked to change it the first time you sign in
• Uploaded files are kept in private storage. They are only sent to people allowed to see them, after an access check
• Access is limited by role and by institution. People in one school cannot see another school's data
• On your phone, your sign-in session is kept in secure storage, and sessions expire

No system is perfectly secure. Please keep your password secret, and tell us straight away at smartcampuspakistan@gmail.com if you think your account has been misused. If a security breach affects your data, we will tell you and your institution without undue delay, with what happened and what you can do to protect yourself.

12. Children's privacy

• Many students who use Smart Campus are under 18, and some are young children. Student accounts are only for students of a registered institution, and each account must be approved by that institution
• Many students do not have their own phones, so a parent or guardian usually creates and runs the student account for them, and can see their attendance, results and progress on it
• Parents and guardians can also create their own guardian account and link it to their child's account to follow their child's school information
• We collect only what the school service needs. We do not show children advertising, and we do not track or profile them
• Students cannot post messages in group chats. They can read and react to messages in the groups their school adds them to
• We do not knowingly collect information from children outside an institution's enrolment. If we learn that we have, we will delete it
• A parent or guardian can ask to see, correct or delete their child's information. Please ask the school, or contact us at smartcampuspakistan@gmail.com

13. Your rights

Depending on the law where you live, you can ask us to:

• Show you the information we hold about you, and give you a copy
• Correct information that is wrong. For school records, ask your school: it can correct them directly
• Delete your account and information (see section 10)
• Withdraw consent: for example turn off notifications, camera or photo access in your phone settings, or remove your profile photo
• Complain to a data protection authority, where one exists in your country

To use these rights, email smartcampuspakistan@gmail.com. We will check your identity before acting, and reply within 30 days. If your request is about school records, we may pass it to your institution, because the records belong to it.

14. Where data is stored

Our servers and database are hosted by Render in Singapore. Our other providers (listed in section 6) may process data in other countries, including the United States and the European Union. We choose well-known providers, and we send data to them over encrypted connections.

15. Changes to this policy

We may update this policy when the app changes or the law changes. The "Last updated" date at the top will change whenever we update it. If a change is important, we will also tell you in the app or by email before it takes effect.

16. Contact us