Privacy Policy

1. Who we are

IntuitiveSBA (a product of Goad Technologies) ("IntuitiveSBA", "we", "us", "our") provides report-card and school-based-assessment (SBA) software for schools in Ghana. This Privacy Policy explains what personal data we process, why, and the choices and rights you have. We process personal data in line with the Data Protection Act, 2012 (Act 843) of Ghana.

You can reach us about privacy at info@intuitivesba.com · +233553254708.

2. Our role: controller and processor

IntuitiveSBA processes personal data in two distinct capacities:

• As a processor (operator) — for the pupil, guardian and assessment data that a school enters or uploads, the school is the data controller. We process that data only on the school's documented instructions to provide the service.
• As a controller — for the account data of the staff who sign in (teachers, heads, administrators) and for visitors to our website, we determine how that data is used and are the controller.

3. Information we collect

Account and profile data

• Your name, phone number and (optionally) email address.
• Your password, stored only as a salted cryptographic hash — never in plain text.
• Your role and school membership, and the sign-in sessions and devices linked to your account.

School and academic data (entered or uploaded by schools)

• Pupil records: name, class/level, sex, date of birth and any school-assigned pupil identifier.
• Assessment data: exam and continuous-assessment scores, SBA components, computed aggregates, grades and class positions.
• Report cards, remarks, and conduct, attendance and promotion information.
• Guardian details: name, phone number and SMS-consent status.
• Photographs of marked exam papers or class score sheets that you upload for the app to read.

Technical and security data

• IP address, device and browser (user-agent) information, and timestamps.
• Security and audit events (for example sign-ins, score commits and report sends), used to keep the platform safe and accountable.

We do not collect payment-card data through the app, and we do not knowingly collect data beyond what is needed to deliver the service.

4. How we use information

We use personal data to:

• Operate the service — read scores from the sheets you photograph, apply SBA scaling and GES grading, compute aggregates and positions, draft remarks, and produce report cards.
• Deliver report links to guardians by SMS, only where the guardian has consented.
• Authenticate users, secure accounts and prevent abuse.
• Provide support, fix problems and improve reliability.
• Meet legal, regulatory and accountability obligations.

We do not sell personal data. We do not use pupil or guardian data for advertising, and we do not use it to train third-party AI models beyond producing the result you asked for.

5. AI processing

To read marks from the images you upload and to draft report-card remarks, the relevant image and score data are sent to our AI provider (Anthropic, the maker of Claude) over a secure connection. AI output — extracted scores and draft remarks — is an aid that teachers review and confirm before it is used; it is not a substitute for the school's own judgement. Data sent to the AI provider through its API is not used by that provider to train its models.

6. Messages to guardians

Report links are sent to guardians by SMS through our messaging provider (mNotify). We only message guardians who have opted in; a guardian without consent is never sent a message. Each message contains the pupil's name and a private, single-purpose link — it carries no scores or other personal details in the link itself. A guardian can opt out at any time through their school or by contacting us.

7. Who we share data with

We share personal data only as needed to run the service, and with organisations that process it on our behalf under contract (sub-processors). These include:

• Our AI provider (Anthropic) — to read scores from images and draft remarks.
• Our SMS provider (mNotify) — to deliver report links to consenting guardians.
• Our cloud hosting and object-storage providers — to run the platform and store data securely.

We may also disclose data where required by law, to protect rights and safety, or to the school that controls the data. We never sell personal data to third parties.

8. Children's data

IntuitiveSBA handles the personal data of children on behalf of schools. The school is responsible for having a lawful basis for that processing, including any parental or guardian consent its own policies or the law require. We apply data minimisation, strict per-school access controls and tenant isolation, and we never use children's data for advertising or profiling.

9. How we protect data

• All traffic is encrypted in transit over HTTPS.
• Each school's data is isolated in the database by row-level security, so one school can never read another's data.
• Passwords are stored only as salted hashes; report links use opaque tokens that carry no personal data and expire.
• Access is role-based and least-privilege; sensitive actions are recorded in an audit log.
• Production refuses to start with weak or default secrets, and we monitor for vulnerabilities.

10. How long we keep data

• Account data is kept while your account is active and for a reasonable period afterwards, then deleted or anonymised.
• Report links expire automatically (by default after 30 days); the underlying report can be re-issued by the school.
• Uploaded exam-paper images are retained per the school's instruction and then purged.
• We retain some records longer where the law requires, and we cycle backups out on a regular schedule.

11. Your rights

Subject to Act 843, you may ask to access, correct, delete or restrict the personal data we hold about you, object to certain processing, and withdraw consent. For pupil and guardian data, the school is the controller, so we direct those requests to the school and assist it in responding. You also have the right to complain to Ghana's Data Protection Commission.

To exercise a right, email info@intuitivesba.com. See also our Account & Data Deletion page for how to delete an account.

12. International transfers

Some of our sub-processors operate outside Ghana. Where personal data is processed abroad, we rely on appropriate safeguards and contractual protections to keep it secure and to maintain a level of protection consistent with Act 843.

13. Cookies and analytics

Our website uses only privacy-friendly, cookieless analytics (where enabled) and sets no advertising cookies. The app stores only what it needs to work — your sign-in tokens and an offline cache so you can capture scores without a connection.

14. Changes to this policy

We may update this Privacy Policy from time to time. The effective date above shows when it last changed, and we will give notice of material changes through the app or website.

15. Contact us

Questions about privacy or this policy? Contact IntuitiveSBA (a product of Goad Technologies) at info@intuitivesba.com · +233553254708.