Data Privacy Policy
1. Overview
Alpas Campuses is a multi-tenant school management platform. We are committed to protecting the personal data of students, faculty, and administrative staff entrusted to us by institutions ("Tenants"). This policy describes how data is collected, used, stored, and safeguarded.
2. Data We Process
On behalf of Tenants, we process the following categories of personal data:
- Student records — names, enrollment status, grades, and academic history.
- Staff and faculty information — contact details, roles, and employment records.
- Financial records — tuition, fee payments, and billing information.
- Platform usage data — login activity and feature interaction logs.
Alpas acts as a data processor. Each Tenant is the data controllerresponsible for the lawful basis of processing their users' data.
3. Tenant Data Isolation
All tenant data is logically isolated using PostgreSQL Row-Level Security (RLS). No tenant can access another tenant's data — this is enforced at the database layer, not merely at the application level. Each institution's data remains strictly within its own security perimeter.
4. How We Use Data
Data is used solely to provide and improve the platform services contracted by the Tenant. We do not sell, share, or use student or staff data for advertising or third-party profiling.
5. Data Retention
Tenant data is retained for the duration of the active subscription. Upon contract termination, Tenants may request a full data export within 30 days, after which data is securely deleted from all systems.
6. Security Measures
We implement the following technical and organizational safeguards:
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Role-based access controls limiting staff access to minimum necessary data.
- Regular security audits and penetration testing.
- Incident response procedures with Tenant notification within 72 hours of any breach.
7. Your Rights
Individuals whose data is processed have the right to access, correct, or request deletion of their personal data. These requests should be directed to the Tenant (the institution), who as data controller will coordinate with us as necessary.
8. Contact
For privacy-related enquiries, please contact us at chris@campuses.app.