KiddieCove School Management System: Privacy Policy
Last updated: June 2026
Privacy Policy of KiddieCove (“we,” “our,” or “us”) is Pakistan’s child-safety-first school management system. We build tools that connect schools, parents, and teachers and in doing so, we handle some of the most sensitive data that exists: information about children Privacy Policy.
This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and what rights you have. It applies to all users of the KiddieCove platform, including school administrators, teachers, parents, and guardians accessing our services through kiddiecove.io and the KiddieCove mobile application.
By using KiddieCove, you agree to this Privacy Policy. If you are a school that has subscribed to KiddieCove, your school’s acceptance of our Terms of Service also constitutes acceptance of this policy on behalf of the school and its staff.
Our Commitment to Your Child’s Privacy Policy
Children’s data carries special weight. A student’s attendance record, pickup history, classroom performance, and location are not ordinary commercial data — they are part of a child’s life and safety. We treat them accordingly.
KiddieCove is built on four privacy principles:
Collect only what we need. We never collect data that is not directly necessary for delivering school management and child safety features.
Use data only as we say. We never sell student or child data. We never use children’s information for advertising or profiling.
Protect it seriously. All data transmitted through KiddieCove is encrypted in transit and at rest. Access is strictly role-based.
Give you control. Parents, schools, and users have the right to access, correct, and request deletion of their data.
Information We Collect
Student and Child Data
To manage school operations and ensure child safety, KiddieCove collects the following information about enrolled students, provided by the school:
- Full name, date of birth, and class/section
- Student ID or roll number
- Attendance records (present, absent, late)
- Pickup and drop-off records, including time, date, and name of authorised guardian
- Emergency contact information
- Profile photograph (optional, uploaded by school)
- Fee payment history
We do not collect sensitive health information, national identity numbers, or home addresses of students unless your school specifically enables a feature that requires this, in which case the school is notified and consents as the data controller.
Parent and Guardian Data
When a parent or guardian registers on or is invited to the KiddieCove platform by their child’s school, we collect:
- Full name and relationship to the student
- Mobile phone number (used for app login and notifications)
- Email address (optional, for account recovery)
- Device information (for app authentication)
- CNIC number (only where required for JazzCash/EasyPaisa payment verification, collected and processed directly by the payment provider, not stored by KiddieCove)
School Administrator and Teacher Data
For users with administrator or teacher roles, we collect:
- Full name and staff ID
- Email address and mobile number
- Role and department
- Login activity logs (for account security)
- Content created within the platform (announcements, chat messages, attendance entries)
Device and Usage Data
When you use the KiddieCove app or website, we automatically collect:
- Device type, operating system, and app version
- IP address and approximate city-level location (not GPS-precise)
- Login timestamps and session duration
- Feature usage patterns (which modules you use and how often)
This data is used to improve platform performance, diagnose technical issues, and ensure platform security. It is not used to build individual behavioural profiles.
Payment Information
KiddieCove facilitates school fee collection through JazzCash and EasyPaisa integrations. KiddieCove does not store your full payment credentials, card numbers, or wallet PINs. All payment transactions are processed directly by JazzCash and EasyPaisa, which operate under State Bank of Pakistan (SBP) regulations and their own privacy frameworks.
KiddieCove stores:
- Fee payment status (paid, pending, overdue)
- Transaction reference numbers
- Payment timestamps and amounts
This information is used to generate fee records for schools and receipts for parents.
GPS and Location Data
KiddieCove’s school bus tracking feature uses real-time GPS data. Specifically:
- Bus/vehicle GPS data is collected from GPS hardware installed on school transport and transmitted to the KiddieCove platform.
- Student boarding/alighting events are recorded when a student scans in or out of the bus.
- Parent app location is NOT collected by KiddieCove. The parent sees the bus location; KiddieCove does not track the parent’s device location.
GPS data is retained for 30 days for safety audit purposes and then automatically deleted. Schools may request extended retention for specific compliance purposes.
How We Use Your Information
We use the data we collect exclusively to provide and improve the KiddieCove platform:
- School operations: Attendance management, fee tracking, class updates, report generation
- Child safety: Real-time bus tracking, authorised pickup verification, instant parent notifications
- Communication: Parent-teacher messaging, school announcements, emergency alerts
- Platform security: Detecting unauthorised access, preventing fraud, maintaining system integrity
- Product improvement: Analysing anonymised, aggregated usage patterns to improve features
- Customer support: Diagnosing and resolving technical issues reported by schools or parents
- Legal compliance: Meeting obligations under Pakistan’s PECA 2016, the proposed Personal Data Protection Bill (PDPB), and applicable SBP payment regulations
We do not use student or child data for any advertising, marketing, or profiling purpose — ever.
How We Share Your Information
KiddieCove does not sell your data. We share data only in the following limited circumstances:
Within the platform as designed. A teacher can see their class students’ attendance. A parent can see their own child’s data. A school administrator can see school-wide data. Data is not shared across schools.
With payment processors. When fee payments are made via JazzCash or EasyPaisa, the minimum necessary information is shared with those processors to complete the transaction.
With authorised service providers. We use a small number of third-party service providers (hosting, SMS notification, push notification services) who process data on our behalf under strict contractual data protection obligations. These providers do not have permission to use your data for their own purposes.
For legal compliance. We may disclose data when required by Pakistani law, a court order, or government authority with lawful jurisdiction. We will notify affected users of such requests where legally permitted to do so.
In a business transfer. If KiddieCove is acquired by or merges with another company, user data would transfer as part of that transaction. We will notify users before their data is transferred and a different privacy policy applies.
Data Security and Protection
We take the security of school and student data seriously and implement the following measures:
- Encryption in transit: All data between your device and KiddieCove servers is encrypted using TLS 1.2 or higher.
- Encryption at rest: Student records, GPS logs, and payment records are encrypted at rest on our servers.
- Role-based access control (RBAC): Teachers can only access data for their own students. Admins access school-level data only. No user can access another school’s data.
- Two-factor authentication: Available for all school administrator accounts and strongly recommended.
- Audit logging: All data access and modification events are logged for security review.
- Regular security reviews: Our infrastructure undergoes regular security assessments.
Despite these measures, no digital system can guarantee absolute security. In the event of a data breach that affects your personal information, we will notify affected users and the relevant Pakistani authorities within the timeframes required by law.
Children’s Privacy Policy: Our Special Commitment
KiddieCove is designed to be used by schools — not directly by children. Students do not create accounts or directly interact with the KiddieCove platform. Student data is entered and managed by schools, who act as the data controller for their students’ information.
Age-appropriate data handling:
- We do not knowingly collect personal data directly from children under 13.
- If a school inadvertently provides data in a way that creates a direct data relationship with a minor, we will work with the school to remove that data upon request.
- Student data is never used for advertising, content personalisation, or profiling.
- Student records are visible only to that student’s school staff and parents — never to other parents or students.
If you are a parent who believes your child’s data has been collected or used in a way that violates this policy, please contact us immediately at [email protected]. We will investigate and respond within 7 business days.
GPS and Location Data: Specific Notice
Because KiddieCove’s bus tracking feature handles real-time location data for school vehicles — and indirectly for students on those vehicles, we apply additional protections:
- GPS tracking is active only during designated school transport hours. Schools configure active tracking windows; the system does not track buses 24/7.
- Bus location data is visible only to that school’s administrators and to parents of students assigned to that bus route.
- Historical GPS logs are automatically purged after 30 days.
- KiddieCove does not share GPS data with any third party for any purpose beyond service delivery.
- Schools are responsible for ensuring appropriate signage and parental consent is in place as required by their institutional obligations.
Payment Data: Specific Notice
KiddieCove facilitates but does not directly process financial transactions. This means:
- KiddieCove never stores full payment wallet credentials, PINs, or account passwords.
- All transactions are processed by JazzCash or EasyPaisa under their own security and regulatory frameworks governed by the State Bank of Pakistan (SBP).
- If you have a concern about a specific payment transaction, the primary contact is your payment provider. KiddieCove can provide payment reference numbers and status records to assist with disputes.
- Fee records (amounts, dates, status) are retained for 7 years as required by standard financial record-keeping obligations applicable to schools in Pakistan.
Your Rights and Choices
Depending on your relationship with KiddieCove and applicable Pakistani law, you have the following rights:
Right to Access. You may request a copy of the personal data KiddieCove holds about you or your child.
Right to Correction. If any data is inaccurate, you may request it be corrected. For student records, correction requests should be directed to your school, who are the data controller.
Right to Deletion. You may request deletion of your personal data. Note that certain data may need to be retained for legal or financial compliance obligations (for example, fee payment records). For student data, deletion is managed through your school.
Right to Withdraw Consent. Where processing is based on consent (for example, optional profile photographs), you may withdraw consent at any time.
Right to Notification. In the event of a data breach affecting your personal information, we will notify you as required by Pakistani law.
How to exercise your rights: Email [email protected] with your name, school name, and the specific right you are exercising. We will respond within 10 business days.
Data Retention
We retain data for as long as necessary to provide our services and meet legal obligations:
| Data Type | Retention Period |
|---|---|
| Active student records | Duration of school’s active subscription |
| Attendance and academic records | 3 years from the academic year of creation |
| GPS/location logs | 30 days (rolling) |
| Payment records and fee history | 7 years (financial compliance) |
| Parent and teacher account data | Duration of active account + 12 months |
| Chat and communication logs | 1 year from message date |
| Usage/device logs | 90 days |
| Security/audit logs | 2 years |
When a school ends its KiddieCove subscription, the school’s data is retained for 90 days to allow data export, then permanently deleted unless a legal hold applies.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time as the platform evolves or applicable laws change. When we make a significant change:
- We will update the “Last updated” date at the top of this page.
- We will send a notification to school administrators via in-app alert and email.
- For changes that materially affect how we handle children’s data, we will require schools to re-confirm acceptance before the changes take effect.
We encourage you to review this policy periodically. Continued use of KiddieCove after a policy update constitutes acceptance of the revised terms.
Contact Us
If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how your data has been handled, please contact our Privacy team:
KiddieCove Privacy Team Email: [email protected] Website: kiddiecove.io/contact
We aim to respond to all privacy enquiries within 10 business days.
For urgent child safety or data breach concerns, please mark your email URGENT: Privacy and we will prioritise your request.
Frequently Asked Questions About KiddieCove Privacy Policy
Q1. Does KiddieCove sell student data?
No. KiddieCove does not sell student data, child data, or any personal data to third parties. Student information is used solely to provide school management and child safety features to the school and family that enrolled the student. This applies permanently — not just while you are an active user.
Q2. Can my child’s teacher see all the data KiddieCove has on my child?
Teachers can see data relevant to their teaching role: their class’s attendance, scheduled announcements, and parent-teacher chat messages. Teachers cannot see GPS tracking logs, fee payment records, or data from other classes. Access is strictly role-based, configured by the school administrator.
Q3. Is my child’s real-time location visible to anyone other than me?
Bus GPS tracking data is visible only to school administrators and to the parents of students assigned to that specific bus route. No other parents, teachers, or third parties can see your child’s bus location. KiddieCove does not share GPS data with any external party.
Q4. What happens to my data if my school stops using KiddieCove?
When a school ends its subscription, all school data — including student records, parent accounts, and communication logs — is retained for 90 days to allow the school to export records. After 90 days, the data is permanently and irreversibly deleted from KiddieCove systems. Payment records are retained for 7 years as required by financial compliance regulations.
Q5. Is KiddieCove compliant with Pakistan’s data protection laws?
KiddieCove operates in compliance with Pakistan’s Prevention of Electronic Crimes Act (PECA) 2016 and the data handling principles of the Personal Data Protection Bill (PDPB) currently before the National Assembly. We also align with internationally recognised data protection principles including data minimisation, purpose limitation, and storage limitation, as these reflect best practice regardless of jurisdiction.
Q6. How does KiddieCove handle JazzCash and EasyPaisa payment data?
KiddieCove does not store your JazzCash or EasyPaisa credentials, PINs, or account details. Payments are processed directly by the payment providers, which are regulated by the State Bank of Pakistan (SBP). KiddieCove only stores the transaction outcome (paid/pending/failed), the transaction reference number, the amount, and the date — the minimum necessary to maintain fee records for schools and parents.
Q7. Can I request that my child’s data be deleted?
Yes. Parents and guardians may request deletion of their child’s data by emailing [email protected]. Because schools are the primary data controllers for student records, we will coordinate the deletion request with the relevant school. Note that payment records may be retained for up to 7 years for financial compliance purposes even after other data is deleted.
Q8. Does KiddieCove use my data to show me advertisements?
No. KiddieCove does not use any user data — including student data, parent data, or teacher data — for advertising or marketing purposes, whether inside or outside the platform. We do not share data with advertising networks.
Q9. What security measures protect student data on KiddieCove?
Student data on KiddieCove is protected by TLS encryption in transit, encryption at rest, role-based access control, audit logging, and regular security assessments. School administrators can further protect accounts with two-factor authentication. In the event of a security incident affecting student data, we will notify affected schools and parents as required by Pakistani law.
Q10. Who do I contact if I have a privacy concern?
Email our Privacy team at [email protected]. We respond to all privacy enquiries within 10 business days. For urgent matters involving child safety or a suspected data breach, mark your email URGENT: Privacy.