Privacy Policy

1. Who we are and our role

For information you give us through our website (the contact form and our AI demos), we decide how it is used, so we are responsible for it.

For information a school enters into the School Management System (about students, parents and staff), the school decides why and how it is used. We process that information on the school’s behalf and on its instructions. If you are a parent, student or staff member, your school is your main contact for questions and requests about that information; we will help the school respond.

2. Information we collect

On our website (brightcodex.com):

• Contact form: your name, email address, company, website address, project type, budget range and message. We check that your email domain can receive mail and that the website you give is reachable, and we email you a link to confirm your address. We record whether you confirmed it.
• Technical information: your IP address and basic request details, used briefly to prevent abuse (for example, limiting repeated form submissions) and to keep the site secure.
• AI demos and chat assistant: the text you type is sent to Anthropic, the provider of the Claude AI model, so it can generate a reply. Please don’t enter passwords, financial details, health information or other sensitive data.

In the School Management System (sms.brightcodex.com):

• School and account details: school name, the names, email addresses, phone numbers and roles of owners, principals, coordinators, accountants and teachers.
• Student records: names, class and section, admission or slip numbers, attendance, fee and payment records, exam marks and results, and question papers written by teachers.
• Parent or guardian details: name, phone number and email address, linked to their child.
• Staff records: attendance, leave and payroll information.
• Usage and security records: sign-in activity and actions taken in the system.

If a school turns on WhatsApp messaging:

• The phone numbers of the people the school messages (such as parents and staff), the content of the messages the school sends (for example notices, fee reminders or result announcements), and delivery status (sent, delivered, read or failed).

Cookies and local storage: our website does not use advertising or analytics cookies. Signed-in areas use essential cookies and on-device storage that are needed to keep you signed in and to let the School Management System work offline (for example, attendance marked without a connection is held on the device until it can sync).

3. How we use information

• To provide, operate, secure and support the Services, including sending the messages and notices a school asks the system to send.
• To respond to enquiries and to confirm that an email address is genuine.
• To prevent spam, fraud and abuse.
• To fix problems and improve the Services.
• To meet legal obligations.

We do not sell personal information, and we do not use school, student or parent data for advertising.

4. WhatsApp Business Platform

When a school enables WhatsApp messaging, messages are sent through the WhatsApp Business Platform, which is operated by Meta. To deliver a message, Meta receives the recipient’s phone number and the message content, and it handles that information under its own terms and privacy policies:

• WhatsApp Business Terms
• WhatsApp Privacy Policy
• Meta Privacy Policy

• We only send messages that a school asks the system to send. We do not use phone numbers we hold for a school to promote our own products.
• Schools are responsible for having permission from the people they message. Messages should only go to people who have agreed to receive them.
• Anyone can ask the school, or us, to stop sending WhatsApp messages to their number. We will stop, and remove the number from messaging.
• Records of messages sent and their delivery status are kept in the school’s account so that staff can see what was sent.

5. Who we share information with

We share personal information only in these situations:

• With the school, for the data that belongs to that school.
• With service providers that help us run the Services, under appropriate confidentiality obligations: cloud hosting and network providers (such as Vercel and Cloudflare, and the host of our API servers), our database provider, our email delivery provider, Anthropic (for the AI demos on our website only), and Meta (only when a school enables WhatsApp).
• Where the law requires it, or where it is necessary to protect the rights, safety or security of our users, the public or Brightcodex.
• If Brightcodex is reorganised, sold or merged, in which case the information may transfer to the new owner, who must honour this policy.

We do not sell personal information or share it for third-party advertising.

6. Where information is stored

Our providers operate in several countries, so information may be processed outside Pakistan and outside the country you live in. We use reputable providers and take steps to protect information wherever it is processed.

7. How long we keep information

• Website enquiries are kept for as long as they are needed to respond and for our business records. Enquiries that turn out to be spam are deleted.
• School data is kept while the school’s account is active. When a school closes its account or asks us to delete its data, we delete it from our live systems within 30 days, and it disappears from backups as they rotate out.
• We may keep limited records for longer where the law requires, or where needed to resolve disputes and enforce our agreements.

8. How we protect information

• Connections to our Services are encrypted with HTTPS.
• Role-based access, so each person sees only what their job needs. Parents see only their own children.
• Each school’s data is kept separate from every other school’s, and this separation is covered by automated tests.
• Access to systems is limited to authorised staff.

No online service can be guaranteed completely secure. If you think your account has been compromised, tell us straight away at info@brightcodex.com.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict how it is used, and to withdraw consent you have given.

• Website enquiries: email us from the address you used and we will act on your request.
• School data (students, parents, staff): contact your school first, as it controls that information. You can also email us and we will pass your request to the school and help it respond.
• We reply to requests within 30 days.

10. Data deletion instructions

To ask us to delete your personal information:

1. Email info@brightcodex.com from the email address linked to your account or enquiry, with the subject “Data deletion request”.
2. Tell us your name, the school or organisation involved and, if you want a WhatsApp number removed, the phone number.
3. We will confirm it is you, delete the information from our live systems within 30 days, and confirm by email once done.

Parents, students and staff can also make the request through their school. Some records may need to be kept where the law requires it, or because they are the school’s own records (for example fee records); we will tell you if that applies.

To stop WhatsApp messages only, tell your school or email us the number and we will stop sending to it.

11. Children

Our website is not directed at children. Student information in the School Management System is entered by schools, who are responsible for having the authority to do so. The parent app is meant for parents and guardians. We do not knowingly collect personal information directly from children.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed. If a change is significant, we will tell schools by email or in the product.

13. Contact us

• Brightcodex, Karachi, Pakistan
• Email: info@brightcodex.com
• Phone / WhatsApp: +92 319 2056750