← Osubula Talks Solutions · Terms of Service
Osubula Talks Solutions ("we") provides a school fee and results management system for schools in Uganda. This policy explains what we do with data, including when a school connects its Google Drive for backups. It covers both the hosted version (app.osubulatalks.com) and the installed desktop version. We act in line with Uganda's Data Protection and Privacy Act, 2019.
Each school is the controller of its own students', parents' and staff data. We process that data on the school's behalf to run the system. Contact: osubuladan@gmail.com.
Student, parent and staff records, fee and payment records, attendance and results, entered by the school. Sign-in details for system users.
Most students are children. We process their data only for the school, to run the system. We do not use it for advertising, we do not sell it, and we do not contact students or parents ourselves. A parent who wants to see, correct or delete a child's data should ask the school first.
Hosted version. The school's data is stored on our cloud servers and the school uses the system over the internet.
Desktop version. The system is installed on a computer at the school. The school's data is stored on that computer, and other devices on the school's own network open the system through it. The desktop version works without internet. It does not send school data to us or to anyone else, and nothing is synchronised with the hosted version.
When a school activates the desktop version with its activation code, the program contacts us once and we receive only what is needed to issue the licence: the activation code, the school's name, a machine identifier that identifies that computer, the computer's name, and the internet address the request comes from. We also keep the licence record (type, expiry date for yearly licences, and when it was activated). The same happens when a school enters a renewal code. After activation the program does not send us any student, parent, staff, fee or results data.
The desktop version saves backup files to a folder on the school's computer, or on a drive the school chooses, such as a USB drive. These backups belong to the school and stay under the school's control. We never receive them, so we cannot restore or recover data that is lost with the computer and its backups. The school decides who may access the computer and the backup drive, and how long backups are kept. A school that loses a computer should treat its data as exposed and change the passwords it used.
If a school administrator chooses to connect Google Drive, we ask for two things only: the Google account email address (to show which account is connected) and the "drive.file" permission, which lets the app see and manage only the files and folders it creates itself. We cannot see, open or change any other file in the school's Drive.
The app creates a folder in the school's own Drive and saves encrypted backup files there. The backups are encrypted before they leave our servers; they can only be read with the system's keys. We keep the connection token in encrypted form and use it only to save and tidy up backup files. We do not use Google user data for advertising, we do not sell it, and we do not share it with anyone else.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
A school administrator can disconnect Google Drive at any time from the Backups page. This revokes our access and stops all new backups. Existing backup files stay in the school's Drive; the school can delete them there.
To run the hosted version we use service providers that process data for us and only for that purpose: cloud hosting and database services, email and SMS delivery, and mobile money payment services where a school has switched them on. Some of these providers store or process data on servers outside Uganda. We do not sell data and we do not share it with anyone else.
Hosted data is stored in secured databases and encrypted backups, and each school can see only its own data. If we become aware of a security incident that affects a school's data, we will tell that school without undue delay so it can act. On the desktop version, the security of the computer, its sign-ins and its backup drive is the school's responsibility.
Hosted version: we keep a school's data for as long as the school uses the system, and for 5 to 6 years after it stops, unless the school asks us earlier to delete or return it, or the law requires otherwise. After that we delete or anonymise it.
Desktop version: the data is on the school's computer, so the school decides how long to keep it and when to delete it. Licence records we hold (see above) are kept for as long as the licence exists and for the same 5 to 6 years afterwards.
You may ask the school, or us, to access, correct or delete your personal data. Write to osubuladan@gmail.com.
We may update this policy and will change the date above when we do.