Last updated 10 July 2026
Data Protection and Privacy Policy
This Data Protection and Privacy Policy explains how Bookmoth collects, uses, stores, and shares personal data when schools, administrators, teachers, students, and parents use our platform. We designed Bookmoth for African secondary schools and take the protection of learner and staff information seriously.
1. Who we are
Bookmoth operates an education technology platform that helps schools run assessments, track topic mastery, support exam readiness, and manage school operations.
For most school deployments, the school is the data controller (or equivalent) for student and staff records it enters into Bookmoth. Bookmoth acts as a processor / service provider that processes that data to deliver the Service under the school’s instructions and this Policy.
2. Personal data we process
Depending on how your school uses Bookmoth, we may process: account identifiers (name, email, role, school affiliation); school profile and billing details; class, subject, and curriculum assignments; assessment attempts, answers, scores, feedback, and mastery metrics; parent or guardian contact details where provided; support communications; and technical logs such as device type, IP address, approximate location derived from IP, and usage events needed for security and reliability.
We do not require schools to upload government ID numbers unless a school chooses to store such fields in notes or custom content. Please avoid entering unnecessary sensitive data.
3. Purposes of processing
We process personal data to: create and secure school accounts; deliver assessments, grading workflows, and learning analytics; generate reports and readiness insights; provide customer support; process subscriptions and payments; prevent abuse and protect the platform; improve product performance; and meet legal obligations.
Where AI features are used, relevant curriculum or assessment context may be processed to generate draft questions or insights. Schools should review AI outputs before use with learners.
4. Legal bases and school responsibilities
Schools are responsible for ensuring they have a lawful basis to upload and process learner and staff data in Bookmoth, including any parental consent, education-law authorisation, or contractual necessity required in their jurisdiction.
Bookmoth processes school-controlled data to perform the Service contract, operate the platform securely, and comply with applicable law. Where we process data for our own limited purposes (for example aggregated product analytics or account security), we do so on legitimate interests balanced against user rights, or consent where required.
5. Sharing and subprocessors
We do not sell personal data. We may share data with: authorised users within the same school according to role permissions; payment providers for subscription billing; infrastructure, email, and AI providers that process data on our instructions under confidentiality and security obligations; and authorities when required by law or to protect rights, safety, or the integrity of the Service.
International transfers may occur when cloud or support providers are located outside your country. We take steps appropriate to the transfer context, including contractual safeguards where required.
6. Retention
We retain personal data for as long as the school account remains active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal, tax, or audit requirements.
After account closure or a verified deletion request from an authorised school administrator, we delete or anonymise personal data within a reasonable period, except where retention is required by law or for legitimate security records.
7. Security
We implement administrative, technical, and organisational measures designed to protect personal data, including access controls, encrypted transport, role-based permissions, and monitoring for suspicious activity.
No method of transmission or storage is completely secure. Schools should use strong passwords, limit administrator access, and report suspected incidents promptly to hello@bookmoth.com.
8. Children’s data
Bookmoth is used by secondary-school learners through school-managed accounts. We do not knowingly market directly to children independent of their school.
Schools must configure and supervise student accounts appropriately and ensure guardians are informed where local law requires notice or consent for educational technology use.
9. Your rights and choices
Subject to applicable law, individuals may request access, correction, deletion, restriction, or portability of personal data, or object to certain processing. Students and parents should typically contact their school first, as the school controls most education records in Bookmoth.
Authorised school administrators may update many records directly in the platform. Privacy requests to Bookmoth can be sent to hello@bookmoth.com. We may need to verify identity and authority before acting.
10. Cookies and similar technologies
We use essential cookies and similar technologies for authentication, security, preference storage (such as language), and basic analytics needed to operate and improve the Service.
You can control cookies through browser settings; disabling essential cookies may prevent login or core features from working.
11. Policy updates and contact
We may update this Policy to reflect product, legal, or operational changes. The “Last updated” date shows the latest revision. Material changes will be highlighted through the Service or by email where appropriate.
For privacy questions or requests, contact hello@bookmoth.com. For general platform support, use the same address or your school’s Bookmoth administrator.