Privacy policy
Draft prepared for legal review. Not in force.
Who we are
Ilmora is provided by CRESTVIBE LTD (Registered in England & Wales, Companies House no. 17397464), 3 Warden Hill Gardens, Luton, LU2 7AH, United Kingdom. Contact: info@crestvibe.com.
Two kinds of information
Institution records (students, guardians, staff, attendance, marks, fees) are entered by the institution. The institution decides what is collected and why; we process it on its behalf to provide the service. Questions about those records should go to the institution first.
Account information (your name, email, sign-in and security settings, devices you're signed in on) is held by us to run your account.
What the service stores
- Student details the institution enters: name, admission number, class, date of birth and gender (optional), guardians and their phone numbers or email addresses.
- Attendance, leave requests, marks, results and report cards, certificates.
- Fee invoices, payments and receipts.
- Announcements and notifications, and whether they were read.
- An activity log of important changes, with who made them.
- For sign-in: email address, a hashed password, two-step settings, and session details (browser, IP address, last active).
National identity numbers are optional and only visible to staff with a specific permission.
How it's used
Only to provide the service to the institution and its families: showing records to the people the institution allows, sending the notifications they've chosen, and keeping the service secure. We don't sell personal information or use it for advertising.
Who else handles it
The service runs on hosting, database and email providers. [Names, locations and safeguards to be confirmed before launch: web hosting, API hosting, database hosting, email delivery.] They process data only to run the service.
How long it's kept
For as long as the institution keeps its account. When a subscription ends, nothing is deleted automatically; the account becomes read-only. An institution can ask us to export or delete its data. [Retention periods after closure to be set with legal advice.]
Security
See the Security page for how data is separated between institutions, protected by role, and backed up.
Your choices
You can change which notifications you receive by email, see and sign out your devices, and turn on two-step sign-in. To see, correct or delete records about a child, contact the institution; we help institutions respond to such requests.
Points for the legal review
- Applicable law: Pakistan (including the Prevention of Electronic Crimes Act 2016 and any personal data protection law in force at launch) and, because the company is registered in England, UK data protection law.
- Processor terms between CrestVibe and each institution, including children's data and parental consent.
- International transfers to hosting providers.
- Retention after an account closes, and backups.