Your data, protected.

Effective Date: 9 June 2025 | Last Updated: 9 June 2025

This Privacy Policy explains how MindSync Solutions collects, uses, stores, shares, and protects your personal information. By accessing or using the Platform you agree to the practices described herein. If you do not agree, please discontinue use immediately.

1. Introduction and Scope

MindSync Solutions ("MindSync", "we", "us", "our") operates an integrated educational technology ecosystem comprising MindSync SIMS (school information management), MindSync LMS (learning management), TutorSmart (1:1 tutoring), Coursify (AI content conversion), MindSync Magazine (parent newsletter & events), School Staffing (AI teacher recruitment), MindSync Coach (AI classroom suite), MindSync Sport (athletic operations), and associated web and mobile applications (collectively, the "Platform").

This Privacy Policy applies to all users of the Platform worldwide, including school administrators, teachers, students, parents, tutors, and institutional partners. It covers all personal data processed in connection with the Platform, regardless of the country in which you are located.

Where you access the Platform on behalf of an educational institution, the institution is responsible for ensuring this Policy is communicated to all relevant users, including obtaining parental or guardian consent for minor students where required by applicable law.

2. Who We Are — Our Legal Entities

MindSync Solutions operates through entities registered in multiple jurisdictions. Depending on your location, the relevant data controller or operator is:

For all privacy enquiries, data subject requests, or complaints, contact us at:

3. Applicable Privacy Laws and Compliance Framework

MindSync Solutions is committed to complying with all applicable privacy and data protection laws in the jurisdictions in which it operates. Our compliance framework encompasses:

Where the laws of multiple jurisdictions apply, we apply the standard that affords the greatest protection to users, unless doing so would conflict with a directly applicable mandatory legal obligation.

4. Information We Collect

4.1 Account and Registration Information

• Full name, email address, phone number, and date of birth
• Role (administrator, teacher, student, parent/guardian, tutor)
• Institution name, address, and contact details
• Username and hashed password; profile photograph (optional)
• Proof of institutional affiliation where required for verification

4.2 Educational and Academic Records

This category is subject to heightened protection under FERPA, NDPR, Ghana DPA, and equivalent laws:

• Enrolment records, timetables, class rosters, and attendance logs
• Academic grades, assessment scores, progress reports, and learning outcomes
• Course materials, assignments, quizzes, and submissions uploaded by educators or students
• AI-generated learning recommendations, personalised feedback, and adaptive learning pathways
• Behavioural engagement data (time-on-task, completion rates, interaction frequency)

4.3 Children's Data (Under 18)

The Platform is deployed in school environments serving students of all ages. We apply the following graduated protections:

4.4 Communication Data

• In-platform messages, announcements, and notifications
• Support tickets and customer service correspondence
• Feedback, surveys, and responses to service communications

4.5 Technical and Usage Data

• IP address, browser type, operating system, device identifiers
• Log data, clickstream data, pages visited, and features accessed
• Session duration, error logs, and crash reports
• Cookie and similar tracking technology data (see Section 8)

4.6 Payment and Billing Data

• Billing name, address, and invoice records
• Payment card data is processed exclusively by PCI-DSS compliant third-party payment processors; MindSync does not store card numbers on its servers

4.7 Sensitive Information

MindSync does not intentionally collect sensitive personal information (e.g., health data, racial or ethnic origin, religious beliefs, biometric data) except where explicitly required to deliver a specific service, in which case separate consent will be obtained. If you believe such data has been inadvertently submitted, contact hello@mindsync.solutions immediately.

5. How We Use Your Information

5.1 Platform Operations

• Creating and managing user and institutional accounts
• Delivering all Platform services including SIMS, LMS, AI tools, and the parent portal
• Facilitating communication between students, educators, parents, and administrators
• Processing payments and managing subscriptions

5.2 AI and Personalisation

• Powering AI-driven course creation, personalised tutoring, and adaptive learning recommendations
• Generating educator analytics on student engagement, performance, and learning outcomes
• Improving AI model accuracy using aggregated, anonymised data — student-identifiable data is never used to train general commercial AI models without explicit institutional consent

5.3 Safety, Security, and Compliance

• Identity verification, fraud prevention, and unauthorised access detection
• Enforcement of our Terms and Conditions
• Compliance with applicable laws, court orders, and regulatory requirements
• Protecting the vital interests of users, particularly minors, in emergency situations

5.4 Service Improvement

• Internal analytics and product development using aggregated or anonymised data
• Diagnosing technical issues and improving Platform performance and reliability

5.5 Marketing and Communications

• Sending product updates, feature announcements, and promotional materials — only where you or your institution has opted in
• Notifying you of material changes to our services or these policies

You may withdraw consent for marketing at any time by clicking 'unsubscribe' in any email or writing to hello@mindsync.solutions. Withdrawal does not affect the lawfulness of prior processing.

6. Legal Basis for Processing

Where the GDPR or equivalent laws require a lawful basis, we rely on the following:

7. How We Share Your Information

MindSync does not sell, rent, or trade personal data. We share information only in the circumstances described below.

7.1 With Educational Institutions

Administrators and authorised staff of your institution may access data relating to users within their institutional account. The scope of access is governed by the institution's own access controls and its agreement with MindSync.

7.2 With Service Providers (Data Processors)

We engage trusted third-party processors to support Platform operations, including:

• Cloud hosting and infrastructure providers (data stored in Australian and/or internationally recognised data centres with appropriate safeguards)
• AI and machine learning service partners operating under strict data processing agreements
• Payment processors (PCI-DSS compliant)
• Email, SMS, and push notification service providers
• Analytics and monitoring tool providers

All processors are bound by contractual obligations to process data only on our instructions and to maintain security measures meeting at minimum the standards required by applicable law.

7.3 Cross-Border Transfers

Where personal data is transferred outside the country in which it was collected, we ensure adequate safeguards are in place:

7.4 FERPA Disclosures

Where MindSync processes education records subject to FERPA on behalf of a US-connected institution, we act as a 'school official' with a legitimate educational interest. We will not re-disclose such records except as permitted by FERPA and will not use them for any purpose other than providing the contracted educational services.

7.5 Legal and Regulatory Disclosures

We may disclose information where required by law, court order, or regulatory authority in Ghana, Nigeria, Australia, or any other applicable jurisdiction, or where necessary to protect the rights, safety, or property of MindSync, our users, or the public.

7.6 Business Transfers

In the event of a merger, acquisition, restructure, or sale of assets, personal data may be disclosed to or transferred to the relevant parties, subject to equivalent privacy protections. Users will be notified in advance of any material transfer of their data.

8. Cookies and Tracking Technologies

We use cookies and similar technologies on our Platform. These are categorised as follows:

You may manage cookie preferences through your browser settings or our in-Platform cookie consent manager. Withdrawing consent for non-essential cookies will not affect your ability to use core Platform features but may affect personalisation and analytics functionality.

We do not use cookies or tracking technologies to build advertising profiles for students or to share student behavioural data with advertising networks.

9. Data Retention

We retain personal data for the minimum period necessary for the purposes for which it was collected, subject to any legal obligations requiring longer retention.

Upon expiry of a retention period, data is securely deleted or anonymised in accordance with our data destruction procedures.

10. Data Security

MindSync implements technical and organisational security measures proportionate to the risks involved in processing personal data:

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest using AES-256 or equivalent
• Role-based access controls (RBAC) limiting data access to authorised personnel with a demonstrated need
• Multi-factor authentication (MFA) available for administrator accounts
• Regular vulnerability assessments and penetration testing
• Staff training on data protection and security awareness
• Incident response and business continuity plans

Despite these measures, no system is completely immune from security threats. In the event of a personal data breach that is likely to result in a risk to rights and freedoms:

11. Artificial Intelligence and Automated Decision-Making

The Platform incorporates AI features including personalised learning pathways, AI-powered course generation, and intelligent tutoring. The following principles govern our use of AI:

• AI features analyse learning behaviour, performance data, and engagement patterns to generate personalised recommendations and content suggestions
• No automated decision will produce legal or similarly significant effects on a student (e.g., academic qualification, grade, or exclusion) without review and confirmation by a qualified human educator
• Under GDPR Article 22 (applicable to EU/UK users), you have the right not to be subject to solely automated decisions with significant effects. To invoke this right, contact hello@mindsync.solutions
• Student-identifiable data will not be used to train AI models for purposes outside the Platform without explicit institutional consent
• AI-generated content is advisory. MindSync does not warrant its accuracy, completeness, or fitness for any particular educational context
• Institutions may request that AI personalisation features be disabled for their account at any time

12. Children's Privacy — Detailed Protections

Given that our Platform is used in K–12 and higher education environments, MindSync applies comprehensive protections for users under 18:

12.1 COPPA Compliance (Children Under 13)

• MindSync does not market or direct the Platform to children under 13 independently of their educational institution
• We do not knowingly collect personal data from children under 13 without verifiable parental or guardian consent obtained by the educational institution
• Personal data of children under 13 is used solely to provide educational services and is never used for advertising, profiling, or disclosed to third parties for non-educational purposes
• Parents may request access to, correction of, or deletion of their child's data through their educational institution or by contacting hello@mindsync.solutions

12.2 GDPR Article 8 (Children Under 16 in the EU/UK)

Where services are directed at children under 16 in the EU/UK, processing based on consent requires parental or guardian authorisation, to be obtained by the institution.

12.3 General Protections for All Minors (Under 18)

• No behavioural advertising targeting any user under 18
• No sale or disclosure of student data for commercial purposes
• Minimum data collection principles strictly applied to student accounts
• Institutions retain primary responsibility as data controllers for their students' data

13. FERPA — Education Records

Where MindSync processes education records on behalf of institutions that receive US federal funding or are otherwise subject to FERPA:

• MindSync acts as a 'school official' with a legitimate educational interest as defined under FERPA
• Education records will not be disclosed to third parties without the prior written consent of the eligible student (or parent/guardian if under 18), except as expressly permitted by FERPA
• MindSync will not use education records for any purpose other than providing contracted educational services
• Students and eligible parents may submit FERPA-related access and correction requests to hello@mindsync.solutions; we will coordinate with the institution to fulfil such requests
• In the event of a conflict between FERPA and other applicable laws, we will consult with the institution and apply the most protective standard that is legally permissible

14. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data. We will process requests within 30 days (extendable by a further 60 days for complex requests with notice):

To exercise any right, submit a written request to hello@mindsync.solutions with sufficient information to identify you and your request. We may require proof of identity. If you are unsatisfied with our response, you may lodge a complaint with the relevant supervisory authority:

15. Third-Party Links and Integrations

The Platform may integrate with or contain links to third-party services (e.g., video conferencing providers, digital content repositories, payment gateways). This Privacy Policy does not govern the data practices of those third-party services. We encourage you to review their privacy policies. MindSync accepts no responsibility for the privacy practices of third-party services.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes in law, our practices, or our services. For material changes, we will:

• Post a prominent notice on the Platform at least 30 days before the change takes effect
• Send email notification to all registered account holders
• For institutions, provide direct notice to the designated institutional administrator

Continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy. If you do not agree to the revised Policy, you must cease using the Platform and notify us to arrange account closure and data handling.

17. Contact Us

For all privacy matters — including data subject requests, complaints, reporting a potential breach, or questions about this Policy — please contact: