This policy explains what personal data SleekJunior handles, why, and who decides what happens to it. It covers the platform itself — not what an individual school does with its own records.

1. Who decides what: schools and us

For records about students, guardians and staff, the school is the controller and we are the processor. The school decides what to collect and why; we hold and process it on the school's instructions in order to run the service.

For the accounts we issue, our billing records, and the applications submitted through our public forms, we are the controller.

If you are a parent or a member of staff and want a record corrected or removed, ask your school first — they control it. We will help them act on your request.

2. What we handle

On behalf of schools

• student records: name, date of birth, gender, class and branch, enrolment status, photo, and any medical or dietary notes the school chooses to record;
• guardian records: name, relationship, contact details, address, occupation;
• staff records: name, contact details, employment details;
• attendance, invoices, payment records, messages, announcements and class activity posts including uploaded photos.

As controller

• account details for the users a school creates: name, email, role;
• demo requests and school applications: school name, contact name, role, email, phone, branch and student numbers, and the IP address a submission came from;
• subscription and billing records;
• operational logs, including an audit trail of significant administrative actions.

3. Children's data

This platform is used by preschools and kindergartens, so most records concern young children. We treat them accordingly:

• children do not get accounts — only adults do;
• a parent sees only their own children, and a teacher only the classes they teach;
• we do not use children's data for marketing, profiling or advertising of any kind, ever;
• the school is responsible for having consent, or another lawful basis, to hold the records it enters.

4. Why we process it

• to provide the service the school subscribed to;
• to authenticate users and enforce who may see what;
• to send the notifications the service exists to send — an absence alert to a parent, an invoice to a payer;
• to take payment and keep billing records;
• to keep the platform secure and diagnose faults;
• to reply to an enquiry or an application you sent us.

We do not sell personal data. We do not use school data to train machine-learning models. We do not use it to advertise to parents.

5. Keeping schools apart

Every school operates in its own Portal, and each record is tied to the school — and to the branch — it belongs to. Access is scoped so that one school's users cannot reach another school's records, and a branch administrator cannot reach a branch they were not assigned.

6. Who else sees it

We share personal data only with:

• payment providers, where a school takes fee payments through the platform — they receive what is needed to process a payment, and handle card details directly rather than through us;
• infrastructure and email providers who host the service and deliver its notifications;
• authorities, where we are legally required to.

Our providers act on our instructions and are bound to protect the data they handle.

7. Payment details

We do not store card numbers. Where fee payment is enabled, the payment is completed with the payment provider, and we keep only the outcome and a reference so an invoice can be reconciled.

8. How long we keep it

• School Data is kept while the school's subscription is active, and for 30 days after termination so it can be exported;
• a downgrade never deletes records — branches over a plan's limit are locked read-only, and their data is retained;
• billing records are kept as long as tax and accounting rules require;
• applications submitted through our public forms are kept while they are useful to us, and deleted on request.

9. Security

Access is authenticated and role-based, administrative actions are recorded, and data is transmitted over encrypted connections. No system is perfectly secure, but we take reasonable technical and organisational measures, and we will notify affected schools without undue delay if a breach affects their data.

10. Your rights

Depending on where you live, you may have the right to access a copy of your personal data, to have it corrected, to have it deleted, to object to or restrict processing, and to complain to a regulator. Where we are the processor, direct your request to your school; where we are the controller, contact us at privacy@sleekjunior.com.

We handle this in line with the Personal Data Protection Act 2010 (Malaysia) and any other law that applies to you.

11. Cookies

We use cookies that are necessary for the service to work — keeping you signed in and protecting forms against cross-site request forgery. We do not use advertising or third-party tracking cookies.

12. Where data is held

Data is hosted with our infrastructure providers and may be processed outside Malaysia. Where it is, we take steps to ensure it remains protected to an equivalent standard.

13. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell schools about material changes.

14. Contact

Privacy questions: privacy@sleekjunior.com.