Privacy Policy

Last updated: 23 May 2026

SchoolDesk helps schools run attendance, fees, announcements, and parent communication through Telegram and a web dashboard. This policy explains what personal data we handle, why, and the choices and rights available to schools, staff, guardians, and students.

1. Who we are

SchoolDesk is operated by SchoolDesk Labs ("SchoolDesk", "we", "us"). We provide a Telegram-first school management platform to early-childhood centres (tadika) and primary schools, primarily in Malaysia. Our processing of personal data is governed by Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable local regulations.

2. Data we collect

Provided by the school

• Student records — name, class/year, enrolment status, attendance, and fee/invoice history.
• Guardian details — name, relationship to student, and contact information used to issue the linking PIN.
• Staff accounts — name, email, and role for dashboard access.

Collected through use of the service

• Telegram identifiers — the Telegram user ID and profile name of a guardian who links to the bot, so we can deliver messages to the right person.
• Messages & intents — the content of messages sent to the bot and the classified intent (e.g. "report absence"), used to respond and to maintain a school activity log.
• Payment metadata — invoice amounts, status, and references. Card and bank credentials are entered directly with our payment processors; SchoolDesk does not store full card numbers or banking credentials.
• Technical data — IP address, device/browser type, and basic logs needed to operate and secure the service.

3. How we use data

• To provide the core service: attendance, billing, announcements, and guardian communication.
• To classify and respond to messages in Bahasa Melayu and English.
• To process payments and reconcile invoices.
• To secure the platform, prevent abuse, and troubleshoot issues.
• To communicate service, billing, and support matters with schools and staff.
• To comply with legal obligations.

We do not sell personal data, and we do not use student data for advertising.

4. Telegram & the bot

Guardians interact with SchoolDesk through Telegram. When using Telegram, the messages you send pass through Telegram's own infrastructure and are subject to Telegram's Privacy Policy. We only share with Telegram the messages our bot needs to send back to you. The bot is authenticated so that updates are processed only from verified Telegram sources.

5. Service providers

We rely on a small number of trusted providers who process data on our behalf under appropriate safeguards:

• Hosting & database — cloud infrastructure located in Singapore, with data encrypted in transit and at rest.
• Telegram — message delivery to guardians.
• Payments — FPX (Malaysia's licensed online-banking rail) and Stripe for card and FPX processing. Funds settle to the school's own registered bank account; SchoolDesk never holds school funds.
• AI message classification — message text is sent to an AI provider to determine intent. We minimise what is sent and do not use it to build advertising profiles.

6. Sharing & disclosure

We disclose personal data only:

• to the school that controls the relevant records;
• to the service providers listed above, to operate the platform;
• where required by law, regulation, or valid legal process; and
• in connection with a business transfer (e.g. merger or acquisition), subject to this policy.

7. Data retention

We retain personal data for as long as a school maintains an active account, and as needed to meet legal, accounting, and audit obligations. When a school closes its account, we delete or anonymise its data within a reasonable period, except where retention is required by law. Schools may request export of their data at any time — there is no lock-in.

8. Security

• Data is encrypted in transit (TLS) and at rest.
• Access is restricted on a least-privilege basis, with school-level isolation enforced at the database layer.
• Payment, payout, and webhook events are signature-verified.
• We monitor for, and respond to, security incidents; affected schools will be notified in line with our legal obligations.

No system is perfectly secure, but we work continuously to protect the data entrusted to us. (SOC 2 Type II is in progress.)

9. Your PDPA rights

Subject to the PDPA, individuals may request to:

• access the personal data we hold about them;
• correct inaccurate or incomplete data;
• withdraw consent or limit certain processing; and
• request deletion where applicable.

Because the school is usually the controller of student and guardian data, please direct requests about that data to your school in the first instance. We will assist the school in fulfilling valid requests. For account or website data we control, contact us using the details below.

10. Children's data

SchoolDesk processes student data on behalf of schools. Schools are responsible for obtaining any consent required from parents or guardians under applicable law before providing student information to us. We handle student data only to deliver the service and never for marketing.

11. International transfers

Our primary infrastructure is in Singapore, and some service providers may process data outside Malaysia. Where data is transferred across borders, we take reasonable steps to ensure it remains protected to a standard consistent with the PDPA.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to schools, and the "Last updated" date above will always reflect the current version.

13. Contact

Questions about this policy or about how your data is handled? Contact our privacy team at admin@schooldesk.my.

See also our Terms of Service.