Back to Home

Privacy Policy

Detailed insight into how IMP3RIAL EDU protects, isolates, and processes your institutional data.

Last updated: 8/8/2026

1. Multi-Tenant Data Isolation (RLS)

IMP3RIAL EDU operates on a strict multi-tenant architecture powered by Supabase and PostgreSQL. Every single database table containing sensitive information utilizes Row-Level Security (RLS). This means that data isolation is enforced at the database engine level.

Your school's unique school_id binds all your students, staff, attendance logs, and financial records. It is cryptographically impossible for users from one school to query, view, or mutate the data of another school. Furthermore, all our Server Actions utilize a verifyTenantOwnership protocol to prevent Insecure Direct Object Reference (IDOR) attacks.

2. Collection of Proctoring Data (CBT Engine)

To ensure academic integrity during Computer-Based Testing (CBT), our testing lobbies monitor specific client-side behaviors. During an active exam, we track:

  • Browser Focus & Tab Switching: We utilize the browser's Visibility API and Fullscreen API to detect if a student leaves the exam environment.
  • Ambient Noise Spikes: We utilize the Web Audio API to detect sudden spikes in background noise. Crucially, audio is never recorded, transmitted, or stored on our servers. It is analyzed purely on the student's local device to generate mathematical anomaly flags for the proctor's dashboard.

3. AI Data Processing (Groq API)

IMP3RIAL EDU integrates ultra-fast LLaMA 3.1 models via the Groq API to provide our AI-Powered Educational Intelligence features, such as Auto-Generated Teacher Comments and Parent-Facing Term Summaries.

When these features are triggered, we securely transmit continuous assessment and exam scores to the Groq API strictly for generation purposes. We do not permit Groq or any third party to use your school's academic data or student names to train their foundational models.

4. Data Sovereignty & The Danger Zone

We believe administrators should have total sovereignty over their data. In the event your institution wishes to leave the platform or start fresh, Super Admins have access to the Danger Zone.

Initiating a school deletion triggers custom cascading PostgreSQL functions (e.g., handle_deleted_profile). This executes an irreversible, cascading database wipe that instantly destroys all associated attendance logs, LMS assignments, CBT exam records, fee histories, and purges all associated user identities directly from the Supabase Auth engine. We leave no orphaned data behind.

5. Third-Party Integrations

To provide our SaaS billing services, we integrate with Paystack. When School Admins manage their subscriptions or Parents pay tuition fees through our platform, financial data is securely tokenized and processed directly by Paystack. IMP3RIAL EDU does not store your raw credit card information or primary account numbers (PAN) on our database.