How SyncHub Pro collects, uses, shares, and protects information across our website, web platform, and mobile applications.
SyncHub Pro (“SyncHub Pro”, “we”, “us”, or “our”) is a unified business and institution management platform operated by SoftVilla Solutions. This Privacy Policy explains what information we collect through the SyncHub Pro website, the web platform (including institution subdomains such as yourinstitution.synchubpro.com), and our Parent, Employee, and Vendor mobile applications (together, the “Services”), how that information is used, and the choices available to you.
By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.
SyncHub Pro is a multi-tenant Software-as-a-Service platform. Schools, colleges, academies, and other organisations (each an “Institution”) subscribe to the platform and use it to manage admissions, students, staff, attendance, fees and payroll, learning management, human resources, inventory, and related operations.
This Policy covers all of the following: the public marketing website; the SyncHub Pro web application and each Institution’s dedicated subdomain; the SyncHub Pro Parent mobile app; the SyncHub Pro Employee mobile app; and the SyncHub Pro Vendor mobile app. It does not cover the independent privacy practices of any Institution, nor those of third-party websites or services that we link to.
Most of the personal information held inside the platform — student records, guardian details, employee files, attendance, fee ledgers, and academic results — is uploaded and controlled by the Institution. For that information the Institution is the data controller and SyncHub Pro acts as a data processor, handling the information only on the Institution’s documented instructions and under our subscription agreement with them.
If you are a parent, student, employee, or vendor and you want your records corrected or deleted, please contact your Institution first — they control that data. We will support the Institution in responding to your request, but we cannot unilaterally alter or erase records they own.
We act as a data controller in our own right only for a limited set of information: enquiries submitted through our website, subscription and billing records for the Institution’s account, support correspondence, and technical logs we generate to keep the Services secure and available.
The information available in the platform depends on which modules an Institution has enabled and which role you hold. In broad terms, we process the following categories:
| Category | Examples | Typical source |
|---|---|---|
| Account and identity data | Name, username, email address, phone number, role and permissions, profile photo, hashed password | Institution administrator or the user |
| Student and guardian records | Student name, registration number, class and section, date of birth, gender, address, guardian names and contact details, documents and certificates | Institution |
| Employee and HR records | Designation, department, joining date, employment documents, leave requests and approvals, attendance and shift records, payroll and salary details | Institution |
| Academic and LMS data | Timetables, subject allocations, assignments, examination results, report cards, question banks and generated papers | Institution and its staff |
| Financial data | Fee vouchers, payment receipts, outstanding balances, vendor invoices and purchase records | Institution |
| Communications | Announcements, notices, support tickets, in-app notifications and their read status | Institution, its users, and us |
| Device and technical data | IP address, browser type and version, operating system, device model, app version, push notification token, time zone, and pages or screens viewed | Automatically collected |
| Diagnostic data | Error reports, crash logs, request logs, and audit trails of actions taken in the platform | Automatically collected |
We do not knowingly collect special-category information such as health, religious belief, or biometric templates for identification purposes unless an Institution chooses to record it within a module for its own legitimate administrative reasons. Where biometric unlock is offered in our mobile apps, the fingerprint or face data never leaves your device and is never transmitted to us — see the section on mobile app permissions below.
| Purpose | What this involves |
|---|---|
| Providing the Services | Creating and maintaining accounts, provisioning the Institution’s tenant database and subdomain, and delivering the modules the Institution has subscribed to. |
| Authentication and access control | Verifying identity at sign-in, issuing session tokens, and enforcing role-based and location-based permissions so users only see what they are entitled to see. |
| Notifications and communication | Sending in-app, email, SMS, and push notifications about attendance, fees, leave approvals, announcements, and other events the Institution configures. |
| Support and troubleshooting | Responding to support tickets, reproducing reported issues, and restoring service after an incident. |
| Security and abuse prevention | Detecting unauthorised access, rate-limiting suspicious traffic, maintaining audit logs, and investigating security incidents. |
| Service improvement | Understanding aggregate feature usage and performance so we can fix defects and prioritise improvements. We use aggregated or de-identified data for this wherever possible. |
| Billing and administration | Managing subscriptions, invoices, renewals, and our own accounting and legal obligations. |
We do not sell personal information, and we do not use the content stored by Institutions inside their tenant for advertising or for training generative AI models on identifiable data.
Where data protection law requires a legal basis for processing, we rely on the following:
Our mobile applications request device permissions only when a feature needs them, and each permission can be declined or revoked later in your device settings. Declining a permission disables the related feature but does not prevent you from using the rest of the app.
| Permission | Why it is requested |
|---|---|
| Camera | To capture profile photos, scan attendance or document codes, and attach photographic evidence to requests where a module supports it. |
| Photos and media | To upload an existing image or document from your device as an attachment. |
| Notifications | To deliver push notifications for attendance, fees, leave decisions, announcements, and other events. |
| Biometric unlock (fingerprint / face) | To unlock the app using your device’s own biometric hardware. The check is performed entirely by the operating system; we receive only a success or failure result and never the biometric data itself. |
| Storage | To download and save documents such as vouchers, receipts, and report cards to your device. |
When you install one of our mobile apps and allow notifications, the app registers a push token with Firebase Cloud Messaging (a Google service) and shares it with our servers so that messages can be routed to your device. The token identifies the device, not you personally, and is deleted when you uninstall the app or sign out.
Institutions may also send email and SMS messages through the platform using third-party gateways. You can turn off optional notification categories in the app’s notification preferences; certain operational messages, such as account security notices, cannot be disabled while your account is active.
Data an Institution stores in its tenant is retained for as long as that Institution’s subscription is active, and thereafter according to our agreement with them. On termination, the Institution may request an export of its data within the window set out in our Terms & Conditions; after that window the tenant database and its backups are scheduled for deletion.
Data we control ourselves is retained on a shorter cycle: technical and security logs are typically kept for up to twelve months, support correspondence for up to twenty-four months, and billing and tax records for the period required by applicable law. Backups are held on a rolling schedule and are overwritten in the ordinary course.
We maintain technical and organisational measures appropriate to the sensitivity of the data we handle, including:
No system can be guaranteed completely secure. You are responsible for keeping your credentials confidential, using a strong and unique password, and notifying us or your Institution immediately if you believe your account has been compromised. If a breach affects your personal information, we will notify the affected Institution and, where the law requires, the relevant authority and the individuals concerned without undue delay.
SyncHub Pro is designed for use by Institutions and their authorised staff, parents, employees, and vendors. It is not directed to children, and children do not create accounts with us directly.
Where an Institution records information about a student who is a minor, it does so as controller and is responsible for obtaining any consent or authorisation required by local law. Parent accounts are created and linked to a student by the Institution. We process student information only to provide the Services to the Institution and never for advertising or profiling.
SoftVilla Solutions operates from Pakistan and the United States, and our infrastructure and service providers may process data in either location or elsewhere. Where personal information is transferred across borders, we take steps to ensure it remains protected to a standard consistent with this Policy, including contractual safeguards with our service providers.
Subject to the law that applies to you, you may have the right to request access to your personal information, correction of inaccurate data, deletion, restriction of or objection to certain processing, a portable copy of data you provided, and withdrawal of consent where processing is based on consent.
Because most records are controlled by your Institution, please direct such requests to them in the first instance. If you contact us about data we hold as a processor, we will forward your request to the relevant Institution and assist them in responding. For information we control ourselves, contact us using the details below and we will respond within the period required by applicable law.
You can also manage several choices directly: update your profile details in your account, adjust notification preferences in the app, revoke device permissions in your device settings, and uninstall the mobile app to stop push delivery entirely.
The Services may link to third-party websites, payment pages, or applications that we do not control. This Policy does not apply to those destinations, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any third party before providing information to it.
We may update this Privacy Policy from time to time to reflect changes in the Services, our practices, or the law. The revised version will be posted on this page with a new “Last updated” date. Where changes are material, we will provide additional notice through the platform or by email to Institution administrators. Continued use of the Services after the revised Policy takes effect constitutes acceptance of it.
If you have questions about this Privacy Policy or how your information is handled, please contact us: