Biissa Sekolah

sekolah.biissa.com

Privacy Policy

Effective date: November 2, 2026

This Privacy Policy explains how PT Biissa Maju Bersama (“Biissa”, “we”, “us”, or “our”) collects, uses, shares, and protects information when you use the Sekolah school portal, mobile application, and related services (together, the “Service”). Sekolah helps schools, staff, families, and students manage school information and daily operations.

1. Information we collect

We collect information needed to provide the Service, including:

  • Account information: name, email address, password credentials in protected form, account role, and verification or invitation details.
  • School and education information: school membership, student and guardian relationships, classes, enrollment, attendance, assignments, submissions, assessments, results, and academic-year information.
  • School operations information: fee obligations and payment records, announcements, direct messages, pickup arrangements, authorized collectors, and handover acknowledgements.
  • Technical information: IP address, request timestamps, browser or app information, security events, and limited diagnostic information needed to operate and protect the Service.
  • Face attendance, only if the school turns it on and a guardian consents: a face template of the student, which is not a photo. Section 8 explains it.

When you use the mobile application, it stores a session credential in the device's secure storage so that you can remain signed in. If you allow notifications, the app sends us a push notification token for your device so we can deliver school notices to it, through Expo's push service and Apple's or Google's notification service. When you sign out, the app tells us to stop sending notices to that device; when you delete your account, your tokens are deleted. The app asks for the camera only on the Pick up screen, to scan a pickup QR code; camera images are processed on the device and are not stored or sent to us, only the code read from the QR. If the app fails, it may send a technical error report: the error message, where in the app's code it happened, and the step you were on. It is not meant to include the content of your school records or messages. The app does not need access to your contacts, photos, microphone, or precise location to provide its core features.

2. How we use information

  • Authenticate users and provide the school features available to their authorized role.
  • Show school, student, attendance, academic, fee, communication, and pickup information to authorized users.
  • Send service messages such as email verification, invitations, password recovery, and important account notices.
  • Secure the Service, prevent abuse, investigate incidents, troubleshoot failures, and maintain audit records.
  • Provide customer support, improve reliability, and comply with legal obligations.

We do not sell personal information or use school and student records for independent advertising.

3. Schools, families, and student information

Schools decide which people and records are entered into their Sekolah workspace and which permissions each role receives. A school may act as the organization responsible for its student and family information, while Biissa operates the Service on the school's behalf. Access is limited by school membership and role permissions.

Schools and guardians are responsible for ensuring that they have the appropriate authority to provide and access information about students. If you believe a student record is inaccurate or should no longer be visible, contact the relevant school and, where appropriate, admin@biissa.com.

4. Sharing and service providers

We share information only as needed to provide and protect the Service:

  • with authorized members of the relevant school according to their role;
  • with infrastructure, database, email, security, and support providers that process information for Biissa under appropriate confidentiality and security obligations;
  • when required by law, legal process, or to protect users, schools, Biissa, or the public; and
  • as part of a merger, acquisition, financing, or transfer of the relevant business, subject to applicable confidentiality requirements.

We do not disclose personal information to third parties for their own marketing purposes.

5. Data retention and security

We retain information for as long as needed to provide the Service, support the school's operational and legal obligations, resolve disputes, enforce agreements, and meet applicable record-keeping requirements. Retention periods may therefore depend on the school's instructions and the type of record.

We use measures designed to protect information, including encrypted connections, protected password handling, secure session storage on mobile devices, role-based access controls, and monitoring for suspicious activity. No service can guarantee absolute security, so please protect your password and report suspected unauthorized access promptly.

6. Your choices and privacy rights

Depending on applicable law, you may request access to, correction of, deletion of, restriction of, or a copy of your personal information, or withdraw consent where processing relies on consent. Some requests must be handled by the school because the school controls the underlying student or school record.

To make a request, contact the school that invited or linked you to Sekolah and/or admin@biissa.com. We may need to verify your identity and may retain information where required by law or necessary to protect other people's rights.

Delete your Sekolah account

You can delete your Sekolah account at any time:

  • In the Sekolah by Biissa app: open Settings (the gear on the home screen), choose Delete account, and type your email address to confirm. The account is deleted at once.
  • By email: write to admin@biissa.com from the email address of your account and ask us to delete it. We reply within 30 days.

Deleting your account signs you out on every device and removes your password, sessions, notification tokens, WhatsApp number, and your links to schools and children, including any permission to collect a child. Your name and email address are removed from your account and from school records such as attendance, grades, fees, past messages, and pickup history; those records stay with the school and are shown as “Deleted user”. What you wrote in messages and requests stays in them. Some records keep the details they were made with: admission forms, invitations you did not accept, names the school typed into its own settings, documents the school has issued, such as report cards, and security logs that cannot be changed, such as the record of who viewed a student's sensitive data. If a student deletes their own account, only the sign-in goes: the school keeps the student's record. If you are the only administrator of a school, add another administrator first. Biissa platform staff accounts are deleted by the Biissa team: write to us. Records a school must keep under the law stay with that school; ask the school directly about them.

7. Children and education data

Sekolah may contain information about students, including children, because schools use the Service for education and school operations. Student accounts and records should be created, linked, and accessed only by the school or an authorized parent, guardian, staff member, or student. We do not use student information for behavioral advertising.

8. Face attendance

A school can choose to take the class roll call with a face scan. It is off unless the school turns it on, and a student takes part only if a parent or guardian linked to the student agrees in the family portal. The teacher always checks and saves the roll call, and can still take it by hand at any time. A student who does not take part is marked by hand, as before.

  • What is collected: school staff take 3 to 5 photos of the student once. Each photo is turned into a face template (a set of numbers that describes the face) and then discarded. A class scan never sends video. In “Walk past” mode the tablet finds faces itself and sends a crop of one face; in “Group photo” mode it sends one photo of the room, and the faces in it are found by our provider. Each face is searched among the templates of the students signed up at that school, and only a participating student enrolled in that class can be named; nobody else is ever shown. Every photo and crop is discarded right after the check. Neither we nor our provider store any photo. We keep a record of each scan with the class, the date, the teacher, counts, and which students were recognised, but no image. Nobody, including the school and us, can look at a face template itself.
  • Other people in view: the camera sees everyone in front of it. Faces of other people in view, including students who do not take part, are sent for the check too, are named only if they match a participating student of the class, and are discarded at once. Nothing is kept about them except a count of faces found: no photo and no template.
  • The only purpose: taking the student's class roll call. Face templates are not used for pickup, exams, the library, or anything else, and are not shared with anyone else.
  • Who processes it, and where: Amazon Web Services keeps the face templates on servers in Singapore, on behalf of the school, because its face service is not available in Indonesia. It receives the photos with an internal code number only, never the student's name.
  • Consent: consent is given for each student by a linked parent or guardian, after reading what is collected and why. Consent from one guardian is enough. Any linked guardian can withdraw it at any time in the family portal, and it takes effect at once. Not giving consent changes nothing else.
  • Deletion: a student's face templates are deleted when consent is withdrawn (or the only guardian who consented deletes their account or is no longer linked to the student), when the student leaves the school or their record is deleted, when the school turns face attendance off, and 12 months after sign-up (the student can then sign up again). A daily check deletes anything that should no longer exist. Scan records are deleted after 180 days. The record of who gave or withdrew consent, and when, is kept as history until that guardian's account or the student's record is deleted.

To ask what is held about a student, or to have it deleted, withdraw consent in the family portal, ask the school, or write to admin@biissa.com.

9. International processing

Biissa and its service providers may process information in countries other than where you live. Where required, we use appropriate safeguards for international transfers and continue to apply the protections described in this Policy. Face templates for face attendance are kept in Singapore (section 8).

10. Changes to this Policy

We may update this Policy when the Service, our practices, or applicable law changes. We will update the effective date above and provide additional notice for material changes where appropriate. The current version will remain available at this page.

11. Contact us

For questions, privacy requests, or concerns about the Service, contact us at admin@biissa.com. If your request concerns a student record managed by a school, please also contact that school.

PT Biissa Maju Bersama
Email: admin@biissa.com