Privacy Policy

1. Who we are

Giant Reports ("Giant Reports", "we", "us", "our") is a school management platform, owned and operated by Brobd Solutions Limited, that helps schools, teachers, class supervisors, and parents or guardians manage attendance, academic performance, assessments, fees, school news, and communications.

The two mobile apps serve different audiences but share this policy:

• Giant Teacher: for teachers and class supervisors (school staff).
• Giant Parents: for parents and guardians of enrolled students.

2. Our role: controller and processor

Much of the data in the Services concerns students (children) and is entered or generated by schools and their staff. For that data:

• The school or educational institution is the data controller: it decides what student data is collected and why.
• Giant Reports acts as a data processor on the school's behalf and under the school's instructions and its agreement with the school.

For account and device data of the app users themselves (teachers, supervisors, and parents), Giant Reports acts as a controller.

If you are a parent or student with questions about student records, please contact your school first. Some requests can only be actioned by the school as controller.

3. Information we collect

3.1 Information you provide

• Account and identity: name, email address, phone number, password, and your role (teacher, class supervisor, parent or guardian).
• Profile details: display name, profile photo, school affiliation, assigned classes or subjects (staff), and linked children (parents).
• Communications: messages you send or receive through in-app messaging between teachers or supervisors and parents.
• Support requests: information you provide when you contact us.

3.2 Student and child information (processed on behalf of schools)

Depending on the school's configuration, the Services process student records such as: student name and identifier, class or grade, photo, attendance, assessment scores and academic performance, lesson-topic progress, end-of-term reports, fee or payment status, and parent or guardian contact details. This data is provided by the school; Giant Reports does not independently collect it from children.

3.3 Information collected automatically

• Device and technical data: device model, operating system and version, app version, language, time zone, and, for the web app, browser type and IP address.
• Push notification identifiers: a device push token or notification ID used to deliver notifications (see Section 6).
• Diagnostic and log data: basic error and event logs used to keep the Services running and to diagnose problems.
• Usage data: high-level information about how you interact with features (for example, which screens you open), where enabled.

As shipped, the apps do not run third-party analytics or crash-reporting SDKs. If we later add such tools (for example, Sentry, Firebase, or Amplitude), we will disclose them here and update this policy.

3.4 Information stored on your device

• Session token: stored after you sign in, so you stay logged in.
• "Remember me" credentials: if you enable "Remember me" on the Giant Teacher sign-in screen, your email and password are stored locally on your device to pre-fill the login form. They remain on the device until you sign out with "Remember me" off or clear the app's data. Do not enable this on a shared device.
• Cached images (for example, profile photos) for performance.

4. How we use information

We use personal data to:

1. Provide and operate the Services: authenticate you, and show your classes, students, attendance, scores, fees, news, and messages.
2. Enable communication between teachers or supervisors and parents.
3. Send notifications you have not opted out of (see Section 6).
4. Maintain security: detect, prevent, and respond to fraud, abuse, and unauthorized access, including signing you out when a session expires.
5. Provide support and respond to your requests.
6. Maintain and improve reliability, performance, and features.
7. Deliver app updates, including over-the-air updates via Shorebird.
8. Comply with legal obligations and enforce our terms.

5. Legal basis for processing

As a Ghanaian company processing personal data primarily for schools operating in Ghana, our principal legal basis for processing is the Data Protection Act, 2012 (Act 843). Under Act 843, personal data may be processed only where a lawful basis exists, including where the data subject has given consent; where processing is necessary to perform a contract to which the data subject is party; where processing is necessary to comply with a legal obligation; or where processing is necessary for the legitimate interests of Brobd Solutions Limited, the school, or a third party, provided this does not unreasonably override the fundamental rights and freedoms of the data subject. See Section 12 for more detail on Act 843.

Where the GDPR or UK GDPR applies to a user (for example, users based in the EEA or UK), we additionally rely on:

• Performance of a contract: to provide the Services you or your school signed up for.
• Legitimate interests: to secure, maintain, and improve the Services, provided your rights do not override those interests.
• Consent: for optional notifications and any optional processing; you may withdraw consent at any time.
• Legal obligation: to comply with applicable law.

For student data, the school (as controller) is responsible for establishing the lawful basis, including any parental consent required.

6. Push notifications

We use OneSignal to deliver push notifications (for example, school news, attendance, and messages). To do this, a push token or notification identifier and basic device information are processed by OneSignal on our behalf. You can turn notifications off at any time in your device settings or, where available, in the app's notification preferences. See OneSignal's privacy policy at onesignal.com/privacy_policy.

7. How we share information

We share personal data only as described here. We do not sell your personal data, and we do not use student data for advertising.

• With your school or institution: the controller of student records.
• Between teachers or supervisors and parents: messaging and student information are shared as designed within the platform, according to the school's configuration and your role's permissions.
• Service providers and sub-processors who process data on our behalf under contract, including:
  • Cloud hosting and backend: reputable cloud infrastructure providers host the Giant Reports backend and database, under contractual data protection and security obligations.
  • OneSignal: push notification delivery.
  • Shorebird: over-the-air app update delivery.
  • Apple App Store and Google Play: app distribution and, where you enable it, platform push services (APNs/FCM).
  • Google Fonts: the mobile apps use the Manrope typeface via the google_fonts package; depending on configuration this may fetch font files from Google's servers.
• Professional advisors, auditors, or authorities where required by law, legal process, or to protect rights, safety, and security, including the Ghana Data Protection Commission.
• Business transfers: if we are involved in a merger, acquisition, or asset sale, data may transfer subject to this policy.

We maintain a current list of sub-processors and will update this section as our vendors change.

8. International data transfers

Personal data collected through the Services is primarily hosted and processed to serve schools operating in Ghana. Where we or our sub-processors transfer personal data across borders, we take appropriate steps required by applicable law, including the Data Protection Act, 2012 (Act 843), to ensure the receiving party provides an adequate level of protection, for example through contractual safeguards, and, where relevant to users in the EEA or UK, Standard Contractual Clauses.

9. Data retention

• We retain account data for as long as your account is active, and for a reasonable period afterward to meet legal, accounting, or reporting requirements.
• We retain student records for as long as the school instructs, or as required by the school's obligations and applicable education or records laws.
• We retain logs and diagnostic data for a limited period, typically no longer than twelve months, for security and troubleshooting.
• We delete or anonymize data when it is no longer needed, subject to legal retention requirements.

Data stored locally on your device (session token, remembered credentials, cached images) is removed when you sign out (with "Remember me" off), uninstall the app, or clear its data.

10. Security

We use technical and organizational measures to protect personal data, including encryption of data in transit (HTTPS/TLS), authenticated API access, role-based access controls, and automatic sign-out when a session is invalid or expired. No system is perfectly secure. Please protect your login credentials, sign out on shared devices, and avoid enabling "Remember me" on devices others can access.

11. Children's privacy

The Services are designed for use by adults (school staff and parents or guardians) and by schools acting as controllers. Students do not create their own accounts. Student personal data is entered and controlled by the school. We process it on the school's behalf and rely on the school to obtain any consents required by law, including parental or guardian consent where required under the Data Protection Act, 2012 (Act 843), or, where applicable, regulations such as COPPA in the United States or GDPR provisions on children's data in the EEA/UK.

Parents and guardians may exercise rights over their child's data through the school, and through the Giant Parents app where the feature is available. If you believe a child's data has been provided without proper authorization, contact us at info@brobd.com and we will work with the school to address it.

12. The Data Protection Act, 2012 (Act 843)

Brobd Solutions Limited is a Ghanaian company, and the primary law governing how we collect, use, disclose, and protect personal data is Ghana's Data Protection Act, 2012 (Act 843) ("the Act"), enforced by the Data Protection Commission ("the Commission").

12.1 Data protection principles

The Act sets out eight principles that govern our processing of personal data: accountability, lawfulness of processing, specification of purpose, compatibility of further processing with that purpose, quality of information, openness, data security safeguards, and data subject participation. We design our processes around these principles for all personal data we control, and we require the same of our sub-processors.

12.2 Registration with the Commission

The Act requires data controllers and data processors operating in Ghana to register with the Data Protection Commission before processing personal data, and to renew that registration periodically. Brobd Solutions Limited complies with the registration obligations applicable to it under the Act as a data controller and data processor.

12.3 The Data Protection Commission

The Commission is the independent statutory body responsible for administering and enforcing the Act in Ghana. You may contact the Commission directly with questions or complaints about how your personal data is handled:

Non-compliance with the Act may attract civil liability, criminal sanctions, or both, and a data subject who suffers damage as a result of a contravention of the Act has the right to claim compensation from the controller, enforceable through the civil courts.

13. Your rights

Under Section 39 of the Data Protection Act, 2012 (Act 843), and, where applicable, under other laws such as the GDPR/UK GDPR or the CCPA/CPRA in California, you may have the right to:

• Be informed when your data is being collected or processed;
• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data ("right to be forgotten"), subject to legal retention requirements;
• Restrict or object to certain processing;
• Portability: receive your data in a portable format;
• Withdraw consent at any time (without affecting prior processing); and
• Lodge a complaint with your data protection authority (the Data Protection Commission in Ghana, described in Section 12.3, or your EU/UK supervisory authority, as applicable).

Where you exercise a right to access or correct your personal data, we will respond within the timeframe required by applicable law. Under the Act, this is generally within twenty-one days of a valid request.

California residents (CCPA/CPRA): we do not sell or "share" personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising your rights.

To exercise your rights, contact info@brobd.com. For student records, we will direct your request to, or act on the instructions of, your school as controller. We will verify your identity before acting on any request.

14. Cookies and local storage

Mobile apps use on-device local storage (not advertising cookies) to keep you signed in and cache content, as described in Section 3.4. The web app (app.giantreports.com) may use cookies and browser storage that are strictly necessary to sign you in and operate the site. As shipped, the web app does not use non-essential or advertising cookies. If we introduce analytics or non-essential cookies in the future, we will disclose them here and provide an appropriate consent mechanism.

15. Third-party links and actions

The Services may let you start a phone call to a school contact or open external links. Those actions are handled by your device and the third party's own services and privacy practices, which we do not control.

16. App-store disclosures

Our Apple App Store "App Privacy" labels and Google Play "Data safety" section summarize the data the apps collect and how it is used. Where those summaries and this policy differ in detail, this policy governs. We keep our store disclosures aligned with this document.

17. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date and, for material changes, provide additional notice, for example an in-app or email notice. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

18. Contact us

Questions, requests, or complaints about this policy or your data:

If you are a parent or student asking about a specific student's records, please also contact your school, which controls that data. This Privacy Policy, and any dispute arising from it, is governed by the laws of the Republic of Ghana, including the Data Protection Act, 2012 (Act 843).