Who we are
EDU54 ("we", "us") makes and sells EDU54, an AI learning lab in one box for schools, colleges and universities. It is built on Umanah Institute LabOS. This policy explains what personal information we handle, why, and the choices you have.
For anything about privacy, email [email protected]. We aim to reply within 7 days and will answer every request within the time the law allows (usually one month).
Two kinds of data
It helps to separate two things, because the rules are different for each.
1. Data on a school's box
When a school uses EDU54, the names, usernames, conversations with the AI tutor, lessons, assignments, projects, progress and safety alerts of its students and staff are stored on the box at that school. The box does not send them to us, and the tutor, lessons and library run without the internet.
For that data the school is in charge (in law, the "data controller"). The school decides who has an account, what is kept and for how long, and answers requests from students and parents. If you are a student, parent or staff member with a question about that data, please contact your school first. Our Data protection page explains how the box helps schools meet their duties.
2. Data we handle ourselves
We handle a small amount of personal information directly: when you visit this website, try a demo, contact us, or when a school orders a box and we set it up and support it. The rest of this policy is about that data.
What we collect and why
| When | What | Why |
|---|---|---|
| You visit edu54.com | Technical connection data: IP address, browser type, the page requested and the time. Our network provider, Cloudflare, may set a strictly necessary security cookie to block automated attacks. | To deliver the site and keep it secure. |
| You try a K-12 or University demo | A single cookie (umanah_demo) that points you to your own private copy of a made-up sample school. Anything you type or create is saved only in that copy. | To give each visitor their own demo that no one else sees. Copies are deleted within 24 hours. |
| You email or call us | Your name, contact details, school or institution, and what you tell us. | To answer you and prepare a quote. |
| Your institution orders a box | The institution's name and address; the names, work emails and phone numbers of the people we deal with; the name and email of the first admin and of the designated safety contacts; order, delivery and invoice details. | To set up the box for your institution, deliver it, invoice it, and support it. |
| We support a box | Technical information about the box (software versions, storage, service health) and a record of what we did. | To fix problems and keep the box safe and up to date. |
Please do not enter real personal information in the demos. They use made-up students and sample data, and are reset every day.
We do not ask for, and do not want, information about a student's health, religion, ethnicity or other sensitive matters. We do not knowingly collect personal information directly from children through this website.
Support access to a school's box
We install and configure each box before it ships. After that we only access a box when the school asks us to or agrees, only for as long as the work needs, and only to do that work.
- We do not open, read or copy student conversations, student work or safety alerts, including during support.
- If a problem cannot be fixed without touching personal data, we explain why and get the school's written agreement first.
- Admin actions on the box are recorded in an audit log the school can read.
Legal grounds
Where data protection law (such as the Nigeria Data Protection Act 2023, Ghana's Data Protection Act 2012, Kenya's Data Protection Act 2019, South Africa's POPIA, or the EU and UK GDPR) asks us to name a legal ground, we rely on:
- Contract: to quote, sell, deliver, set up and support a box.
- Legitimate interests: to run and secure this website and the demos, and to answer people who contact us. We weigh these against your rights and keep the data to a minimum.
- Legal obligation: to keep invoices and tax records.
- Consent: if we ever want to use data for anything else, such as a case study naming your school, we will ask first, and you can withdraw consent at any time.
International transfers
Our website and email providers may process data in countries other than yours, including countries outside Africa. When that happens we use providers that offer recognised safeguards, such as standard contractual clauses, as required by the Nigeria Data Protection Act, the GDPR and similar laws. Student data on a school's box stays on that box.
How long we keep it
- Demo copies: deleted within 24 hours, and all demos are reset every day.
- Website connection logs: kept only as long as needed for security and fault-finding, then deleted.
- Enquiries: up to 2 years after our last contact, unless they lead to an order.
- Order, invoice and support records: for as long as we support the box, and after that for as long as tax and company law requires.
Your rights
Depending on where you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct it if it is wrong;
- delete it, or limit how we use it;
- stop using it for a purpose you object to;
- give it to you, or another organisation, in a common format;
- withdraw consent you gave earlier.
Email [email protected]. We may need to confirm who you are. There is no charge. For data on a school's box, ask the school; we will help the school respond.
You can also complain to your data protection authority, for example the Nigeria Data Protection Commission, Ghana's Data Protection Commission, Kenya's Office of the Data Protection Commissioner, South Africa's Information Regulator, or the authority in your EU country or the UK. We would be grateful for the chance to put things right first.
Children
This website and the demos are meant for adults choosing a product for their institution. Children use EDU54 through their school, on the school's own box, with accounts the school creates. Student accounts need only a display name and a username: no student email address or date of birth is required.
Schools are responsible for any parent or guardian consent the law requires for their students. Our Data protection page explains this for Nigeria, Ghana and other countries.
Security
We protect the information we hold with access controls, encrypted connections (HTTPS) on this website, private networks for support, and by keeping as little as possible. On the box, everyone signs in with their own account, each role sees only what it needs, and admin actions are recorded. No system is perfectly secure; if a breach affects your personal information, we will tell you and the relevant authority as the law requires (in Nigeria and under the GDPR, the authority within 72 hours of becoming aware of it).
Changes to this policy
We will update this page when our practices change and show the new date at the top. If a change matters for schools that have bought a box, we will tell them directly. Questions: [email protected].