Privacy Policy

Last updated: 8 November 2026

This policy explains how the SomaNet school management system ("SomaNet", "we") handles information, including information from Google and Microsoft accounts that a school connects for cloud backups.

1. Who holds school data

SomaNet is installed on a computer owned by each school. The school's records (learners, staff, marks, fees and other school data) are stored in a database on that school's own computer. The school is responsible for this data. SomaNet (the vendor) does not receive or store a copy of school records on its own servers.

2. Cloud backup with Google Drive or OneDrive

A school may choose to copy its backups to its own Google Drive or Microsoft OneDrive account. To do this, an authorised person at the school signs in and allows SomaNet access.

• Google Drive: SomaNet requests only the drive.file permission. This lets SomaNet create, read and delete only the files it creates itself (the backup files, in a folder named "SomaNet Backups"). SomaNet cannot see, open or change any other files in the account.
• OneDrive: SomaNet requests only access to its own app folder ("Apps/SomaNet Backups") and the account's basic profile (name and email, to show which account is connected).
• Backup files are encrypted by SomaNet on the school's computer before they are uploaded, using a password chosen by the school.
• The sign-in permission (access token) is stored only on the school's own computer, protected with Windows encryption. It is not sent to or kept by the vendor.
• Uploading, listing and deleting old backups, and downloading a backup when the school restores it, are the only things SomaNet does with this access.

3. Use of Google user data

SomaNet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the backup feature described above. It is not sold, not used for advertising, not used to train artificial intelligence models, and not shared with anyone else.

4. Information the vendor receives

To manage licences and program updates, a school's SomaNet computer sends the vendor its computer code, licence details, program version and number of active learners. No learner, staff or financial records are included. If the school uses phone notifications, notification messages pass through the vendor's relay to Firebase Cloud Messaging to reach the phones and are not stored by the vendor.

5. Removing access

A school can disconnect its cloud account at any time on SomaNet's System Backup page. It can also remove SomaNet's access from its Google account (myaccount.google.com → Security → Third-party apps) or Microsoft account (account.microsoft.com → Privacy → Apps and services). Backup files already in the school's Drive or OneDrive stay there until the school deletes them.

6. Security

Backups are encrypted with AES-256 before upload, connections use HTTPS, and access is limited to SomaNet's own backup files.

7. Contact

Questions about this policy: somanet59@gmail.com.