Privacy notice
How we handle your information
Last updated 8 November 2026. This notice covers school.blackrocknepal.com: the website, the Book a demo and contact forms, and BRSchool accounts with the school records kept in them.
The short version
- We collect what we need to answer you and to run BRSchool for your school, and nothing more.
- The site runs no analytics, advertising or tracking scripts. Its pages set the small cookies that run a session, even before you sign in.
- We never sell your information or use it for advertising.
- Nobody signs up on their own: a school's administrators create its accounts.
- You can ask to see, correct or delete your information through the contact form.
Who we are
BRSchool is school management software made by Black Rock in Kathmandu, Nepal. Black Rock decides how the information in this notice is used and is responsible for it, with one difference: a school decides what it keeps about its students, families and staff, and Black Rock keeps and processes those records for it.
What we collect and why
When you visit
Every page of the site, this one too, sets five small cookies that run a session, even before you sign in: sid, system_user, full_name, user_id and user_lang. For a visitor they hold no more than “Guest”, “no” and the language; sid lasts a week and the rest until the browser closes. Signing in sets the ones that keep you signed in. The site runs no analytics, advertising or tracking scripts.
Our servers record the IP address, time, page, referring page and browser of each request. We use these records only to keep the service secure and working, never to track or profile visitors. The form pages load their typeface from Google Fonts, so your browser asks Google for it.
When you book a demo
Your name, school, role, how many students it has and your phone, and, if you add them, your e-mail, your city or district and what you'd like to see. We use them only to arrange the demo and the quote, and to write to you about them.
When you send a message
Your name, your e-mail, what the message is about and the message itself, and, if you add them, your phone and your school. We use them only to answer you.
For both forms we count the requests from your IP address, to stop automated sending; the count expires after 10 minutes.
When you have an account
Your school's administrators create it: your name, e-mail address, phone if given, and your roles; your password, which we store only as a one-way hash; your sign-in history, with the time and IP address of each sign-in; and the record of the pages you open in the desk. We use this to let you sign in, keep your account secure and show you your part of the school.
Your school's records
Students, guardians and staff, admissions, attendance, timetables, results, fees, leave and the answers to School Forms, with their files, belong to the school that keeps them. We store and process them only to provide BRSchool to it. Who can open them depends on their role: students see only their own records, guardians only their children's, and teachers the groups they teach.
The assistant
It is switched off on this site. Where a school switches it on, each message typed into it is sent, with the day's date, to Anthropic's Claude model, which works out what is being asked; the answer is read from BRSchool's own records, which aren't sent. Messages are kept for 90 days.
This site sends no e-mail yet. We will update this notice before it does.
How long we keep it
- Demo requests and messages
- Until we delete them: there is no fixed period yet. Ask, and we delete yours.
- Your account
- Until your school closes it.
- Your school's records
- As long as the school keeps them in BRSchool, and as Nepal's laws require.
- Sign-in history (time and IP address)
- 90 days.
- The record of the pages you open in the desk
- 90 days.
- Assistant messages, where the assistant is on
- 90 days.
- Error reports
- 14 days.
- Web server logs (IP address, time, page and browser)
- No fixed period yet. Requests first pass through Cloudflare and a front server shared with other services, which keep their own logs.
- Backups
- Made every night and kept for 14 days, on the same server. Deleted information can remain in a backup until that backup is removed.
How we protect it
- Everything travels over HTTPS.
- Passwords are stored only as one-way hashes.
- Roles decide who opens what, checked record by record, and every request for more access is kept with who decided it.
- Files sent through forms are checked by what they contain, stored privately and opened only by the staff who read the answers.
- Repeated or automated requests are limited, and the server is backed up every night.
Your choices and rights
Nepal's Privacy Act, 2075 (2018) protects your personal information, and we follow it. You can ask us to:
- show you the information we hold about you;
- correct anything that is wrong;
- delete your information, except what the law requires us to keep;
- withdraw your consent, after which we stop using what you gave us for it.
Send a message through the contact form and choose “A privacy request”, giving the e-mail address you used with us, so that we can confirm the request is yours. We aim to reply within 30 days. For your school's records, ask your school first: it decides what it keeps, and we help it.
Children
Most students are children. Their records are entered by their school; a student's own account shows only their own records, and a guardian's only their children's. We use children's information only to provide BRSchool to their school, never for advertising.
Changes to this notice
When we change this notice, we update the date at the top.
Contact
Questions and requests: the contact form. Black Rock Nepal, Kathmandu, Bagmati Province, Nepal.