Privacy Policy

1. Introduction and Scope

William V.S. Tubman High School ("the School," "we," "our," or "us"), operating under the Monrovia Consolidated School System (MCSS) in Monrovia, Liberia, is committed to protecting the privacy of our students, parents, teachers, staff, and website visitors.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the MCSS Live Class application, our website at https://tubmanhighschool.com, and any related educational services (collectively, "the Services").

By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.

2. Information We Collect

We collect several categories of information depending on how you interact with the Services.

2.1 Information You Provide Directly

When you register, apply for admission, or participate in classes, you may provide:

• Identity information: full name, date of birth, gender, nationality
• Contact information: physical address, phone number, email address
• Academic information: grade level, class, section, subjects, registration number
• Guardian information: parent or guardian name, relationship, occupation, contact details
• Uploaded documents: profile photographs, bank payment receipts, and other admission materials

2.2 Information from Google Account Integration

Specifically, when you authorize Google integration, we access:

• Google Calendar (scope: https://www.googleapis.com/auth/calendar): We read and create calendar events solely to schedule live classes and generate Google Meet video conference links.
• Google Meet meeting links: Automatically created when a class is scheduled and stored in our system so students can join.
• Google profile basics: Your name and email address, used to identify you as a teacher or student in the class roster.

We do not access your Gmail messages, Google Drive files, Google Contacts, Google Photos, YouTube data, or any other Google services outside of Calendar.

2.3 Information Collected Automatically

When you use the Services, we may automatically collect:

• Log data: IP address, browser type, pages visited, timestamps, and referring URLs
• Device information: device type, operating system, and screen resolution
• Cookies and session data: session identifiers to keep you logged in and maintain security

3. How We Use Your Information

We use the information we collect exclusively for educational and administrative purposes. Specifically:

• To schedule and host live classes: Create Google Meet links, notify students and teachers, and manage class rosters
• To log class attendance: Record the time each student joins a live class session to maintain accurate attendance records
• To process admissions: Review applications, communicate decisions, and enroll accepted students
• To communicate: Send SMS or email notifications about upcoming classes, admission decisions, and school events
• To maintain records: Keep academic and administrative records as required by educational regulations
• To ensure security: Detect and prevent fraud, unauthorized access, and misuse of the Services

We do not use your information for advertising, marketing to third parties, profiling, or any commercial purpose unrelated to education.

4. Google API Services User Data Policy Compliance

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide the features described in Section 3 above
• We do not transfer Google user data to third parties except as necessary to provide the Services or as required by law
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data unless: (a) you give explicit consent, (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized

5. Information Sharing and Disclosure

We do not sell, rent, trade, or otherwise transfer your personal information to outside parties for commercial purposes. We share information only in the following limited circumstances:

5.1 With School Personnel

Authorized teachers, administrators, and IT staff have access to student records necessary for their official duties.

5.2 With Service Providers

We use the following trusted third-party services to operate the application:

• Google LLC — for Google Calendar integration and Google Meet video conferencing
• Our web hosting provider — for secure server infrastructure
• SMS and email providers — for sending class notifications

All service providers are contractually obligated to protect your information and use it only for the specific purpose of providing their service to us.

5.3 Legal Requirements

We may disclose information if required by law, subpoena, court order, or government regulation, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the School, our students, or the public.

6. Data Retention

We retain your information only as long as necessary for the purposes described in this Privacy Policy:

• Student academic records: Retained for the duration of enrollment plus the period required by Liberian educational regulations and MCSS record-keeping requirements
• Live class attendance logs: Retained for the current academic year plus one (1) additional year, then archived or deleted
• Google Calendar events: Retained only while the corresponding class remains in our system; deleted when the class record is deleted
• OAuth tokens and credentials: Stored securely for the operational lifetime of the integration; revoked upon teacher departure or request
• Admission application records: Retained for three (3) years from the date of application
• Contact form submissions: Retained for one (1) year

7. Data Security

We implement industry-standard security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: All communication between your browser and our servers uses HTTPS/TLS encryption
• Encrypted credential storage: Google OAuth client secrets and refresh tokens are stored securely on our servers and never exposed to browsers or third parties
• Access controls: Only authorized IT staff have access to server infrastructure and database records
• Password hashing: All user passwords are stored using one-way cryptographic hashing
• Session security: Sessions are encrypted, and users are automatically logged out after periods of inactivity

While we take security seriously, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. Your Rights and Choices

You have the following rights regarding your personal information:

8.1 Access and Correction

You may request access to, or correction of, the personal information we hold about you by contacting the IT Office.

8.2 Revoking Google Access

You can revoke the School's access to your Google account at any time by visiting https://myaccount.google.com/permissions. Revoking access will prevent new classes from being scheduled under your account but will not delete data already recorded.

8.3 Data Deletion Requests

You may request deletion of your personal information by contacting the IT Office at info@mcssedu.org. We will process valid deletion requests within thirty (30) days, except where retention is required by law or legitimate educational records requirements.

8.4 Complaint to Authorities

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant data protection authority.

9. Children's Privacy

Our Services are used primarily by students under the age of 18 as part of their education. We comply with applicable child protection laws and take the following measures:

• We only collect information from students that is necessary for academic administration
• Student photographs and personal information are visible only to authorized school personnel and, where appropriate, to the student's own class and teachers
• We do not use student information for marketing or advertising purposes
• Parents and guardians may contact the IT Office to review or request deletion of their child's information

10. International Data Transfers

Our servers and service providers may process data in countries other than Liberia, including the United States (where Google's servers are located) and other countries where our hosting provider operates. We ensure that appropriate safeguards are in place for such transfers.

11. Cookies and Tracking

We use only essential cookies required for the application to function:

• Session cookies: To keep you logged in during your session
• Security cookies: To protect against cross-site request forgery (CSRF)

We do not use advertising cookies, third-party tracking cookies, or behavioral profiling cookies.

12. Third-Party Links

Our Services may contain links to third-party websites (for example, Google's Terms of Service or Privacy Policy). We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will:

• Post the updated policy on this page
• Update the "Last updated" date at the top
• Notify students, parents, and staff via email or in-app notification

Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: