The privacy policy for YESS and ENFURISED. Plain language at the top, the full document below.
Plain language
We collect only what your school needs us to run the platform. Student records, attendance, grades, fees — these live in the database your school controls. We do not sell, share, or use any of it for advertising. We never train AI on student data. You can export everything at any time. You can delete it on request, fully.
ENFURISED is a software company headquartered in Yaoundé, Cameroon. We operate the YESS platform on behalf of our school customers. When YESS processes data about students, parents, or staff, the school is the data controller and ENFURISED is the data processor.
Data the school enters: student profiles, parent contacts, staff records, attendance marks, grades, fee transactions, communication content, conduct events, and any documents uploaded.
Data we observe to run the service: login timestamps, device fingerprints for fraud detection, IP addresses, audit trail of sensitive mutations, error reports.
Data we never collect: third-party browsing, location outside opted-in geofences, content of personal devices, biometric data beyond what's explicitly enrolled for attendance.
All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Primary storage is in Frankfurt by default, with regional alternatives available on request. Row-Level Security partitions every tenant table by school_id; the database refuses cross-tenant queries.
Only people in your school, with the permissions your admin granted. ENFURISED staff have access for support only when the school invokes impersonation explicitly — every impersonation event is audit-logged with timestamp, actor, and reason. We never share data with third parties for marketing.
Schools (and the individuals within them) can request a full data export at any time, in CSV, JSON, or SQL dump form. Individual users can request deletion of their personal data — we honour the request within 30 days, except where law requires retention (e.g., financial records).
YESS uses one cookie — the session cookie that keeps you signed in. We do not run analytics that profile individuals, we do not run advertising, and we never inject third-party tracking pixels.
When we update this policy, we notify school admins by email at least 14 days before the change takes effect. Material changes (new data category, new sub-processor) trigger re-consent at the school level.
Questions? Contact ENFURISED.