Privacy Policy

1. Platform operator and scope

Result Forum™ is a Scholar Vault Africa™ product that helps institutions manage, review, publish and verify academic results. This notice explains information that may be processed when you visit the website or use the platform.

An institution that determines why and how official student records are used will generally be the data controller for those records. Result Forum may process those records on the institution's instructions and may separately control certain account, security, support and website-use information. Actual roles depend on the processing activity and applicable law; institutions may have their own separate privacy notices.

2. Information we may process

The information depends on your role, institution and features used. It may include:

• Account and identity data: name, email address, phone number, sign-in identifiers, role and institutional affiliation.
• Institution-submitted or institution-managed academic records: student identifiers, class/programme, marks, grades, result summaries, official documents, review/publication status and audit history of authorised actions.
• Parent/guardian and verification information: contact details and limited signals needed to confirm authorisation or a sign-in session.
• Support and feedback: subjects, messages, complaints and information you choose to submit.
• Technical information: browser/device details, network addresses and error or security logs that may be generated by the platform or its service providers.
• Feature-usage information: selected public-site events and performance measurements, as well as prompts and outputs when you choose an AI feature.

3. Why information is used

We use information for specified service-related purposes and on a basis permitted by law and appropriate to the role of the relevant controller.

• Create and secure accounts, authenticate users, associate them with institutions and show information permitted for their assigned role.
• Support institution-controlled entry, review, approval, publication, retention and verification of academic records.
• Provide support, respond to feedback, communicate about security and resolve errors.
• Prevent unauthorised use, fraud, system interference and security incidents, and keep legally required records.
• Measure performance and improve the public website using limited usage analytics.
• Respond to user requests and provide AI features requested by a user where those features are enabled.

4. Institutional records and role responsibilities

The relevant institution determines which authorised staff may access, review, approve and publish official results according to its responsibilities and applicable law. Having an account alone does not entitle a user to view data; access should follow the assigned role and permission.

To correct a name, mark or official record, contact your institution administrator first. Result Forum will not alter official marks on an unverified request outside the institution's controlled process. Institutions should provide their own privacy notice and establish the legal basis for records they control.

5. Information sharing

Information may be accessed or shared only to the extent needed for the service and by an appropriate recipient, including:

• Institution staff or users authorised for the relevant role.
• A student, parent or guardian where access has been verified and authorised.
• A person using public verification, limited to information the institution has approved for that verification purpose. A verification code is not a password; do not share it unnecessarily.
• Technical service providers needed to operate the platform, such as database/authentication, hosting, performance analytics and an AI provider when its feature is used.
• Public authorities, advisers or other parties where applicable law, a lawful order or protection of rights requires disclosure.

6. Service providers and transfers outside Tanzania

Technical services may include Supabase for database/authentication, Vercel for hosting and performance measurements, PostHog for selected public-site events, and an AI provider such as OpenRouter for the Guardian AI route when enabled. Providers and their roles may change; this notice will be updated when material changes occur.

Some online providers may process or store data in another country. Cross-border transfers will be made only where permitted under Tanzanian law, with the assessments, safeguards and approvals that are required. The data location and terms of each provider should be confirmed by the platform operator before sensitive data is processed.

7. Artificial intelligence (AI) features

When an AI feature is enabled and you use it, your prompt and the context needed to respond may be sent to the AI provider connected to that feature. AI responses may be inaccurate or miss context; treat them as assistance, not as the final source of truth.

AI must not replace an institution's authority over marks, review, approval or publication of official results. Do not use AI alone to make final academic, disciplinary, admissions or student-safeguarding decisions without review by an authorised human.

Do not enter identifiable student information, identifying mark details, passwords, authentication secrets, health information or institutional confidential information into an AI prompt unless you are authorised to do so, a lawful basis exists and approved safeguards are in place.

8. Public verification and sharing codes

The verification feature may respond without requiring an account. Anyone with a valid code may see the information the institution has approved for that verification. Do not post private codes on social media, and institutions should limit the disclosed information to what is necessary to verify a record.

A result shown by Result Forum reflects the record available in the system at the time of checking; it does not replace the authority of the institution or an official examination authority.

9. Information security

We use access controls and technical and organisational measures intended to protect information from loss, misuse, disclosure or unauthorised access. Users should protect passwords, lock devices, use their own accounts and report unusual activity.

No online service can guarantee absolute security. If you suspect account compromise, accidental disclosure of results or a data incident, promptly notify your institution administrator or use Profile → Feedback while signed in.

10. Retention and deletion

Information is retained for as long as needed for the stated purposes, legal requirements, security, dispute handling and a valid institutional records-retention schedule. Retention may differ for accounts, security logs, feedback and official academic records.

Information that is no longer needed will be deleted, destroyed or de-identified where practicable and permitted by law. Backups and technical logs may remain for a limited period until routine deletion cycles complete. A deletion request cannot remove a record that an institution or law must retain.

11. Your personal-data rights

Under Tanzania's Personal Data Protection Act and applicable requirements, you may have rights to:

• Be informed about processing and request access to your personal data.
• Request correction of inaccurate, outdated or incomplete information.
• Request erasure or restriction, object to processing or request portability where the law allows.
• Withdraw consent where processing relies on consent, without invalidating lawful processing that occurred before withdrawal.
• Object to or seek review of a decision made solely by automated processing where that right applies.
• Complain to the Personal Data Protection Commission (PDPC) and seek remedies provided by law.

12. Children, students and guardians

The platform may be used for students under 18. Institutions, parents/guardians and the platform operator should ensure collection and access to a child's data has a lawful basis, is necessary for the stated purpose and is appropriately protected.

Do not publicly disclose a student's marks, identifiers, image or other details without authority and a lawful basis. Parent/guardian access should be verified and limited to information that the person is authorised to see.

13. Cookies, browser storage and analytics

The platform may use browser storage and cookies needed for sign-in, session continuity and security. The website may also use Vercel Analytics/Speed Insights for performance measurements and PostHog for selected public-site events. The current PostHog implementation disables session recording, disables automatic capture and respects the browser's Do Not Track signal where supported.

You can manage cookies through your browser; blocking essential storage may disrupt sign-in or features. Analytics should be limited to appropriate measurement and must not include marks or details from academic records.

14. Changes and privacy requests

We may update this notice when the service, service providers or applicable law changes. The last-updated date appears above. Material changes should be communicated through an appropriate channel.

For academic records, contact your institution administrator first. While signed in, you can use Profile → Feedback and choose a complaint/support category, stating that it is a privacy/data request. If you cannot sign in, ask your institution administrator to forward the request to the platform administrator. Do not send passwords or more record information than is necessary.