Privacy Policy

Last updated: August 22, 2026

1. Introduction

This Privacy Policy explains how The American Foundation School ("TAFS", "we", "us", or "our") collects, uses, discloses, and safeguards information through TAFSync, our school management platform, including the TAFSync web application (accessible at tafs.edu.pk), the TAFSync mobile application for students and parents, and the TAFSync Staff mobile application for employees (together, the "Platform").

The Platform is used by TAFS students, parents/guardians, teachers, and staff for purposes such as attendance, fee management, communication, academic records, and school administration. By using the Platform, you agree to the collection and use of information in accordance with this policy.

2. Scope of This Policy

This policy applies to all users of the Platform, including students, parents/guardians, employees (teaching and non-teaching staff), and administrators of TAFS. Where the Platform is used by or on behalf of a minor (a student under 18 years of age), the student's account and related data are managed under the supervision of the school and the student's parent or guardian, who provides consent on the student's behalf.

3. Information We Collect

We collect the following categories of information:

a. Identity & Contact Information

Full name, date of birth, gender, photograph, phone number, email address, home address, CNIC/B-Form number, and emergency contact details for students, parents, and employees.

b. Academic & Enrollment Records

Class/section enrollment, academic progression, grades, attendance records, rollcall/check-in data, and disciplinary or notice-board communications. For employees, this also includes staff attendance records and leave requests/approvals.

c. Financial Information

Fee vouchers, payment history, discounts, bank and postdated cheque details, and other billing records necessary to manage tuition and fee accounts. For employees, this also includes salary and payroll details, bank account information for salary disbursement, and payroll settlement records. We do not store full payment card numbers; payments are processed through the relevant bank or payment channel.

d. Communications

Messages, attachments, and voice notes sent through the in-app chat and support ticket features, and notifications sent to your device.

e. Device, Authentication & Usage Information

Login session data, IP address, device/browser type, app version, and push-notification tokens. On the mobile app, if you enable biometric login (fingerprint/face unlock), the biometric data itself is processed and stored entirely on your device by your device's operating system — TAFS never receives or stores your biometric data.

f. Media & Permissions (Mobile App)

With your permission, the mobile app may access your camera/photo library to upload a profile photo or share images in chat, and your microphone to record and send voice notes. These permissions are only used when you actively choose to use the related feature.

4. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Platform's features (attendance, fees, enrollment, timetables, HR, payroll, leave management, reporting, etc.);
Verify identity and secure accounts, including through login sessions and OTP verification;
Facilitate communication between school, staff, students, and parents, including notices, alerts, and support tickets;
Process and record fee payments, generate vouchers, and maintain financial records;
Track attendance and academic progress;
Send service-related push notifications and email/SMS alerts;
Maintain the security, integrity, and proper functioning of our systems, including detecting and preventing fraud or misuse; and
Comply with applicable legal, regulatory, and educational record-keeping obligations.

6. Cookies & Local Storage

The web application uses a secure, HTTP-only session cookie to keep you signed in; this cookie cannot be read or modified by JavaScript. We may also use local storage on your device to remember preferences such as theme (light/dark mode). We do not use third-party advertising or tracking cookies.

7. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including role-based access controls, encrypted transmission (HTTPS), secure httpOnly session cookies, and server-side authorization checks on every request. Access to student, parent, and employee records is restricted to authorized personnel based on their role within the school. While we work hard to protect your data, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain personal information for as long as necessary to provide the Platform's services and to fulfil the purposes described in this policy, including satisfying academic record-keeping, financial, and legal requirements. Academic and financial records may be retained beyond the end of enrollment as required by law or school policy. When information is no longer needed, we take reasonable steps to securely delete or anonymize it.

9. Children's Privacy

The Platform is used by students of TAFS, including minors, as part of their enrolment at the school. Student accounts and data are created and managed by the school in cooperation with the student's parent or guardian. Parents/guardians may contact us at any time (see Section 13) to review, correct, or request deletion of their child's information, subject to the school's record-keeping obligations.

10. Your Rights and Choices

Subject to applicable law, you may:

Request access to, or a copy of, the personal information we hold about you;
Request correction of inaccurate or incomplete information;
Request deletion of your information, where retention is not otherwise required for academic, financial, or legal purposes;
Withdraw consent for optional features such as push notifications or biometric login at any time through your device settings; and
Object to certain uses of your information by contacting us.

How to request deletion of your data (TAFSync app & TAFSync Staff app)

To request deletion of your personal data from either the TAFSync mobile app (students/parents) or the TAFSync Staff mobile app (employees), email info@tafs.edu.pk from your registered email address, or contact the school office directly, and state:

Your full name and the app you use (TAFSync or TAFSync Staff);
Your username, student GR number, or employee code; and
That you are requesting deletion of your account and personal data.

We will verify your identity and act on your request. Login credentials, device push-notification tokens, and personal profile details (contact info, photos, chat messages) are deleted from our active systems once the request is processed. Academic records, attendance, fee/financial records, and payroll/employment records are retained beyond that point, and are only removed once no longer required to satisfy academic, financial, tax, or legal record-keeping obligations under applicable law and school policy — there is no fixed additional retention period beyond what the law requires.

To exercise any other rights listed above, please contact us using the details in Section 13.

11. Third-Party Services

The Platform may use trusted third-party service providers to deliver certain functionality, such as cloud hosting, and push notification delivery (Firebase Cloud Messaging). These providers only process data as necessary to provide their service to us and are contractually obligated to protect it. The Platform does not integrate third-party advertising networks or sell data to data brokers.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this page when we make changes, and, where appropriate, notify users through the Platform.