Legal
Privacy Policy
Effective 16 September 2026
Attender helps schools take attendance. This policy explains what the Attender website, the Attender mobile app, and the Attender API collect about you, why, who else sees it, how long it is kept, and what you can do about it. It applies to lecturers, students and school administrators.
1. Who is responsible
Your school decides to use Attender and decides who is invited. For the attendance records it keeps about its students, your school is the data controller and Attender processes that data on its behalf. For your account itself (sign in, security and service messages), Attender is responsible. Questions about either can be sent to hello@karmat-hq.com, and we will pass anything that belongs to your school on to them.
2. What we collect
| Data | When | Why |
|---|---|---|
| Name, school email address, role, department, and for students a matric number | When you register or accept an invitation | To create your account and show you on the right course rosters |
| Password (stored only as a one way hash) | When you set or change it | To sign you in |
| Your location: latitude, longitude and reported accuracy | Only at the moment you open or mark an attendance session, and only while the app or website is open. On the web, your browser asks your permission first | To confirm you are inside the range your lecturer set. It is stored on that attendance record so a lecturer can review a refused attempt |
| A face profile: a list of numbers computed from your photos | Only if you choose face check in, or agree to your lecturer setting it up. On the web the camera is used only on the face screens, after your browser asks you | To confirm that the person checking in is you. Photos are processed in memory and never stored |
| Attendance records: present, absent, time and method | Each time a session runs on your course | The service your school uses Attender for |
| Push notification token for your phone | When you allow notifications in the app | To tell you a session has opened, or that a summary is waiting |
| A browser notification preference | If you turn on browser notifications in your web profile | Kept only in that browser, to tell you a session has opened while Attender is in the background |
| IP address, device type, sign in times, and API usage counts | When you use the service | Security: rate limiting, detecting stolen sessions, and investigating abuse |
| An optional profile picture link | If you add one | Shown next to your name |
We do not track your location in the background, we do not use advertising identifiers, we do not sell personal data, and we do not use your data to train any model.
3. Face check in
Face check in is optional. Manual check in (one tap inside the range) always remains available. If you enable face check in:
- Your photos are turned into a numeric profile and then discarded. The profile cannot be turned back into a picture.
- A check in photo is compared only with your own profile. Attender never searches one face against other people's faces.
- You can delete your face profile at any time from your profile screen. Deleting it switches you back to manual check in.
- If a lecturer sets up your profile for you, you are notified, and you can remove it the same way.
5. How long we keep it
- Your account is kept while it is active and your school uses Attender.
- Attendance records belong to your school's academic record and are kept for as long as your school requires.
- Email verification codes expire after 15 minutes and password reset links after 30 minutes.
- Sign in sessions last at most 30 days, and end immediately when you sign out everywhere or change your password.
- Your face profile is kept until you delete it or delete your account.
- Notifications are kept until you delete them or delete your account.
6. Deleting your account
You can delete your account yourself at any time: in the mobile app under Profile, then Delete account, or on the web at the bottom of your Profile page (lecturers) or My attendance page (students). Deletion removes your face profile, push tokens, notifications, sessions and course memberships at once. Your name, email address and other details are erased from your account. Attendance your school already recorded is kept, without your name, because it is part of the school’s record. See how to delete your account for the steps, including what to do if you can no longer sign in.
7. Your rights
Depending on where you live, including under the Nigeria Data Protection Act 2023 and the GDPR, you can ask to access, correct, export, or delete your personal data, object to or restrict how it is used, and withdraw consent for face check in. Most of this you can do yourself in your profile. For anything else, email hello@karmat-hq.com. Requests about attendance records may be passed to your school, which controls them. You may also complain to your data protection authority.
8. How we protect it
- All traffic is encrypted in transit, and passwords, API keys and one time codes are stored only as hashes.
- On phones, sign in tokens are kept in the device's secure keychain.
- Sign in attempts, codes and requests are rate limited, and reuse of a stolen session ends every session on the account.
- Every school, and every lecturer within a school, is isolated from the others.
No system is perfectly secure. If you believe your account or data has been compromised, contact hello@karmat-hq.com straight away.
9. Children
Attender is built for colleges and universities. It is not directed at children under 13, and people under the age required by local law may only use it where their school has arranged it with the appropriate consent.
10. Changes to this policy
We will post any change here and update the effective date. If a change is significant, we will also tell you by email or in the app before it takes effect.
11. Contact
Email hello@karmat-hq.com with any question about privacy or this policy.