Privacy Policy

Last updated: 12 August 2026

OBAXY is a school management platform operated by Creaxe (Pvt) Ltd ("we", "us"). This policy explains what information OBAXY handles, why, and what rights schools and families have over it. It applies to the OBAXY web application, the OBAXY mobile app, and messages we send on a school's behalf.

The short version. Schools own their data; we process it for them. We do not sell personal information, we do not use it for advertising, and we do not share one school's data with another. Data about a child is visible only to that child's school staff and their own registered guardians.

1. Who controls the data

Each school is the data controller for its students, guardians and staff. Creaxe (Pvt) Ltd is the data processor: we store and process that information on the school's instructions, under our agreement with them. For account information belonging to the school itself, we are the controller.

2. What we collect

Students: name, date of birth, B-Form number, class and section, photograph, guardian links, attendance, marks, fee records, and other school records the school chooses to keep.
Guardians and staff: name, CNIC, phone number, address, role, and login credentials.
School records: classes, timetables, fee structures, invoices, payments, announcements.
Technical data: log entries needed to operate the service securely, such as sign-in events, IP address and device type.

We collect this information because a school enters it, or because it is generated by using the service. We do not buy personal data from third parties.

3. How we use it

To run the school's operations: enrolment, attendance, fees, homework, exams and results.
To notify guardians about their own child — attendance, fee challans, results, announcements and similar updates — by WhatsApp, SMS and in-app notification.
To authenticate users, including sending one-time login codes.
To keep the service secure, diagnose faults, and meet legal and audit obligations.

We do not use school, student or guardian data for advertising, and we do not sell it or rent it to anyone.

4. Children's information

OBAXY holds information about minors because schools keep records about their pupils. Children do not sign up for OBAXY themselves. Access to a child's record is limited to authorised staff of that child's school and to guardians the school has verified and linked to that child. Guardian consent is obtained by the school as part of enrolment.

5. Messaging

We send messages to guardians and staff on the school's behalf using the WhatsApp Business Platform and, where applicable, SMS. These are service messages about a recipient's own child or their own account — fee notices, attendance alerts, results, meeting bookings and login codes. They are not marketing messages. A recipient can ask their school to stop messaging a number at any time.

6. Sharing

We share personal information only with:

Infrastructure and messaging providers that operate the service on our behalf (hosting, storage, WhatsApp/SMS delivery, push notifications), bound to process it only for us.
Authorities, where we are legally required to do so.

We never share one school's data with another school. Schools are isolated from each other at the database level, not merely filtered in the application.

7. Security

Data is encrypted in transit. Access is controlled by role, so a user sees only what their role permits. Every school's records are separated by database-level isolation rules, and administrative actions are recorded in an audit log.

8. Retention

School and academic records are kept for as long as the school's account is active, and afterwards for as long as the school or the law requires — financial records in particular must be retained. Where a record must be removed, we anonymise it rather than delete it outright, so that financial and academic history stays consistent.

9. Your rights

Guardians and staff may ask to see, correct, or restrict the use of their information. Because the school controls the record, please contact your school first — they can act immediately. If you cannot reach them, write to us at privacy@obaxy.com and we will assist the school in responding.

10. Changes

If we change this policy we will update the date above and, for material changes, notify schools through the platform.

11. Contact

Creaxe (Pvt) Ltd
Email: hello@obaxy.com
Privacy: privacy@obaxy.com
WhatsApp: +92 321 971 2255