For authorities and regulators
What education authorities, the data protection authority and other regulators may want to know about Shaaro, in one place.
1. The operator
| Item | Detail |
|---|---|
| Name | Studio Imagine (operator of Shaaro) |
| Registered address | 83/B Shiddeshwari Circular Road, Malibag, Dhaka 1219 |
| Trade licence | TRAD/DSCC/286032/2019 |
| e-TIN | 252007746813 |
| Contact, including data protection | hello@shaaro.app |
| Website | shaaro.app |
2. How we meet each law
| Law | What Shaaro does |
|---|---|
| Personal Data Protection Ordinance 2025 and the law that follows it | Only the data we need; a record of guardian consent for students, with date and policy version; no profiling, behavioural tracking or targeted ads for children; rights to see, correct, download and delete; breach notification to the authority. |
| Children Act 2013 | The child's best interest comes first; outside the school only a student's first name and class are shown; officers and trainers see numbers only; child-safety reports are handled first. |
| Cyber Security Ordinance 2025 | Encryption, role-based access, security and change logs; harmful content removed quickly; cooperation with lawful requests. |
| Information and Communication Technology Act 2006 | Electronic records, with the time and method of each consent kept, and a log of every change to marks, attendance and results. |
| Copyright Act 2023 | Questions are written in our own words from NCTB textbooks, each tied to a book chapter; no long passages copied word for word; the author teacher is credited. |
When laws or rules change, we update our policies and software. If you notice a gap, please tell us at hello@shaaro.app.
3. Where data is kept
Data is currently held in a Supabase cloud data centre, encrypted at rest and in transit. Photos and files sit in private storage. If the law or an agreement with the authority requires data to stay in the country, we are ready to move it to a data centre in the country. On request we export anonymised data for an authority's area.
| Service provider | Purpose | Location |
|---|---|---|
| Supabase | Database, login and files | Cloud data centre |
| Vercel | Hosting the website | Global network |
| Cloudflare | Bot check on some forms (Turnstile) | Global network |
| SMS provider | Messages to guardians, when the school uses SMS | To be named when chosen |
| Resend | Sending email | Global |
| Optional login | Global | |
| Anthropic | Drafting teachers' posts, with student names removed | Global |
| Open-Meteo | Rain alerts, using only the school's location | Global |
4. What each level can see
| Level | Sees |
|---|---|
| Teacher | Names, results and attendance for their own classes |
| Head teacher | All classes in their school |
| Teacher trainer | School-level numbers for their cluster, with no student names |
| Upazila | School-level numbers, with no student names |
| District and centre | Upazila and school-level numbers |
Officers' and trainers' screens show counts only, never a student's name or marks. Reports a school sends to an office hold totals only.
5. Child safety
- Students cannot send private messages to each other.
- Students' notes and quizzes are seen by their own subject teacher first, and only then by others.
- Outside the school, only a student's first name and class are shown, never the school or the photo.
- A student's post with a face in the photo is never approved, and three reports hide a post. Child-safety reports from the "Report" button are handled first.
- A skill group is guidance and a teacher can change it. No significant decision about any student is made automatically.
6. Security measures
Logging in only proves who you are. Nobody picks their own role: a head teacher is confirmed with a Shaaro team code, or the school stays provisional; a teacher joins a school already on Shaaro with the head teacher's approval; an officer's account is tied to the post's official mobile.
- Data encrypted at rest and in transit (TLS).
- Role-based access on every database row: nobody gets data outside their own area.
- Five wrong PINs or passwords within 15 minutes lock that login for a while; two-step verification on the Shaaro team console.
- A log of every change to marks, attendance, grades, result sheets and the register, and of every Shaaro team decision.
- Classroom screens are recognised by a hash of their token only; photos and files sit in private storage.
7. Question quality
Every question is linked to a chapter of an NCTB textbook. A teacher's question is checked in two rounds: first by another teacher at the author's school, then by a teacher at another school. A question not yet checked carries a "Not checked yet" label. When three people or five browsers report a question, it is set aside, and the Shaaro team decides whether to keep it or fix it.
8. How authorities can send requests
- Send a signed letter on official letterhead to hello@shaaro.app with the subject "Official request", naming the requesting officer, their post and the legal provision.
- We verify the request by calling the office's official number.
- We provide only the data the law requires.
- We tell the affected user unless the law forbids it.
- For urgent child-safety matters, write to the same address with the subject "Urgent". These get the fastest response.
9. Documents available on request
- Data-flow diagram
- Data protection impact assessment
- Security summary
- Full list of service providers and contract terms
- Sample guardian consent form
Ask at hello@shaaro.app. We usually send them within 10 working days.