Privacy Policy

EdCo Tech (SMC-Pvt) Ltd. (“EdCo”, “we”, “us”) operates the EdCo mobile application and related web services (together, the “Platform”), which help schools, colleges, businesses and other organisations (“Institutions”) issue invoices and collect payments. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using the Platform, you agree to the collection and use of information as described here. If you do not agree, please do not use the Platform.

Who this policy covers

We collect information from two kinds of people: Institution staff who use the EdCo app to manage billing (account holders), and the customers, students or members an Institution bills through the Platform (“Payers”). Information about a Payer is entered and controlled by the Institution — EdCo processes it on the Institution’s behalf, as described below.

Information we collect

• Account information: name, email, mobile number and password, for anyone who logs into the EdCo app.
• Institution & billing data: entity, branch and Payer records entered by Institution staff — names, contact details, identity numbers (CNIC, B‑Form or passport, where an Institution chooses to record them), invoices, discounts, payment history and balances.
• Payment information: transaction references, amounts and status from 1LINK (1BILL and RAAST) and Bank Alfalah’s Alfa Payment Gateway. EdCo does not store full card numbers or bank credentials — these are handled directly by the payment processor.
• Device & usage information: app version, device type, push‑notification tokens, and basic diagnostic logs, to keep the Platform running and secure.

Children’s information

Where an Institution is a school or college, records may relate to students who are minors. This information is provided and controlled by the Institution (as the data controller for its own students) and, indirectly, by parents or guardians who make payments — it is not collected by EdCo directly from a child through the app. Institutions are responsible for having the appropriate consent to share student information with EdCo for billing purposes.

How we use information

• To operate the Platform — generate invoices, process payments, calculate discounts and penalties, and keep records reconciled.
• To send invoices, receipts, payment reminders and account notifications by email, WhatsApp and push notification.
• To provide customer support and respond to enquiries.
• To detect and prevent fraud, and to comply with legal and regulatory obligations, including those of our payment partners.
• To improve the Platform’s reliability and features.

Who we share information with

We share information only as needed to run the Platform:

• Payment rails & processors: 1LINK (Guarantee) Ltd. (1BILL, RAAST) and Bank Alfalah Limited (Alfa Payment Gateway), to process payments.
• Communications providers: Amazon Web Services (email), Meta (WhatsApp Business Platform) and Google Firebase (push notifications), to deliver invoices, receipts and reminders.
• Cloud infrastructure: Amazon Web Services and Google Cloud, to host the Platform and store data securely.
• Legal & safety: where required by law, regulation, or to protect the rights and safety of EdCo, Institutions or Payers.

We do not sell personal information to third parties.

Data retention

We retain billing and payment records for as long as an Institution’s account is active, and afterwards for seven years, as required for accounting, tax and regulatory record‑keeping under Pakistani law.

Financial records, such as invoices, payments, receipts and balances, are kept for that full period. Each record stays linked to the account that made or received it, so that transactions can be audited and traced if needed for legal or regulatory purposes.

Identity details of account holders (name, email, mobile number and identity number) are kept in a restricted‑access record for the same period. Only authorised EdCo staff can access this record, and only for legal, regulatory, audit or dispute purposes. Access is logged.

Deleting your account

Account holders can request deletion of their account from within the app (Settings › Delete account). Deleting your account:

• signs you out immediately and stops you from logging in again;
• removes your personal details from everyday use in the app and from the Platform’s screens, so they are no longer shown to you or to other users; and
• keeps the financial records described above, as required by law. These records are no longer shown in the app.

Deletion is not reversed by reinstalling the app. If you believe you were deleted in error, contact us through our contact form and we will review your request.

Security

We use industry‑standard safeguards — encryption in transit, access controls and secure cloud infrastructure — to protect information on the Platform. No system is completely secure, and we encourage account holders to use a strong, unique password and keep their device secure.

Your choices & rights

Account holders can review and update their account information from within the app. A Payer who wants to access, correct or remove their information should contact the Institution that holds their record, as the Institution controls that data; EdCo will assist the Institution in fulfilling such requests where required. Account holders can delete their account at any time, as described under “Deleting your account”.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date, and, for material changes, notify account holders through the app.

Contact us

Questions about this Privacy Policy can be sent through our contact form.