Privacy policy
Last updated 23 October 2026
In short, SUAAMS records class attendance. It never collects your fingerprint or face, never tracks your location, and keeps only what attendance needs: who you are, which courses you take, when you checked in, and an ID for the phone your account is locked to. Your institution's administrators and your lecturers can see your attendance. We don't sell or share your data for advertising.
Who we are
SUAAMS, short for Smart Universal Automated Attendance Management System, is a class attendance system with a mobile app, door readers and a web portal at portal.suaams.com.ng. It was built as a final-year engineering project, and a pilot is planned. Questions about this policy or your data go to contact@suaams.com.ng.
Your institution creates your account and decides who is enrolled and who can see attendance. SUAAMS handles the data to run the attendance service for it.
What we collect
| Data | Why |
|---|---|
| Name, matric or staff number, department and level | To know who you are and which classes are yours. Your institution provides these. |
| Username and password | To sign you in. We store only a one-way bcrypt hash of your password. Nobody can read the password from it, administrators included. |
| Phone ID | Your account is locked to one phone so nobody else can check in as you. This is the ID Android or iOS gives the app. It isn't your phone number or IMEI. |
| Courses and timetable | To show your classes and work out which class a check-in belongs to. |
| Attendance records | When you checked in, which reader you used, how you checked in and your status. How is an NFC tap, Bluetooth or a lecturer marking you. Status is present, late, absent or excused. |
| Results | If your department enters course scores and grades, we store them so you can see them. |
| Notification token | A code from Google or Apple that lets us send you push notifications, such as "you've been marked present". It identifies the app on your phone, not you. |
| Staff activity | When staff change something in the portal, we record who did it, what changed and their IP address, so every change can be traced. |
What we don't collect
- Fingerprints or face data. Your phone checks your fingerprint or PIN itself and only tells the app whether it matched. The fingerprint never reaches the app, let alone our servers.
- Your location. Tapping the reader proves you're in the room, so GPS isn't needed. Android 11 and older won't let any app scan for Bluetooth without the location permission, so SUAAMS asks for it on those phones for that reason only. It never reads your location. Newer versions of Android don't ask.
- Contacts, photos, messages or browsing. The app has no permission to read them.
Permissions the app asks for
- Fingerprint or face unlock. Confirms it's you before each check-in.
- NFC. Lets your phone pass its check-in code to the reader when you tap.
- Bluetooth. The fallback for phones without NFC. The app listens for the reader's short code.
- Notifications. Tells you when you've been marked, and about announcements.
Who can see your data
- You see your own attendance, courses, timetable and results.
- Your lecturers see attendance for the courses they teach.
- Your head of department sees attendance for students in the department.
- Your institution's administrators see what they need to run the system, including your phone binding, so they can unbind it when you change phones.
We don't sell your data or use it for advertising.
Services that handle data for us
SUAAMS runs on these providers. Each handles data only to provide its service. Some of them store data outside Nigeria.
- Render hosts the server and web portal in the United States.
- Clever Cloud hosts the database.
- Google Firebase Cloud Messaging delivers push notifications using the notification token. On iPhone, Apple's push service does the same job.
- Talsec's freeRASP runs the app's tamper check. It reports device-security signals, such as whether a phone is rooted, so the app can block tampered phones. It doesn't receive your name or attendance.
How we protect it
- The app, readers and portal only talk to the server over encrypted HTTPS connections.
- The server signs every check-in code. Each code belongs to one student and one class and expires after 10 seconds.
- Database backups are encrypted.
- The portal logs every change staff make, with their name.
How long we keep it
Attendance is part of your academic record, so we keep it for as long as your institution keeps academic records. When you graduate or leave, your institution switches off your sign-in, but your attendance history stays so it can still be checked. We delete notification tokens when you sign out or when they stop working.
Your rights
Under the Nigeria Data Protection Act 2023 you can ask to see the data we hold about you, have it corrected, object to how it's used, or ask for it to be deleted where it isn't needed as part of your institution's records. Email contact@suaams.com.ng or ask your department's administrator. If you're unhappy with our answer, you can complain to the Nigeria Data Protection Commission.
Changes to this policy
If what we collect changes, we'll update this page and the date at the top.