The operator agreement, on one page.
What Slooch agrees to when it processes a school's learner, family and staff information on the school's behalf.
Summary updated October 2026
The full operator agreement is signed by the school and Slooch before any of the school's information is loaded. This page explains it in plain language; where the two differ, the signed agreement applies.
Parties and roles
The school is the responsible party under POPIA: it decides why and how learner, family and staff information is processed. Slooch is the operator: it processes that information only on the school's written instructions, under the licence the school signs.
Each side names a contact for the agreement, and the school names its information officer.
Purpose limitation
Slooch uses the school's information only to run Slooch for that school: registers, marks, forms, fees, notices and the other modules the school switches on.
The school's information is never sold, never used for advertising, never used to train AI models and never used to rank children. One school's information is never combined with another's.
Security measures
Slooch keeps appropriate technical and organisational measures in place for as long as it holds the school's information, including these.
- Encryption in transit and at rest.
- Access by role and relationship: a teacher sees their own classes, a parent their own children, the finance office its accounts.
- A log of who changed what, and when, for every change.
- Slooch staff open a school's information only to support that school, with two-step sign-in, and each access is logged.
- Backups, tested restores and a written incident plan.
Sub-operators and hosting
Live school information will be hosted in South Africa. Every sub-operator, such as hosting and email or SMS delivery, is named in the agreement and bound by the same terms.
The school is told in writing before a new sub-operator is added, with time to object.
Breach notification
If Slooch has reason to believe the school's information has been accessed or acquired without authority, it tells the school's information officer immediately, in writing: what is known, what has been done and what happens next.
The school decides on notifying the Information Regulator and the people affected, and Slooch gives the school what it needs to do so.
Data subject requests
Learners, parents and staff can ask to see, correct or delete their information. Those requests go to the school. If one reaches Slooch, we pass it to the school within two school days and help the school answer it.
Retention and return
Slooch keeps the school's information only while the agreement runs, and only for as long as the school's retention rules allow. The school can export its information at any time.
When the agreement ends, the school receives a full export. Slooch then deletes its copies within 30 days, and backups expire within a further 60 days.
Audit
The school may check that Slooch keeps to the agreement, once a year on reasonable notice and after any breach. Slooch shares its latest security review and answers the school's questions in writing.
Termination
Either side may end the agreement as the licence sets out, and a school can stop at the end of any term. Before anything is deleted, the school receives its export and confirms it is complete.
The duty to keep the school's information confidential continues after the agreement ends.
Questions about the agreement go to hello@slooch.app. We reply within one school day.
Become a Slooch school.
Book a 45-minute walkthrough. We show your principal, a teacher and the office one school week on Slooch, from the trip notice on Monday to the marks on Friday, and answer whatever you ask.