Privacy Policy

1. Who decides what happens to your data

If you are a student, a parent or a member of staff at a school that uses SchoolERP, your school decides what data is collected about you and why. Under the Digital Personal Data Protection Act, 2023, your school is the Data Fiduciary and we are its Data Processor: we hold and process the data on your school's instructions and for no purpose of our own.

This means a request to see, correct or erase your data goes to your school first. We will help your school act on it, and we will act directly where the law requires us to.

2. What the platform holds

• Students: name, admission number, class and section, date of birth, guardian details, address, contact numbers, photograph, attendance, marks and results, fee and payment records, and — where the school uses those modules — transport route, hostel allotment, library loans and certificates issued.
• Parents and guardians: name, relationship to the student, contact number, email address, and the payment records associated with their children.
• Teachers and staff: name, role, contact details, qualifications, attendance, leave, and salary records where the school uses the salary module.
• Everyone with an account: email address, sign-in times, and an audit record of the actions they take in the system.

3. What we collect for ourselves

Very little. To operate the platform we hold the school's own account details, its billing contact, its invoices and payment references, and server logs that record requests to the system.

We do not sell personal data, we do not share it with advertisers, and we do not use one school's data to build anything offered to another.

4. Who can see what

Access inside a school is governed by roles the school sets. A teacher sees their classes; a parent sees their own children; an accountant sees fee records. The platform enforces these at the database, not only in the interface.

No signed-in user of one school can read another school's data. Tenant separation is enforced by row-level security on every table, and is independently verified.

Our platform administrators can enter a school's tenancy to provide support. Every entry and every action taken while inside is recorded against the administrator by name in that school's own audit trail.

5. Where the data is held

Records are held in a managed PostgreSQL database, and uploaded files in object storage, both encrypted at rest. Everything travels over TLS in transit.

The current sub-processors and the regions they operate in are listed on the Sub-processors page.

6. How long it is kept

For as long as the school's subscription runs, plus the periods set out in the Data Retention & Deletion Policy. A school's records are its own; we do not delete them because a bill is late.

7. Your rights

• To know what data about you is held, and why.
• To have inaccurate data corrected.
• To have data erased where there is no longer a lawful reason to hold it.
• To nominate someone to exercise these rights on your behalf if you are unable to.
• To complain — to your school, to us, or to the Data Protection Board of India.

8. Children

Almost everyone whose data is in SchoolERP is a child. The Student & Children's Data Policy sets out what follows from that, and it takes precedence over anything in this policy that would be read more loosely.

9. Changes

We will post a revised policy here with a new effective date, and notify schools of any change that materially affects them before it takes effect.