1. Our role

Your School is the data fiduciary for the records it keeps about its students, parents and staff: it decides what is collected and why. We are its data processor and act on its instructions.

For the information needed to run your account itself — your sign-in identity, device tokens, security logs and our contract with the School — we are the data fiduciary.

2. What we collect

• Account information: name, email address, phone number, a generated username, role, and the School you belong to. Passwords are stored only as salted hashes.
• School records entered by the School: class and section, attendance, marks and assessments, fee and payment records, payroll and leave records, transport, hostel and house assignments, documents and certificates, and messages. Which of these exist depends on the modules the School uses.
• Payments: when a fee is paid online, the payment gateway (Razorpay, PhonePe or Paytm, as the School has chosen) processes the card, UPI or bank details. We receive only the gateway's transaction reference, amount and status — never the card number or UPI PIN.
• Device and usage data: a push-notification token, device platform and app version; request logs with IP address, time and the action taken; and error reports. Sign-ins and sensitive actions are logged with the IP address for security and for the consent and audit records the law requires.
• Consent records: which version of the Terms and this Policy you accepted, when, and from which device and IP address.
• Staff attendance (staff app): the time of each check-in and check-out, the phone's location at that moment (latitude, longitude and accuracy) and its distance from the School, how it was done (the app's location or the QR code shown at the School), and any safety flag raised for it. Location is read only when you check in or out, not in the background.
• Conversations: messages between parents and teachers, with the sender, the time, and the names of any files attached. Messages and the files attached to them are deleted automatically after the retention period your School sets (10 days unless changed).
• Check-in photo: where your School turns this on, a selfie taken with the phone's front camera at each check-in and check-out. It is kept in private storage in India and shown only to the School's attendance managers. It is deleted automatically after the retention period the School chooses (1 to 30 days, 7 days unless changed), and only the check-in photo and the latest check-out photo of a day are kept. We do not run face recognition or any biometric matching on these photos.
• Phone identifier for attendance: a random identifier created by the app on your phone (not your advertising ID, IMEI, phone number or contacts), with the phone model, operating system version and app version. The identifier is stored only in scrambled form, unique to each School, so that one phone used to mark attendance for two staff members can be noticed.

3. Why we use it

We do not sell personal data and do not use it for advertising. We do not profile children for any purpose.

• To run the Service for the School and its users, including sign-in, notifications, fee collection and reports.
• To keep accounts and data secure, detect abuse and investigate incidents.
• To meet legal obligations: tax invoices, audit trails for fees, consent records and lawful requests from authorities.
• To keep staff attendance genuine: checking the location, the photo and the phone against the School's rules, so that a check-in made for someone else can be noticed and reviewed by the School. A flag is a signal for the School's administrator to look at, not a finding; the administrator's review, note and decision are recorded.
• To improve reliability, using logs and error reports.

4. Legal basis and consent

We process School records under our contract with the School. Account information is processed with your consent, given when you accept this Policy at sign-up or sign-in, and for the legitimate uses the DPDP Act 2023 allows (such as security and legal compliance).

Records about students are entered by the School, which obtains the consent of a parent or guardian where the law requires it. Parents and guardians with questions about a child's records should contact the School first.

You may withdraw consent for your own account at any time by asking for your account to be deleted (section 8). The School's records are governed by the School's own retention duties.

5. Who we share it with

We do not transfer personal data outside India except to the extent a provider above processes it elsewhere under contractual safeguards.

• Your School: everything you enter and everything the School enters about you is visible to the School's authorised staff.
• Service providers that process data for us: Google Cloud Platform (hosting and file storage, servers in Mumbai, India), MongoDB Atlas (storage of parent-teacher conversations and chat attachment records, cluster in Mumbai, India), Google Firebase (sign-in identity and push notifications), and the email service that sends sign-in codes and notices.
• Payment gateways chosen by the School (Razorpay, PhonePe, Paytm) when you pay fees online; their own privacy policies apply to the payment itself.
• Referral partners ("agents") who introduced the School see the School's name, plan and billing status — never student or staff records.
• Authorities, when the law requires it or to protect someone's safety.

6. How long we keep it

Check-in photos are deleted automatically when the School's retention period ends (7 days unless the School chooses another). Staff attendance records, the attendance corrections a staff member asks for, and the review notes of the School's administrators are kept for the School's payroll and attendance purposes while its subscription lasts.

Account information is kept while your account exists and for 30 days after a deletion request. Fee, payment, invoice and audit records are kept for 8 years as tax and accounting law requires. Security logs are kept for 1 year. Consent records are kept for as long as the account exists plus 3 years.

Records your School controls are kept for as long as the School's subscription lasts and for 60 days after it ends for export, unless the School asks for them to be deleted earlier.

7. Security

Data is encrypted in transit (TLS) and at rest. Passwords are hashed; payment-gateway keys are encrypted. Access is role-based and every change to fee records is written to an immutable audit log. Daily backups are kept. Where a breach affects you, we will tell your School and, where the law requires, you and the Data Protection Board of India.

8. Your rights and choices

• Access and correction: you can see and correct your profile in the app. For School records, ask the School; we will help it respond.
• Deletion: ask for your account to be deleted from Profile → Delete account, or by writing to us. Sessions end at once; the account is deleted after a 30-day grace period (signing in again cancels the request). Records the School controls are not deleted by this request.
• Camera and location: the staff app asks for the camera and for location when you check in or out. You can change these in your phone's settings at any time; if your School requires a photo or location, check-in cannot be completed without them and you should speak to your School administrator.
• Nomination: under the DPDP Act 2023 you may nominate someone to exercise these rights for you if you are unable to.
• Grievance: write to our Grievance Officer (section 10). You may also approach the Data Protection Board of India.

9. Cookies and similar

The web application uses only the cookies and local storage it needs to keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies. Marketing pages may use privacy-respecting analytics that does not identify you.

10. Grievance Officer

Abhinav, EduvionAI (a sole proprietorship of Abhinav). Email: grievance@eduvionai.com. We acknowledge complaints within 24 hours and resolve them within 15 days, as the IT Rules 2021 require. See Grievance Officer.

11. Changes

We may update this Policy. The version date at the top changes when we do; a material change is announced in the Service and accounts are asked to accept the new version at their next sign-in.

12. Contact

Privacy questions: privacy@eduvionai.com. Postal address: EduvionAI (a sole proprietorship of Abhinav), Hisar, Haryana 125001, India.