Privacy Policy

We collect the following categories of personal data:

• Institute administrators & staff: name, email address, phone number, role.
• Students: name, phone, email, date of birth, batch, fee details, academic records, attendance.
• Parents: name, phone number, push notification subscription tokens.
• Usage data: pages visited, actions performed, timestamps — collected automatically for security and analytics.
• Device data: browser type, OS, IP address — collected by our infrastructure providers.

We do not collect Aadhaar numbers, financial account details, or biometric data.

• To provide and operate the ShikshaOS service.
• To send fee receipts, notices, homework alerts, and other institute communications.
• To deliver push notifications and WhatsApp/SMS messages you have opted into.
• To detect and prevent fraud, abuse, and security incidents.
• To improve the platform based on aggregated, anonymised usage patterns.
• To comply with legal obligations.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Under the DPDP Act 2023, we process personal data on the basis of:

• Consent — obtained from users at registration and for optional features such as push notifications.
• Legitimate use — processing necessary to provide the contracted service to the institute.
• Legal obligation — where required by Indian law.

Your data is stored on servers located in India via our infrastructure providers (Supabase and Vercel), both of which offer India-region data residency. Files such as institute logos and signatures are stored in cloud object storage within the same region.

We use the following third-party processors:

Each provider processes data only as necessary to deliver their service and under their own privacy commitments.

• Active institute data is retained for the duration of the subscription.
• On termination, data is retained for 30 days to allow export, then deleted.
• Anonymised usage analytics may be retained indefinitely.
• Legal hold: we may retain data longer if required by a court order or regulatory authority.

As a Data Principal under the DPDP Act, you have the right to:

• Access — request a copy of your personal data we hold.
• Correction — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your data (subject to legal retention obligations).
• Withdraw consent — opt out of non-essential processing such as push notifications at any time.
• Grievance redressal — raise a complaint with our Grievance Officer (see Section 10).

To exercise any of these rights, email support@shikshaos.in. We will respond within 30 days.

We implement industry-standard security measures including TLS encryption in transit, Row Level Security (RLS) on the database, role-based access controls, and server-side session management. No system is completely secure; in the event of a data breach we will notify affected parties as required by applicable law.

ShikshaOSmay store student records that include minors. This data is provided by and under the responsibility of the subscribing institute, which acts as the Data Fiduciary for its students. We process such data solely on the institute's instructions.

In accordance with the IT Act 2000 and DPDP Act 2023, we have designated a Grievance Officer:

ShikshaOS uses strictly necessary cookies for session management and authentication. We do not use advertising or third-party tracking cookies. No cookie consent banner is shown because no non-essential cookies are set.

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notice at least 14 days before they take effect. Continued use ofShikshaOS after changes constitutes acceptance of the updated policy.

For any privacy-related queries, contact us at: support@shikshaos.in
Zynverse Technologies