Privacy Policy

This policy explains what personal data Eduvedha handles, why, how it is protected, and the rights you have. Eduvedha is operated by [Company Legal Name] (“Eduvedha”, “we”, “us”), [Registered office address].

1. Scope and the law we follow

This policy covers the Eduvedha website (https://eduvedha.com), the Eduvedha web application, and the Eduvedha parent, staff and driver mobile apps (together, the “Service”).

We process personal data in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) and the Information Technology Act, 2000, as they apply. Terms such as Data Fiduciary, Data Processor, Data Principal and personal data breach have the meaning given in the DPDP Act.

A school’s own website built on Eduvedha, and any privacy notice a school gives you, belong to that school. The school’s notice explains how the school uses your data.

2. Our two roles

How we act as a processor for schools is set out in the Data Processing Summary.

3. Personal data we handle

3.1 As Data Fiduciary

• Account data: name, e-mail address, mobile number, school name, role and sign-in credentials. Passwords are stored only as salted one-way hashes.
• Billing data: subscription plan, invoices, GSTIN and billing address, payment reference and status. Card, UPI and bank details are entered with the payment gateway; we do not store them.
• Support and enquiries: what you tell us by e-mail, form, phone or chat.
• Technical and security data: IP address, browser and device type, sign-in times, failed sign-in attempts, and audit records of changes made in the Service.

3.2 As Data Processor for schools

What is stored depends on the modules a school uses. It can include:

• Students: name, date of birth, gender, photo, admission and class details, attendance, marks, report cards, certificates, fees and receipts, health records, transport details and documents the school uploads.
• Parents and guardians: name, relationship to the student, mobile number, e-mail address, address, fee payments and messages.
• Staff: name, contact details, qualifications, attendance and leave, payroll and documents.
• Face-attendance data: only if a school turns on face attendance — a numerical face template created from a photo, used only to mark attendance.
• Vehicle location: only if a school uses bus tracking — the location of school vehicles, sent from the driver app.
• Messages: notices, e-mails, SMS, WhatsApp and app notifications the school sends, and their delivery status.

4. Why we use personal data

4.1 As Data Fiduciary

• to create and manage subscription accounts and provide the Service;
• to bill, collect payment and keep tax and accounting records;
• to answer support requests and send service messages (for example security alerts, renewal reminders and changes to our terms);
• to keep the Service secure, prevent fraud and misuse, and investigate incidents;
• to comply with the law and with lawful requests from authorities.

We process this data with your consent, or for a legitimate use allowed by Section 7 of the DPDP Act — for example, where you have given us the data voluntarily for a specific purpose (such as opening an account), or where the law requires it. We send marketing e-mails only if you agree, and you can opt out at any time. [We may use aggregated, de-identified usage statistics to improve the Service.]

4.2 As Data Processor

We use school data only to provide the Service to that school, on the school’s instructions (the school’s set-up and use of the Service are its instructions), and to keep the Service secure. We do not use it for our own purposes, we do not sell it, and we do not use it for advertising. The school is responsible for having a lawful basis for its processing and for giving notice to its students, parents and staff.

5. Children’s data

Most students are children (under 18) under the DPDP Act.

• The school, as Data Fiduciary, obtains verifiable consent from a parent or lawful guardian before processing a child’s personal data, except where the DPDP Act or DPDP Rules exempt the processing. The DPDP Rules include specific exemptions for educational institutions; each school decides with its own advisers whether one applies.
• Student and parent app accounts are created by the school, not through open sign-up.
• We do not track or behaviourally monitor children for our own purposes, we do not direct advertising at children, and we do not process children’s data in any way likely to harm their well-being.

6. Who we share data with

• Sub-processors that help us run the Service (listed below). They may use the data only to provide their service to us, under written contract.
• Services a school connects: when a school connects its own payment gateway, SMS or WhatsApp provider, e-mail server or other integration, data goes to that provider under the school’s own agreement with it.
• Authorities: when required by law, a court order or a lawful request from a government agency. Where the data belongs to a school, we tell the school unless the law forbids it.
• Business transfer: if Eduvedha is merged or sold, personal data may pass to the new owner, subject to this policy and with notice to you.

We do not sell or rent personal data.

Sub-processors

7. Where data is stored

The Service and its database are hosted in [India - hosting region]. Some sub-processors (for example push-notification or AI providers, where enabled) may process data outside India. We transfer personal data outside India only as permitted by Section 16 of the DPDP Act and any restrictions notified by the Central Government.

8. How long we keep data

• Account and billing data: while the subscription is active, then for up to [8] years where tax, accounting or company law requires it.
• Security and access logs: [1 year], the minimum period the DPDP Rules require for detecting and investigating unauthorised access, or longer where another law requires.
• School data: while the school’s subscription is active. When it ends, the school can export its data for [30] days; we then delete it from live systems within [30] days, and backup copies are overwritten within [90] days. A school may ask us to delete its data sooner.
• Enquiries and support messages: [24 months] after the last contact.

9. How we protect data

• Encrypted connections (HTTPS/TLS) between browsers or apps and the Service.
• Passwords stored only as salted one-way hashes; sign-in attempts are rate-limited.
• Integration secrets — payment-gateway keys, SMS and WhatsApp gateway credentials, push-notification keys and backup-destination credentials — are encrypted at rest.
• Each school’s data is kept separate from other schools’ data, and within a school, access is limited by the role-based permissions the school sets.
• Audit trails of important changes and sign-in logs, used to detect and investigate unauthorised access.
• Regular database backups [with copies stored off-site], so the Service can be restored after an incident.
• Access to production systems only for authorised personnel who need it, under confidentiality obligations.

No system is completely secure. If you think your account has been misused, contact us straight away.

10. Personal data breaches

• Data we control: we inform affected people and the Data Protection Board of India without delay, and give the Board a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows), as the DPDP Rules require.
• School data: we notify the affected school without undue delay, and in any case within [24] hours of becoming aware, with the information the school needs to inform the Board and the people affected. We help the school contain and fix the problem.
• Where the law requires it, we also report cyber security incidents to CERT-In (currently within 6 hours of noticing them).

11. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data being processed about you, the processing activities, and who it has been shared with;
• have inaccurate or incomplete data corrected, completed or updated;
• have data erased when it is no longer needed for its purpose or you withdraw consent, unless the law requires it to be kept;
• withdraw consent at any time, as easily as you gave it (processing before the withdrawal remains lawful);
• nominate another person to exercise your rights if you die or become unable to do so;
• have your grievances addressed.

A parent or lawful guardian exercises these rights on behalf of a child.

How to make a request

• Students, parents, guardians and school staff: contact your school. The school controls your data and is the right place for your request. If you write to us instead, we forward your request to the school within [7] days and help it respond.
• School account holders, customers and website visitors: e-mail info@eduvedha.com or the Grievance Officer below. We may need to verify your identity. We aim to respond within [30] days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after using the grievance process above. The DPDP Act also sets out duties for Data Principals — for example, to give authentic information and not to file false or frivolous complaints.

12. Cookies

The Eduvedha website and web application use only the cookies they need to work:

We do not use advertising or cross-site tracking cookies, and the Eduvedha website and application do not load third-party analytics. The mobile apps use a sign-in token stored on the device instead of cookies. A school’s own website may add Google Analytics or Meta Pixel if the school chooses to; the school’s notice covers that.

13. Contact and Grievance Officer

We aim to resolve grievances within [30] days and in any case within the period the DPDP Rules allow (currently 90 days).

14. Changes to this policy

We will post any changes on this page and update the dates at the top. If a change materially affects how we use personal data, we will tell school account holders by e-mail or in the Service before it takes effect.