Data Relationship Notice (Data Controller vs. Data Processor)
When EdYantra provides Services to an Educational Institution ("Institution" or "School"), the Institution serves as the Data Controller (or "Data Fiduciary" under the DPDP Act 2023), determining the categories and operational purposes of student, parent, and staff data processed. EdYantra operates strictly as a Data Processor acting upon the lawful instructions and contractual mandates of the Institution.
1. INTRODUCTION & SCOPE
Welcome to EdYantra™ ("Platform", "we", "our", or "us"), operated by EdYantra Technologies Pvt. Ltd. ("Company").
EdYantra provides an enterprise-grade, multi-tenant Education Enterprise Resource Planning (ERP) platform, institutional intelligence system, web portals, and mobile applications, collectively referred to as the "Services". These include:
For live academic updates, attendance, assignments, fee invoices, and transport tracking.
For daily roll-call attendance, gradebook mark entry, homework uploads, and circulars.
For bus route navigation, designated stop student rosters, and transit telemetry.
For principal management, fee counters, accounting audits, and statutory reporting.
This Privacy Policy describes how we collect, process, store, disclose, and protect personal and institutional information when:
- Educational Institutions (Schools, Colleges, Preschools, Coaching Institutes, and Educational Trusts) register and deploy our ERP platform.
- Students, Parents/Guardians, Faculty Members, Drivers/Attendants, and Institutional Administrators access our mobile apps or web portals.
- Visitors access our public-facing websites or institutional subdomains.
2. LEGAL COMPLIANCE FRAMEWORK
This Privacy Policy and our internal engineering protocols are engineered to comply with global and national data protection standards:
Digital Personal Data Protection Act & Information Technology (Intermediary Guidelines) Rules.
Google Play Developer Program Policies for Student & Children safety compliance.
Section 5.1 Privacy, Data Collection, User Consent & Account Deletion standards.
Children's Online Privacy Protection Act & Family Educational Rights and Privacy Act.
General Data Protection Regulation principles for cross-border student exchanges and data handling.
3. INFORMATION WE COLLECT
We collect only the data strictly necessary to deliver institutional administration, academic tracking, communication, campus safety, and fee processing services.
3.1 Student Information (Collected via School Administration or Parent Profile)
- Identity & Demographics: Full name, General Register (GR) / Admission number, Roll number, Date of birth, Gender, Blood group, Photograph, Caste/Category (strictly where mandated for statutory scholarships/government reporting).
- Government Identifiers: Aadhaar number, Birth certificate details, Previous school leaving / transfer certificates (stored securely in encrypted digital vaults).
- Academic Records: Class, Division/Section, Attendance records, Examination marks, Progress reports, Competency ratings, Homework submissions, and Teacher remarks.
- Health & Safety Details: Emergency contact details, medical alerts, and allergies (as provided by parents or school medical desk).
3.2 Parent and Guardian Information
- Contact Details: Full name, Relationship to student, Primary mobile phone number (used for SMS OTP login and emergency school alerts), Email address, Residential address.
- Professional Information: Occupation and office contact (optional, as captured in official school admission forms).
- Financial Transactions: Fee installment schedules, concession categories, payment method used (UPI, NetBanking, Card, Cash, Cheque), transaction references, and fee receipt numbers. (Note: EdYantra does not store raw credit/debit card numbers or CVVs. All electronic payments are processed via PCI-DSS Level 1 compliant gateways such as Razorpay).
3.3 Teacher and Staff Information
- Professional & Identity Data: Full name, Employee ID, Designation, Department, Qualifications, Subjects handled, Emergency contacts, Government ID, and Profile photo.
- Academic Operations Data: Assigned weekly timetables, Daily work reports, Classroom attendance logs, Exam mark submissions, and Study material / handwritten notes uploads.
3.4 Transport, Fleet & Logistical Information
- Vehicle & Personnel Details: Bus registration numbers, Route details, Stop landmarks, Driver name, Attendant name, and Driver mobile contact.
- Student Transportation Rosters: Pick-up and drop-off bus stops assigned to enrolled students.
- Live Location / Telematics (Where Enabled): Real-time GPS location of institutional transport vehicles for parent transit tracking and route optimization.
3.5 Campus Hardware & Biometric Telemetry
Turnstile / Biometric Sync: Hardware device identifiers, biometric attendance timestamps (entry/exit logs), and RFID smart card badge numbers synchronized with campus turnstiles. (Biometric fingerprint templates remain localized to campus hardware devices or secure on-premise gateways; EdYantra cloud servers only process attendance timestamps).
3.6 Technical & Device Information Automatically Collected
- Device Identifiers: Device model, Operating system version, IP address, Unique Device Identifier (UDID), and Firebase Cloud Messaging (FCM) Push Notification Tokens.
- System Activity Logs: Timestamps of logins, password resets, role changes, and API transactions to maintain enterprise audit trails.
4. MOBILE APPLICATION PERMISSIONS & USAGE
To provide real-time educational functionality, our mobile applications may request the following device permissions with explicit justification:
| Permission | Technical Manifest Name | Operational Purpose |
|---|---|---|
| Camera | android.permission.CAMERA NSCameraUsageDescription | Allows students/parents to capture and submit homework assignments; allows teachers to photograph handwritten notes; allows administrators to capture ID card profile photos and scan fee slips. |
| Photos / Storage | READ_MEDIA_IMAGES WRITE_EXTERNAL_STORAGE | Enables downloading and saving academic report cards, bonafide certificates, fee receipts, circular PDFs, and uploading assignment files. |
| Push Notifications | POST_NOTIFICATIONS | Delivers instant alerts for daily attendance (e.g., absence notification), fee payment deadlines, exam timetables, school emergencies, and circular bulletins. |
| SMS / OTP | Verification API | Used strictly for frictionless passwordless phone number verification (OTP login via Twilio / Fast2SMS). EdYantra does not read personal user SMS messages. |
| Location (Optional / Staff) | ACCESS_FINE_LOCATION | Used on designated Driver/Attendant devices to transmit live institutional bus tracking coordinates to authorized parents and school transport managers. |
* You can modify or revoke these permissions at any time via your device operating system settings, though certain core features (e.g., uploading homework or receiving emergency alerts) may be impaired.
5. HOW WE USE YOUR INFORMATION
We process collected information strictly for legitimate educational and administrative purposes:
- Academic Administration: Managing student enrollment, classroom allocations, attendance monitoring, and timetable scheduling.
- Evaluation & Reporting: Calculating grades, compiling academic report cards, generating Bonafide and School Leaving Certificates with anti-tampering QR codes.
- Parent-School Communication: Sending SMS, WhatsApp, push notifications, and email alerts regarding homework, attendance status, event circulars, and fee reminders.
- Fee Processing & Accounting: Managing installment billing, calculating late fee penalties, issuing official stamped fee receipts, and tracking school operational budgets.
- Campus & Student Safety: Managing authorized bus pickup rosters, tracking campus turnstile clock-ins, and maintaining verified emergency contact chains.
- Platform Security & Compliance: Preventing unauthorized access through role-based access control (RBAC), multi-factor authentication (TOTP/OTP), and maintaining cryptographic audit logs.
6. CHILDREN'S PRIVACY & COPPA / DPDP COMPLIANCE
Because EdYantra serves K-12 educational institutions, protecting student and minor data is our highest priority:
EdYantra NEVER serves third-party advertisements, tracks students across third-party websites, or sells student profiles to data brokers.
Student profiles are created either by authorized school administrative personnel upon admission or by parents/guardians directly. The Educational Institution certifies that it has obtained valid parental consent or acts in loco parentis under applicable educational exemption frameworks (e.g., COPPA / FERPA / DPDP Act).
Parents and legal guardians have the right to inspect their child's academic and personal data, request corrections of factual inaccuracies, or request cessation of non-essential processing by contacting their child's school administration.
7. THIRD-PARTY SERVICE PROVIDERS (SUB-PROCESSORS)
We partner only with enterprise-grade third-party infrastructure providers that maintain strict confidentiality and security commitments:
| Provider | Purpose | Data Transferred | Security / Compliance |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, Serverless execution, S3 Document Vault | Encrypted database backups, documents, receipts, certificates | ISO 27001, SOC 2, HIPAA, AES-256 server-side encryption |
| Razorpay | Electronic fee payment gateway (UPI, NetBanking, Cards) | Transaction amounts, student name, roll number, order IDs | PCI-DSS Level 1 compliant |
| Google Firebase (FCM) | Mobile push notification delivery | Device push tokens, notification title and message payload | Google Cloud Security Compliance |
| Twilio / Fast2SMS | SMS OTP verification and critical emergency alerts | Mobile phone number, OTP code, announcement text | Carrier-grade encrypted delivery |
* We do not authorize any sub-processor to use your personal information for their own marketing or independent commercial purposes.
8. DATA SECURITY & ENCRYPTION MEASURES
EdYantra implements multi-layered enterprise defense mechanisms:
- Transmission Security: All communications between mobile apps, web browsers, and our backend are encrypted in transit using TLS 1.3 / HTTPS protocols.
- Authentication & Authorization: Secure asymmetric RSA / Secret-based JSON Web Tokens (JWT) with strict Role-Based Access Control (RBAC). Passwords are cryptographically salted and hashed using HMAC-SHA256. Two-Factor Authentication (TOTP via Speakeasy) is available for administrative access.
- Data at Rest: Sensitive institutional files, student documents, and financial records stored on AWS S3 are secured using AES-256 encryption and restricted presigned URLs with strict time limits.
- Multi-Tenant Isolation: Database architecture enforces strict multi-tenant boundaries (
school_id/group_idforeign keys) ensuring that no institution can access or view another institution's records.
9. DATA RETENTION & ACCOUNT DELETION
9.1 Data Retention
We retain student and institutional data for the duration of the school's active contract with EdYantra, or as required to satisfy statutory educational record retention laws (e.g., academic transcripts and leaving certificates that institutions are legally mandated to preserve).
9.2 Account & Data Deletion (Google Play & App Store Compliance)
Users have full rights regarding their accounts and personal data:
- School Staff / Administrators: Can request deletion of their profile upon resignation or contract termination through their Super Admin or School Principal.
- Parents & Students: Because student records are educational assets owned by the Institution, requests for complete student record purging must be routed through the student's School Administration to ensure compliance with compulsory education archiving laws.
- Direct App Deletion Request: Users can initiate an account deletion or data erasure request directly from the Profile > Settings > Delete Account section within the mobile application or by submitting a request via our dedicated deletion URL:URL: https://edyantra.com/delete-accountor email: privacy@edyantra.com
- Upon receipt of a verified deletion request and institutional clearance, personal identifiers, login credentials, and push notification tokens will be permanently purged within 30 days.
10. USER RIGHTS & CHOICES
Subject to applicable national laws (including DPDP Act, GDPR), you are entitled to:
- Right to Access: Request a copy of the personal information we maintain regarding you or your child.
- Right to Rectification: Request correction of inaccurate, incomplete, or outdated academic or personal information.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.
- Right to Data Portability: Request transfer of your data in a structured, machine-readable format (e.g., academic transcript or fee statement).
- Right to Redressal: Lodge inquiries or complaints regarding privacy compliance with our Grievance Officer.
11. POLICY UPDATES
We may periodically update this Privacy Policy to reflect technological improvements, functional enhancements, or regulatory amendments. Any material modifications will be announced via in-app banner notifications, circular updates, or through email communication prior to the changes taking effect. The "Last Updated" date at the top will indicate the latest revision.
12. GRIEVANCE REDRESSAL OFFICER & CONTACT INFORMATION
In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the details of the designated Grievance & Data Protection Officer are provided below:
If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at the details above.
EdYantra™ Education Enterprise Resource Planning & Mobile Platform
© 2026 EdYantra Technologies Pvt. Ltd. All rights reserved.