Privacy Policy

1. Who we are and what this policy covers

This policy applies to schoolsandhi.com and to every page and feature served from it (the "Service"). In this policy "we", "us" and "our" mean the operator of SchoolSandhi; "you" means anyone who visits or uses the Service.

Under the Digital Personal Data Protection Act, 2023 (India) we are a Data Fiduciary and you are a Data Principal. Under the EU and UK General Data Protection Regulation we are a Controller and you are a data subject. Under the California Consumer Privacy Act we are a business. Different laws use different words for the same idea: we decide what happens to your data, and we are answerable for it.

We also observe the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which is why we publish a Grievance Officer in section 13.

This policy does not cover any third-party site you reach from ours. Those have their own policies and we do not control them.

2. Information we collect

We collect the following, and nothing beyond it:

Information you give us

• for visitors to our public website and blog: the pages you view, approximate location from your IP address, and the cookie and advertising identifiers described in section 6
• for school staff using the platform: the account details your school issues to you, your role and permissions, and an audit record of the actions you take in the system
• for enquiries: the name, email address, institution and message you send us through our contact form

Information collected automatically

• Your IP address, which we use to derive an approximate location (city or region level, not a precise position) for security, fraud prevention and regional defaults.
• Your browser type and version, operating system, device type, screen size and language preference.
• The pages you view on our site, the page that referred you to us, and the time and date of each request.
• Cookie and similar identifiers, as described in section 5, and advertising identifiers, as described in section 6.

Information we do not collect

• We do not ask for and do not want your Aadhaar number, PAN, passport number, voter ID or any other government identifier.
• We do not collect payment card numbers. Where we charge for anything, payment is handled by a PCI-DSS compliant payment processor and card details never reach our servers.
• We do not knowingly collect biometric data, health data, caste or tribe, religious belief, political affiliation, sexual orientation or trade union membership.

3. Why we use it, and on what legal basis

We use personal data only for the purposes below. Where more than one legal basis could apply, we have stated the primary one.

We do not use your personal data for automated decision-making that produces legal effects about you, and we do not sell it for money.

4. Data we hold on behalf of schools, and the two different roles we play

Role 1 — we are the Data Fiduciary for our public website

For anyone browsing schoolsandhi.com, reading our blog, or sending us an enquiry, we decide why and how your data is handled. We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and the Controller under the UK and EU General Data Protection Regulation. Address requests about this to privacy@schoolsandhi.com.

Role 2 — we are a Data Processor for the platform itself

Student records, attendance, marks, fee ledgers, health notes, transport allocations and staff files inside the platform ("School Data") belong to the subscribing institution. That institution decides what is collected and why; we only hold and process it on the institution's documented instructions. We are a Data Processor under the DPDP Act and the GDPR, and the school is the Data Fiduciary or Controller.

This means that if you are a parent, student or member of staff and you want to see, correct or erase a record, your request goes to your school, not to us. We are not permitted to alter or disclose a school's records on the instruction of a third party. If you contact us directly we will tell you so and, where we can identify the institution, forward your request to it.

What we will never do with School Data

• We do not sell it, rent it or share it with advertisers, data brokers or any other third party for their own purposes.
• We do not use it to train machine learning models.
• We do not use it to profile students, or to target advertising at students, parents or staff.
• We do not serve any third-party advertising inside the authenticated platform at all. Advertising appears only on our public marketing pages and blog, which are intended for adult administrators evaluating the product.

What happens when a subscription ends

On termination, the institution may export its School Data in a machine-readable format. We delete it from our production systems within 60 days of the export or of the institution's written instruction, whichever is later, and from encrypted backups within a further 90 days as those backups age out on their normal cycle.

5. Cookies and similar technologies

A cookie is a small file a site stores in your browser. We and our partners also use local storage, session storage and pixels, which do comparable jobs. We use four kinds:

You can delete or block cookies in your browser settings. Blocking strictly necessary cookies will break parts of the Service. Where the law in your country requires consent before a non-essential cookie is set, we ask for it before setting one.

6. Advertising, and our advertising partners

SchoolSandhi is free to use, and advertising is what pays for it. We work with Taboola, a content recommendation and advertising network, and may work with other advertising partners.

What our advertising partners do

• They set and read cookies and similar identifiers in your browser.
• They collect your IP address, device and browser characteristics, and the pages on which their units appear.
• They may combine that with information they have gathered on other websites in order to select which recommendations to show you. This is behavioural or interest-based advertising.

Taboola acts as an independent controller of the data it collects through its units. We do not receive, and cannot access, the profile it builds. Their privacy policy is at taboola.com/policies/privacy-policy.

How to opt out

• Taboola directly: taboola.com/policies/privacy-policy#optout
• Industry-wide opt-outs: NAI, DAA, and Your Online Choices for the EEA and UK.
• Your browser settings, which can block or delete third-party cookies.
• Your device: "Limit Ad Tracking" on iOS, or "Opt out of Ads Personalisation" on Android.

Opting out stops advertising being personalised to you. It does not remove advertising, and the Service remains free either way.

We do not sell your personal information for money

We do not exchange your personal information for money. However, "sale" and "share" are defined broadly under the California Consumer Privacy Act as amended by the CPRA, and the disclosure of identifiers to an advertising partner for cross-context behavioural advertising may fall within those definitions. Section 11 explains how a California resident can opt out.

Advertising and children

7. When we share information

We do not sell your personal data. We disclose it only in these situations:

• Service providers who work on our instructions — hosting, content delivery, error monitoring, email delivery and, where applicable, payment processing. They may use the data only to provide that service to us, and are bound by contract to do so.
• Advertising partners, as described in section 6.
• Legal and regulatory requirements — where we are required to disclose by law, by a court of competent jurisdiction, or by a lawful request from a government or law enforcement agency. We satisfy ourselves that a request is lawful, and where we are permitted to tell you about it, we will.
• Protection of rights — where disclosure is necessary to enforce our Terms, to investigate suspected fraud or abuse, or to protect the safety of any person.
• Business transfer — if the Service is merged, acquired or its assets sold, your data may pass to the acquirer, who will remain bound by this policy or give you notice before changing it.

8. International transfers

We are based in India and our infrastructure and service providers may be located in India, the European Union, the United Kingdom, Singapore or the United States. Using the Service may therefore involve your data crossing a border.

• Under section 16 of the Digital Personal Data Protection Act, 2023, transfers out of India are permitted except to territories the Central Government restricts by notification. We monitor those notifications and comply with them.
• For transfers out of the EEA or the UK, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with supplementary technical measures — encryption in transit and at rest, and access control.

You can ask us for details of the safeguards applied to a specific transfer by writing to privacy@schoolsandhi.com.

9. How long we keep information

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires.

After these periods data is deleted or irreversibly aggregated so it can no longer identify you. Data may persist in encrypted backups for a further 90 days before those backups age out on their normal cycle.

10. How we protect information

We maintain reasonable security practices and procedures within the meaning of section 43A of the Information Technology Act, 2000 and the rules made under it, proportionate to the data we hold. In practice:

• All traffic is served over HTTPS with modern TLS. Data is encrypted at rest.
• Access to production systems is limited to staff who need it, is individually authenticated, and is logged.
• Dependencies are monitored for known vulnerabilities and patched.
• We collect as little as we can, and delete on a schedule, because data we do not hold cannot be breached.

11. Your rights, and how to use them

Your rights depend on where you are. We apply the strongest applicable standard rather than the minimum we could get away with.

If you are in India — Digital Personal Data Protection Act, 2023

• Right to access a summary of the personal data we process about you and the processing activities we undertake (s.11).
• Right to correction, completion, updating and erasure of your personal data (s.12).
• Right to grievance redressal through the mechanism in section 13 below, which you must exhaust before approaching the Data Protection Board of India (s.13).
• Right to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity (s.14).
• Right to withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out.

You also have duties under section 15 of the Act, including not raising a false or frivolous grievance and not furnishing false particulars.

If you are in the EEA, the UK or Switzerland — GDPR and UK GDPR

• Access, rectification and erasure of your personal data.
• Restriction of processing, and objection to processing carried out on the basis of legitimate interests — including an absolute right to object to direct marketing.
• Data portability, where processing is based on consent or contract and is carried out by automated means.
• The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.
• The right to withdraw consent at any time, and the right to lodge a complaint with your national supervisory authority or, in the UK, the Information Commissioner's Office.

If you are in California — CCPA as amended by the CPRA

• The right to know what personal information we collect, the sources, the purpose, and the categories of third parties to whom it is disclosed.
• The right to delete personal information we hold about you, subject to statutory exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising — exercise it through the opt-outs in section 6, or by emailing us. We honour Global Privacy Control signals sent by your browser.
• The right to limit the use of sensitive personal information. We do not collect sensitive personal information as that term is defined.
• The right not to be discriminated against for exercising any of these rights. We will not degrade the Service or charge you differently.

If you are elsewhere in the United States

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy statutes have broadly equivalent rights of access, correction, deletion, portability and opt-out of targeted advertising. Use the same contact route and tell us which state you are in.

How to exercise any of these rights

Email privacy@schoolsandhi.com. We will acknowledge within 72 hours and respond substantively within 30 days, extendable once by a further 30 days where a request is complex — we will tell you if that happens. There is no charge unless a request is manifestly unfounded or excessive, in which case we will tell you the fee before doing the work.

We must be able to identify you before acting, particularly on a deletion request. We will ask for enough information to establish that the request is genuinely yours, and no more. An authorised agent acting for you must provide written proof of authority.

12. Children

Section 9 of the Digital Personal Data Protection Act, 2023 treats anyone under 18 as a child. Processing a child's personal data requires verifiable consent from a parent or lawful guardian, and the Act specifically prohibits tracking, behavioural monitoring and targeted advertising directed at children.

In the United States, the Children's Online Privacy Protection Act applies to children under 13.

Our position

Our public website, blog and advertising are directed at adult school administrators and purchasers. They are not directed at children, and we do not knowingly permit a child to create an account on them.

Inside the platform, the personal data of students — many of whom are children — is School Data. The subscribing institution is the Data Fiduciary and is responsible for obtaining any consent the law requires from parents or guardians. We process that data only on the institution's instructions, never for advertising, never for profiling, and never for model training.

Student and parent accounts, where a school enables them, sit inside the authenticated platform and carry no third-party advertising or behavioural tracking of any kind.

13. Grievance Officer, and how to complain

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and section 13 of the Digital Personal Data Protection Act, 2023, we publish a Grievance Officer.

Please include your name, how to contact you, a clear description of the issue, and the URL of the page concerned. It helps us resolve things quickly and it is what the Rules require.

If you are not satisfied with our response

• India — after exhausting the grievance mechanism above you may complain to the Data Protection Board of India.
• EEA — you may complain to the supervisory authority in your country of residence, work or of the alleged infringement.
• United Kingdom — you may complain to the Information Commissioner's Office at ico.org.uk.
• California — you may contact the California Privacy Protection Agency or the Attorney General.

14. Changes to this policy

We may update this policy as the Service or the law changes. The "last updated" date at the top always reflects the current version.

Where a change materially reduces your rights or materially expands how we use your data, we will give prominent notice on the Service before it takes effect, and — where the law requires consent — we will ask for it rather than assume it. Continuing to use the Service after a change takes effect means you accept the updated policy.

15. How to contact us

For anything in this policy: