Privacy policy

For visitors to this website, and for the contact, demo, quotation and support requests they send us, we decide how the data is used.

For everything an institution records in its own Edu SaaS account (students, parents, staff, attendance, marks, fees), the institution decides what is collected and why. We process that data on the institution's behalf and on its instructions. If you are a student, parent or staff member and want to know why a record exists or have it corrected, your institution is the right first contact.

From website visitors:

• Details you enter in our demo, quotation, support or contact forms: name, email, phone number, institution name and type, your role, preferred demo time, number of students and branches, modules of interest, and your message.
• Standard technical information that any web server records, such as IP address and browser type, used to keep the service secure and to apply rate limits.

Inside an institution's account, depending on which modules the institution uses:

• Account details: name, email address, phone number, role, and the organization and branch the account belongs to. Passwords are stored only as one-way hashes.
• Academic records: enrolments, batches, timetables, exam and course results, test attempts and scores, study material progress, and certificates.
• Attendance, including check-in and check-out times and, where the institution enables it, the location captured at check-in.
• Fee installments, payment status and receipts. Card and UPI details are never collected by us (see "Who we share data with").
• For preschools: daily activity logs (meals, naps, mood, activities) and the named people authorized to collect each child, with their relationship and phone number.
• Live class participation: when each person joined and left a class, used to calculate attendance.
• Admissions inquiries entered by the institution's staff, including notes and follow-up dates.
• An audit trail recording sensitive actions, such as approvals, payments and password changes, and who performed them.

• To provide, secure and support the service for the institution that uses it.
• To send messages that an institution or the platform triggers, such as fee receipts, daily updates, results and password-reset links, by email, SMS or WhatsApp where delivery is set up.
• To reply to demo, quotation, support and contact requests.
• To keep the service reliable and to investigate abuse or errors.
• To meet legal obligations.

We do not sell personal data, and we do not use it for third-party advertising. This website does not use advertising or analytics trackers.

We use a small number of service providers to run specific parts of the product. They receive only what they need for that purpose:

• Razorpay processes online fee payments. Card and UPI details are entered on Razorpay's own checkout and never reach our servers.
• Twilio delivers SMS and WhatsApp messages. Recipients' phone numbers and the message text are sent to it.
• SendGrid delivers email. Recipients' email addresses and the message text are sent to it.
• A live class provider, LiveKit, Daily or Zoom depending on how the institution has configured live classes, carries the audio and video of classes.
• Our hosting and infrastructure providers store and serve the data.

Certificates are public by design: anyone who has a certificate number can see the holder's name, program, cohort, issue date and validity on the verification page.

Within an institution, its administrators can see the data of their own organization. Branch administrators can see their own branch. We may also disclose data where the law requires it.

When you log in, we set one session cookie so that you stay signed in. It is marked httpOnly, which means scripts on the page cannot read it, and it expires after seven days. We do not set advertising or tracking cookies. Live classes also keep a few preferences in your browser's local storage.

An institution's data is kept while its account is active. Messages sent through our website forms are kept for as long as we need them to handle your request.

If a person deletes their account from the Account page, their name, email address and phone number are replaced with anonymous placeholders and they can no longer log in. Records that other people rely on, such as fee records, enrolments and certificates, are kept so that they remain accurate and verifiable.

The measures we rely on are described in plain terms on our data protection page. No system is perfectly secure, but these controls are in place today and we keep them under review.

• Download your data: signed-in users can export the data held about their own account from the Account page.
• Delete your account: the same page lets you delete your account, which anonymizes your personal details as described above.
• Access, correction, erasure and withdrawal of consent: you can ask us or your institution at any time. Where the data belongs to an institution's records, we will pass your request to that institution.
• Complaints: tell us first at the address below. You also have the right to complain to the relevant data protection authority, for example under India's Digital Personal Data Protection Act, 2023, where it applies to you.

Students, including young children, are added to Edu SaaS by their institution, and parents or guardians receive their own login linked to their child. Institutions are responsible for obtaining any parental consent that the law requires before adding a child. We do not market to children.

If we change this policy in a way that matters, we will update the date above and, for institutions with an account, tell them directly.

Questions or requests about this policy: info@magebytes.com.