Privacy Policy

Sarventic SchoolOS is licensed to schools and institutions. Your school creates and administers the accounts, decides what records it keeps about its students and staff, and instructs us on how that information is handled.

In the language of India's Digital Personal Data Protection Act, 2023, your school is the data fiduciary and Sarventic Solutions LLP is a data processor acting on the school's instructions. Where we decide things for ourselves — such as keeping the service secure, or holding a record of a deletion request — we act as a data fiduciary in our own right, and this policy tells you so at each point.

If you want a school record changed or removed, your school decides. If you want your Sarventic login and app data removed, we can act directly. Section 9 explains both routes.

We do not collect precise location, contacts, calendar, microphone, health or biometric data. The app requests camera and photo access only when you choose to upload a photograph or a document, and storage access only when you download a certificate or report.

We do not use your data for advertising, we do not sell it, and we do not share it with data brokers or advertising networks.

• To provide the service — showing you the attendance, timetable, marks, fee statements and notices that your school maintains.
• To authenticate you — signing you in, keeping your session secure, and recognising your device.
• To communicate — delivering school announcements and notifications by app, SMS, email or WhatsApp, according to the channels your school has configured.
• To keep the service working — diagnosing crashes and errors, preventing abuse, and protecting against unauthorised access.
• To meet legal obligations — retaining financial, payroll and statutory records for the periods Indian law requires.

We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not profile users.

We share personal data only with the parties below, only for the purpose stated, and only to the extent needed.

• Your school — which owns the records and controls who within the school may see them.
• Cloud hosting providers — Google Cloud Platform (Cloud Run and Cloud SQL), which stores the platform's data on servers located in Mumbai, India (asia-south1).
• Communication providers — the SMS gateway, email service and WhatsApp Business provider your school uses, which receive the recipient's number or address and the message content in order to deliver it.
• Payment providers — where your school collects fees electronically, the payment gateway receives the details needed to process the transaction. We do not store complete card numbers.
• Professional advisers and authorities — where we are required by law, a court order, or a lawful government request.

Any third party with whom we share user data — including service providers, third-party software components, communication and payment providers, and any parent, subsidiary or other related entity of Sarventic Solutions LLP that has access to user data — is contractually required to provide the same or equal protection of that data as is stated in this Privacy Policy, and to use it only for the purpose for which it was provided.

We do not use third-party artificial-intelligence services to process personal data from Sarventic SchoolOS. If that changes, we will update this policy and seek consent where consent is required before any personal data is shared with such a service.

If Sarventic Solutions LLP is involved in a merger, acquisition or transfer of assets, we will give notice before any personal data is transferred and becomes subject to a different privacy policy.

Sarventic SchoolOS is a tool used by schools to administer education. It processes personal data about children because school records are, by their nature, records about children.

The app is not directed at children as consumers. It has no public sign-up, no advertising, no in-app purchases and no social features open to the public. Accounts exist only because a school created them.

Where a student under 18 holds an account:

• the account is created by the school under its own authority and its arrangements with the parent or guardian at admission;
• we do not collect more data from a child than the school has entered or the app needs to run;
• we do not serve advertising to children, do not use children's data for advertising or profiling, and do not transmit advertising or device identifiers for children's accounts;
• under the Digital Personal Data Protection Act, 2023, a child's rights are exercised by their parent or lawful guardian, and we will act on a verified guardian's request; and
• we notify the school and the registered guardian before completing the deletion of an under-18 account.

If you believe a child's data has been collected in a way this policy does not describe, write to privacy@sarventic.com and we will investigate and respond within 30 days.

Personal data is encrypted in transit using TLS, and encrypted at rest on our servers. Passwords are stored as salted one-way hashes and are never visible to us or to your school. Access by our staff is restricted to named personnel who need it to operate or support the service, is logged, and is reviewed periodically.

Within the platform, what any user can see is governed by the role your school assigns — a teacher sees their own classes, a parent sees only their own child, and an administrator sees what the school permits.

No system is perfectly secure. If a personal data breach occurs that is likely to affect you, we will notify your school and the Data Protection Board of India as required by law, and we will notify affected users where the law requires it.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires.

• Account and profile data — for as long as the account is active. Deleted on request, or within 90 days of your school ending its licence.
• School academic records — retained for as long as your school instructs. Deletion is your school's decision.
• Fee, payment and payroll records — 8 financial years, as required by Indian tax and employment law.
• Diagnostics and error logs — 180 days.
• Message delivery records — 12 months.
• Encrypted backups — overwritten on the normal cycle, within 90 days.

When a school ends its licence, we return or delete its data on the school's instruction, and delete our own copies within 90 days except where a statutory retention period applies.

You may:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• request deletion of your account and associated data;
• withdraw consent where we rely on it — including turning off notification channels in the app, or writing to us to withdraw consent entirely, which may mean you can no longer use the app; and
• nominate another person to exercise your rights in the event of death or incapacity, as provided by the Digital Personal Data Protection Act, 2023.

To delete your account and data, use the Delete your account page, or Settings → Account → Delete account in the app. That page sets out exactly what is deleted, what is retained, and why. You do not need the app installed to make the request.

Because school records belong to your school, a request to delete academic, fee or employment records is referred to your school. We will tell you when we do this and send you a copy.

We respond to requests within 30 days and do not charge for them.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If we change this policy we will update the effective date at the top and, where the change is significant, notify you in the app or by email before it takes effect. Previous versions are available on request from privacy@sarventic.com.