Privacy Policy

1. Scope and Roles

This Privacy Policy explains how Stavion Technologies ("Stavion", "we", "us", "our"), a business division of Stavion Private Limited, a company incorporated under the Companies Act, 2013 (CIN: U62013KA2026PTC226686), collects, uses, discloses, and protects personal data in connection with EduCampusOS (the "Platform") — available at educampusos.com and any school-specific subdomain or custom domain configured for a customer school.

This Policy applies to:

• Prospective and current customer schools, and the individuals who administer accounts on their behalf ("School Administrators");
• Students, parents/guardians, teachers, and other staff of a customer school whose data is processed on the Platform ("End Users");
• Visitors to this marketing website (educampusos.com) who submit an enquiry, raise a case, or otherwise interact with us before becoming a customer.

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the customer school is the Data Fiduciary for its students' and staff's personal data — the school determines the purpose and means of processing that data. Stavion acts as a service provider processing that data on the school's instructions for the purpose of operating the Platform. For account data relating to the school's own administrative access to the Platform, and for data collected directly through this marketing website, Stavion acts as the Data Fiduciary in its own right.

If you are a student, parent, or staff member with a question about your data, please contact your school's administration first, since they control the underlying record; we support every school in fulfilling requests promptly.

2. Information We Collect

2.1 Information provided by schools, on behalf of their students and staff

• Student information: name, date of birth, gender, admission number, class/section, parent/guardian names and contact details, address, photograph (where uploaded by the school), academic records, attendance records, fee and payment records, transport and hostel allocation, health information voluntarily recorded by the school (e.g. allergies, for safety purposes), library records, and disciplinary records.
• Staff information: name, contact details, address, employment records, attendance and leave records, salary and bank details (for payroll processing where enabled), qualifications, and identity documents uploaded for HR compliance.
• Parent/guardian information: name, contact number, email address, relationship to student, and login credentials for the Parent Portal.

2.2 Information collected directly from you

• Account and usage data: login credentials, IP address, device and browser type, pages visited, and actions taken on the Platform (recorded in audit logs for security and dispute-resolution purposes).
• Communications: messages you send us via the chat assistant, the Raise a Case form, email, or phone, including any attachments you choose to provide.
• Payment information: where a school pays fees or subscription charges through the Platform, payment card or bank details are collected and processed by our payment gateway partners directly; Stavion does not store full card numbers.

2.3 Information collected automatically

• Standard server logs (timestamps, IP address, request type) for security monitoring and troubleshooting.
• Cookies and similar technologies as described in Section 11.

3. Children's and Students' Data

Much of the personal data processed on the Platform relates to children under 18, as EduCampusOS is fundamentally a school administration system. We recognize this as a heightened responsibility, and we process children's data only:

• At the instruction of, and under the authority of, the customer school, which is legally required to obtain any consent of a parent or lawful guardian necessary for enrolling a child's data on the Platform, consistent with Section 9 of the DPDP Act;
• For purposes directly connected to the school's educational and administrative functions — never for behavioral advertising, profiling for commercial purposes, or tracking children across other websites or platforms, both of which are expressly prohibited under Section 9 of the DPDP Act and which we do not engage in regardless;
• With the same or greater technical and organizational security safeguards applied to all other personal data on the Platform.

Schools are responsible for obtaining verifiable parental consent as required by applicable law before enrolling a student's data on the Platform. Stavion provides consent-capture workflows within the product to help schools meet this obligation but does not independently verify each instance of parental consent, as the school is best placed to do so as the Data Fiduciary.

4. How We Use Information

We use personal data solely to:

• Provide, operate, and maintain the Platform's modules (admissions, academics, attendance, fees, transport, hostel, library, HR, communication, Class IQ, and others) as configured by the school;
• Send transactional communications — attendance alerts, fee reminders, results, notices — via email, SMS, or WhatsApp, as configured by the school;
• Provide Class IQ's adaptive learning recommendations, which analyze a student's responses to syllabus-mapped practice questions solely to personalize that student's own learning pace — this analysis is not used for any purpose beyond the student's own educational benefit, and is not shared outside the school without the school's instruction;
• Respond to support requests, cases, and enquiries;
• Maintain security, detect and prevent fraud or unauthorized access, and maintain audit logs;
• Comply with applicable law, including education-sector regulatory reporting (e.g. UDISE+) that a school is required to file;
• Improve the Platform, using aggregated and de-identified data wherever reasonably possible.

We do not sell personal data. We do not use student or staff data for advertising, and we do not share personal data with third parties for their own independent marketing purposes.

5. Legal Basis for Processing

Under the DPDP Act, personal data on the Platform is processed on the basis of: (a) the consent obtained by the school from parents/guardians, staff, or other Data Principals, for processing directly connected to the school's educational and administrative functions; and (b) certain "legitimate uses" recognized under the DPDP Act, such as compliance with legal obligations and purposes directly volunteered by a Data Principal (for example, a visitor to this website submitting an enquiry).

6. Sharing and Third-Party Processors

We share personal data only as necessary to operate the Platform, and always under contractual confidentiality and data-protection obligations:

• Communication providers (currently MSG91) — to deliver email, SMS, and WhatsApp notifications on the school's behalf;
• Cloud infrastructure and hosting providers (currently including Cloudflare, Railway, and Supabase, and Cloudflare R2 for file storage) — to host the Platform and store data securely;
• Payment gateway providers — to process fee and subscription payments, where applicable;
• Government and regulatory authorities — where a school uses the Platform to generate statutory filings (e.g. UDISE+), or where disclosure is required by law, court order, or a valid request from a competent authority;
• Professional advisors (auditors, legal counsel) under confidentiality obligations, where necessary.

We do not permit any third-party processor to use personal data for any purpose other than providing the specific service for which it was engaged.

7. Security Measures

We maintain reasonable security practices and procedures as required under Indian law, including: encryption of data in transit (TLS) and at rest; role-based access controls so that staff and Stavion personnel see only the data their role requires; audit logging of create/update/delete actions; regular backups with tested recovery procedures; and periodic independent security review. No system is completely immune to risk, and we will notify affected schools and, where required, the Data Protection Board of India, without undue delay in the event of a personal data breach, consistent with our obligations under the DPDP Act.

8. Data Retention

We retain personal data for as long as the school's subscription is active, and thereafter for the period necessary to comply with legal, regulatory, tax, and accounting requirements (financial and audit-relevant records are retained for a minimum of ten years; general activity logs for a minimum of two years, consistent with our internal retention schedule). Upon a school's request following termination of services, we will export the school's data to it and, following a reasonable transition period, delete or anonymize personal data no longer required to be retained by law.

9. Cross-Border Data Transfer

We primarily host data on infrastructure serving the Indian market. Where a sub-processor's infrastructure involves data processing outside India, we take steps to ensure that data continues to receive a level of protection consistent with the DPDP Act and any applicable Government of India notifications restricting transfer to specific countries.

10. Your Rights (Data Principals)

Subject to applicable law, and coordinated through the relevant school where the data concerns a student or staff member, Data Principals have the right to:

• Access a summary of personal data processed and the processing activities undertaken;
• Correction and completion of inaccurate or incomplete personal data;
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements;
• Grievance redressal, as described in Section 12;
• Nominate another individual to exercise these rights in the event of death or incapacity.

Requests relating to a student's or staff member's data should be directed to the relevant school in the first instance, as the Data Fiduciary with primary responsibility for that record; the school may involve us as needed to fulfil the request, and we will support the school in doing so within a reasonable time.

11. Cookies and Tracking

This marketing website uses essential cookies necessary for the site to function (e.g. remembering your cookie preference) and, where enabled, analytics cookies to understand aggregate site usage. We do not use third-party advertising cookies or cross-site tracking on this website. The Platform itself (once a school is a customer) uses session cookies and local storage strictly necessary for authentication and functionality.

12. Grievance Redressal

In accordance with the DPDP Act, we have designated a contact point to address privacy-related grievances. Any Data Principal with a concern about how their personal data (or, for a student, their child's personal data) has been processed may contact:

Grievance Officer
Stavion Technologies (a division of Stavion Private Limited)
Email: [email protected]

We will acknowledge grievances promptly and aim to resolve them within 30 days.

13. Complaints to the Data Protection Board

If you are not satisfied with our response to a grievance, you have the right to file a complaint with the Data Protection Board of India, established under the DPDP Act.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on this page with a revised "Last updated" date, and for material changes, we will provide additional notice to customer schools.

15. Contact Us

For any question about this Privacy Policy, please contact us at [email protected] or via our chat assistant.