Privacy Policy

1. Scope and Roles

This Privacy Policy explains how Stavion Technologies ("Stavion", "we", "us", "our"), a business division of Stavion Private Limited, a company incorporated under the Companies Act, 2013 (CIN: U62013KA2026PTC226686), collects, uses, discloses, and protects personal data in connection with EduCampusOS (the "Platform") — available at educampusos.com and any school-specific subdomain or custom domain configured for a customer school.

This Policy applies to:

• Prospective and current customer schools, and the individuals who administer accounts on their behalf ("School Administrators");
• Students, parents/guardians, teachers, and other staff of a customer school whose data is processed on the Platform ("End Users");
• Visitors to this marketing website (educampusos.com) who submit an enquiry, raise a case, or otherwise interact with us before becoming a customer.

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the customer school is the Data Fiduciary for its students' and staff's personal data — the school determines the purpose and means of processing that data. Stavion acts as a service provider processing that data on the school's instructions for the purpose of operating the Platform. For account data relating to the school's own administrative access to the Platform, and for data collected directly through this marketing website, Stavion acts as the Data Fiduciary in its own right.

If you are a student, parent, or staff member with a question about your data, please contact your school's administration first, since they control the underlying record; we support every school in fulfilling requests promptly.

2. Information We Collect

2.1 Information provided by schools, on behalf of their students and staff

• Student information: name, date of birth, gender, admission number, class/section, parent/guardian names and contact details, address, photograph (where uploaded by the school), academic records, attendance records, fee and payment records, transport and hostel allocation, health information voluntarily recorded by the school (e.g. allergies, for safety purposes), library records, and disciplinary records.
• Staff information: name, contact details, address, employment records, attendance and leave records, salary and bank details (for payroll processing where enabled), qualifications, and identity documents uploaded for HR compliance.
• Parent/guardian information: name, contact number, email address, relationship to student, and login credentials for the Parent Portal.

2.2 Information collected directly from you

• Account and usage data: login credentials, IP address, device and browser type, pages visited, and actions taken on the Platform (recorded in audit logs for security and dispute-resolution purposes).
• Communications: messages you send us via the chat assistant, the Raise a Case form, email, or phone, including any attachments you choose to provide.
• Payment information: where a school pays fees or subscription charges through the Platform, payment card or bank details are collected and processed by our payment gateway partners directly; Stavion does not store full card numbers. Online fee payments are processed by Cashfree Payments, which collects card, UPI and bank details on its own page under its own privacy policy. EduCampusOS receives the result of the payment, its amount and a reference, and limited details such as the payment method and the last four digits of a card or a masked UPI handle.

2.3 Information collected automatically

• Standard server logs (timestamps, IP address, request type) for security monitoring and troubleshooting.
• Cookies and similar technologies as described in Section 11.
• Data the mobile apps use on your phone, as described in Section 12.

3. Children's and Students' Data

Much of the personal data processed on the Platform relates to children under 18, as EduCampusOS is fundamentally a school administration system. We recognize this as a heightened responsibility, and we process children's data only:

• At the instruction of, and under the authority of, the customer school, which is legally required to obtain any consent of a parent or lawful guardian necessary for enrolling a child's data on the Platform, consistent with Section 9 of the DPDP Act;
• For purposes directly connected to the school's educational and administrative functions — never for behavioral advertising, profiling for commercial purposes, or tracking children across other websites or platforms, all of which are expressly restricted under Section 9 of the DPDP Act and which we do not engage in regardless;
• With the same or greater technical and organizational security safeguards applied to all other personal data on the Platform.

Schools are responsible for obtaining verifiable parental consent as required by applicable law before enrolling a student's data on the Platform. Stavion provides consent-capture workflows within the product to help schools meet this obligation but does not independently verify each instance of parental consent, as the school is best placed to do so as the Data Fiduciary.

4. How We Use Information

We use personal data solely to:

• Provide, operate, and maintain the Platform's modules (admissions, academics, attendance, fees, transport, hostel, library, HR, communication, Class IQ, and others) as configured by the school;
• Send transactional communications — attendance alerts, fee reminders, results, notices — via email, SMS, or WhatsApp, as configured by the school;
• Provide Class IQ's grounded question-answering: a student's question is matched against their own teacher's uploaded syllabus material to generate a cited answer, and the exchange is logged for safety and quality review — this is not used for any purpose beyond the student's own educational benefit, and is not shared outside the school without the school's instruction;
• Respond to support requests, cases, and enquiries;
• Maintain security, detect and prevent fraud or unauthorized access, and maintain audit logs;
• Comply with applicable law, including education-sector regulatory reporting (e.g. UDISE+) that a school is required to file;
• Improve the Platform, using aggregated and de-identified data wherever reasonably possible.

We do not sell personal data. We do not use student or staff data for advertising, and we do not share personal data with third parties for their own independent marketing purposes.

5. Legal Basis for Processing

Under the DPDP Act, personal data on the Platform is processed on the basis of: (a) the consent obtained by the school from parents/guardians, staff, or other Data Principals, for processing directly connected to the school's educational and administrative functions; and (b) certain "legitimate uses" recognized under the DPDP Act, such as compliance with legal obligations and purposes directly volunteered by a Data Principal (for example, a visitor to this website submitting an enquiry).

6. Sharing and Third-Party Processors

We share personal data only as necessary to operate the Platform, and only with service providers who process it on our behalf and on the instructions of the school. These providers fall into the following categories:

• Communication service providers — to deliver email, SMS, and WhatsApp notifications on the school's behalf;
• Cloud infrastructure, hosting, and storage providers — to host the Platform, run its databases, and store files and backups securely;
• Artificial-intelligence service providers — to power AI-assisted features such as Class IQ, using only the content needed to answer the request;
• Device notification services — Google’s and Apple’s push-notification services, to deliver mobile app notices to a user’s phone;
• Payment service providers — to process fee and subscription payments, where applicable (currently Cashfree Payments for online fee payments);
• Government and regulatory authorities — where a school uses the Platform to generate statutory filings (e.g. UDISE+), or where disclosure is required by law, court order, or a valid request from a competent authority;
• Professional advisors (auditors, legal counsel) under duties of confidentiality, where necessary.

We engage service providers only after reasonable due diligence, and only on terms that require them to protect personal data, keep it confidential, and process it solely to provide the service we engaged them for. They may not use it for their own purposes. We remain responsible for personal data handled by our service providers on our behalf, as required under the DPDP Act.

Our website links to Cashfree’s sign-up page through a partner link. Stavion may earn a referral commission from Cashfree when a school signs up through it. If you follow the link, Cashfree’s own privacy policy applies to what you give it. The link carries a partner code only and none of your personal data.

We do not sell personal data. A school may request information about the categories of service providers handling its data, including through its agreement with us.

7. Security Measures

We maintain reasonable security practices and procedures as required under Indian law, including: encryption of data in transit (TLS) and at rest; role-based access controls so that staff and Stavion personnel see only the data their role requires; audit logging of create/update/delete actions; regular backups with tested recovery procedures; and periodic independent security review. No system is completely immune to risk, and we will notify affected schools and, where required, the Data Protection Board of India, without undue delay in the event of a personal data breach, consistent with our obligations under the DPDP Act.

8. Data Retention

We retain personal data for as long as the school's subscription is active, and thereafter for the period necessary to comply with legal, regulatory, tax, and accounting requirements (financial and audit-relevant records are retained for a minimum of ten years; general activity logs for a minimum of two years, consistent with our internal retention schedule). Upon a school's request following termination of services, we will export the school's data to it and, following a reasonable transition period, delete or anonymize personal data no longer required to be retained by law.

9. Cross-Border Data Transfer

Some of our service providers may store or process personal data outside India. We make such transfers only to the extent permitted under the DPDP Act, and not to any country or territory restricted by the Government of India by notification. We take reasonable steps, including contractual safeguards, to ensure that personal data transferred outside India continues to be protected.

10. Your Rights (Data Principals)

Subject to applicable law, and coordinated through the relevant school where the data concerns a student or staff member, Data Principals have the right to:

• Access a summary of personal data processed and the processing activities undertaken;
• Correction and completion of inaccurate or incomplete personal data;
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements;
• Withdraw consent previously given, as easily as it was given, without affecting the lawfulness of processing done before withdrawal (and subject to legal retention requirements);
• Grievance redressal, as described in Section 13;
• Nominate another individual to exercise these rights in the event of death or incapacity.

Requests relating to a student's or staff member's data should be directed to the relevant school in the first instance, as the Data Fiduciary with primary responsibility for that record; the school may involve us as needed to fulfil the request, and we will support the school in doing so within a reasonable time. Parents can also start access, correction and erasure requests from inside the mobile app (Section 12.3).

11. Cookies and Tracking

This marketing website uses essential cookies necessary for the site to function (e.g. remembering your cookie preference) and, where enabled, analytics cookies to understand aggregate site usage. We do not use third-party advertising cookies or cross-site tracking on this website. The Platform itself (once a school is a customer) uses session cookies and local storage strictly necessary for authentication and functionality.

12. The Mobile Apps

The EduCampusOS mobile apps are for the people in a customer school: parents, students, teachers, other staff and bus drivers. You can sign in only with an account that your school has created for you, and there is no sign-up inside the app. Everything else in this Policy applies to the apps. This section adds what the apps do on your phone.

12.1 What the apps use, and why

• Account and device. Your User ID and password, and a random identifier created for each installation. The identifier is used for quick sign-in and to send notifications to your phone.
• Location, bus drivers only. While a driver has started a trip, the app shares the bus’s position with the school and with the parents of children on that bus until the driver ends the trip. A notification stays visible on the driver’s phone while this happens. The app does not collect location outside a trip and does not ask for background location. A parent’s phone may use its own position to show where they are on the bus map. That position stays on the phone.
• Camera and photos. Only when you choose to take or upload a photo for school records, or to scan a QR code such as a visitor check pass or an ID card. Nothing is recorded in the background. The apps do not use your microphone, contacts, text messages or call history.
• Notifications. If you allow them, the school can send you notices such as attendance, fees, homework and bus updates. They are delivered through Google’s and Apple’s notification services, which need an address for your device.
• Fingerprint, face or PIN. An optional app lock. Your phone does the checking, and we do not receive or store your fingerprint or face data.
• Saved on your phone. Actions taken without a signal, such as a leave request or bus boarding, are saved in encrypted storage on the phone and sent when the signal returns. Phone backup is turned off for the apps, and sensitive screens block screenshots.
• Payments. Pay opens the school’s payment page, provided by Cashfree Payments, in your browser. The apps do not collect or store your card or UPI details.

12.2 What the apps do not do

The apps contain no advertising and no third-party analytics, crash-reporting or tracking software. We do not sell personal data, use it for advertising, or track you across other apps or websites. The school’s server keeps sign-in and activity records for security, as described in Section 2.2.

12.3 Your choices

• You can turn off notification, camera or location permission in your phone’s settings at any time. A driver’s trip sharing needs location while a trip is running.
• You can sign out of the app at any time, and turn the app lock on or off.
• Parents can see the consent they have given and ask for access, correction or erasure of their child’s data from inside the app (More, then Your data). The school reviews each request. Section 10 describes these rights in full.
• If you cannot use the app, write to privacy@educampusos.com or to your school, and we will help the school act on your request.

12.4 Students

Students use the Student app under the authority of their school. Section 3 applies in full, including that we never use children’s data for advertising or tracking.

13. Grievance Redressal

In accordance with the DPDP Act, we have designated a contact point to address privacy-related grievances. Any Data Principal with a concern about how their personal data (or, for a student, their child's personal data) has been processed may contact:

Grievance Officer
Stavion Technologies (a division of Stavion Private Limited)
Email: grievance_officer@educampusos.com

We will acknowledge grievances promptly and aim to resolve them within 30 days.

14. Complaints to the Data Protection Board

If you have first raised a grievance and are not satisfied with our response (or receive none within the stated time), you have the right to file a complaint with the Data Protection Board of India, established under the DPDP Act.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on this page with a revised "Last updated" date, and for material changes, we will provide additional notice to customer schools.

16. Contact Us

For any question about this Privacy Policy, please contact us at privacy@educampusos.com or via our chat assistant.