§01
Introduction
Please read this Privacy Policy carefully. It explains how Educantic handles personal data when you use the Platform. Where consent is required by applicable law, we will seek it in the manner required by law; using the Platform does not replace any separate notice or consent that may be required.
1.1
Welcome to www.educantic.com ("Website") and the Educantic Application ("Application"), a school ERP platform covering admissions, attendance, fee management, gradebooks, communication, and an AI assistant ("Educantic AI") — together the "Platform" — owned and operated by Educantic and its affiliates ("Company", "we", "our", "us"). "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the Company.
1.2
Your use of the Platform's admissions, attendance, fee, communication, and Educantic AI features ("Services") is subject to this Privacy Policy and our Terms of Service. Personal data will be processed for the purposes described in the applicable notice and on a lawful basis permitted by applicable Indian law.
1.3
In this Policy, "you" and "Users" means anyone using the Platform — Admin Users, teachers, parents, and students — including where an institute has registered on a student's or parent's behalf.
1.4
If you are under 18, your institute and/or parent or lawful guardian should supervise your use of the Platform as appropriate to the Services and applicable law. Where Indian law requires verifiable parental consent for processing a child’s personal data, that consent must be obtained before the relevant processing, unless a legally applicable exemption applies. For users outside India, additional requirements may apply under the laws applicable to them.
1.5
We may update this Policy from time to time. Updates are posted on this page, and we encourage you to review it periodically.
1.6
Protecting personal data is central to how we operate. We collect, use, disclose, and retain personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, applicable rules and directions, and this Policy, to the extent each law or provision is in force and applies to the relevant processing.
§02
Definitions
| Term | Meaning |
|---|---|
| Usage Data | Information generated automatically through your use of the Platform (device, browser, activity logs). |
| Cookies | Small data files stored on your device by your browser when you use the Platform. |
| Data Fiduciary (referred to as "Data Controller" in some clauses below) | The entity that determines the purpose and means of processing personal data. Depending on the activity, an institute may be the Data Fiduciary for student and school records it controls, while Educantic may process those records on the institute’s documented instructions. Educantic may act as a Data Fiduciary for personal data it processes to operate its own website, manage customer relationships, provide support, or meet its own legal obligations. |
| Data Processor | Any party that processes personal data on behalf of a Data Fiduciary. |
| Data Principal (referred to as "PII Principal" in some clauses below) | The individual to whom personal data relates, including students, parents/guardians, teachers, and institute administrators. Under the DPDP Act, a parent or lawful guardian may act for a child where the Act and applicable rules provide for it. |
| Consent Manager | A person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review, or withdraw consent through an accessible platform. Educantic does not currently route consent through a third-party Consent Manager; consent is collected and logged directly on the Platform. |
§03
Information We Collect
Registration is required for features that need an account. You are responsible for activity under your account and should provide accurate information that is necessary for the relevant Service. Educantic and the relevant institute will provide notices and seek consent where required by applicable law; registration alone is not treated as blanket consent for every purpose.
Personal data you or your institute provide
- Name, email address, phone number
- Address, city, state, PIN code
- Date of birth, gender (where collected for academic records)
- Class/section, roll number, enrollment and academic records
- Attendance and fee-payment records
- Photograph, where uploaded for an ID card or profile
- Parent/guardian contact details, for student accounts
Usage data
Collected automatically where applicable: IP address, browser type and version, device identifiers, operating system, pages and features accessed, and timestamps or usage events. We use this information for service delivery, security, troubleshooting, abuse prevention, and other purposes explained in the relevant notice. We limit collection and retention to what is reasonably necessary for those purposes and applicable legal obligations.
Location data
Collected only if you grant permission (e.g. for attendance features that use location), to provide or improve that specific feature.
Data from other sources
Where you sign in through a connected third-party account, or your institute imports records from a prior system, we receive the corresponding information from that source.
§04
How We Use Your Information
We use the information collected to:
- Create and maintain accounts, and deliver the Services your institute has subscribed to;
- Record attendance, process fee payments, and generate report cards and academic records;
- Send service notifications — attendance alerts, fee reminders, exam schedules;
- Provide customer support and resolve technical issues;
- Analyze aggregated, de-identified usage to improve the Platform;
- Verify identity and prevent fraud or unauthorized access;
- Meet legal, regulatory, and billing obligations;
- Send product updates or offers, where you haven't opted out.
We do not sell student, parent, or teacher personal data to advertisers, and we do not use student academic records for behavioral advertising.
§05
Cookies
5.1
Necessary cookies — session cookies that keep you logged in and preserve your place in multi-step forms (e.g. admissions or fee entry). Required to use the Platform.
5.2
Preference cookies — remember language, theme, and dashboard layout choices.
5.3
Analytics cookies — help us understand which features are used and where users encounter friction, so we can improve the Platform.
5.4
Marketing cookies and technologies — if enabled on a relevant page, these may support advertising measurement or marketing activities. They should remain disabled unless the user has made the applicable choice through the consent interface, where consent is required.
Necessary cookies support core functionality and security. Preference, analytics, and marketing technologies, where used, are optional and are controlled through the cookie-consent interface where provided or through available browser controls. Rejecting optional categories should not disable essential school ERP functions. Your selection is stored so the site can remember your choice; the consent log may include your choice, policy version, timestamp, and IP address for consent administration, security, and audit purposes. We do not treat a click on "Accept All" as permission for purposes unrelated to the categories described in the consent interface.
§06
Data Retention & Deletion
6.1
We retain personal data for no longer than is reasonably necessary for the stated purpose, unless a longer period is required or permitted by applicable law, a lawful request, a dispute, or a contractual obligation. Retention and deletion practices will be implemented in accordance with applicable legal requirements as they come into force.
6.2
Academic and attendance records are retained according to the institute’s instructions, its subscription and service arrangements, applicable education requirements, and any other lawful retention obligation. Institutes should identify records that must be preserved for statutory or academic reasons.
6.3
Upon termination or expiry of an institute’s subscription, the institute’s data will be returned, made available for export, deleted, or otherwise handled in accordance with the applicable service agreement and documented instructions. Where a six-month deletion window has been agreed for the relevant service, deletion will occur within that period, unless a longer period is required by law, needed for security or dispute resolution, or agreed in writing. Backups may remain until overwritten or deleted under the applicable backup cycle. Institutes should export required records before access ends.
6.4
Aggregated, anonymized data derived from Platform usage may be retained beyond this period, as it no longer identifies an individual.
§07
Your Rights & Consent
Where consent is the applicable legal basis, it should be free, specific, informed, unconditional, and unambiguous, and should be recorded in a manner appropriate to the processing. For school-managed student records, the institute and Educantic will follow their respective responsibilities under the service arrangement and applicable law. Where verifiable parental consent is legally required for a child’s personal data, it must be obtained before processing unless an applicable exemption applies; a school’s involvement does not automatically replace every legal consent requirement.
Access
See what personal data we hold about you
Correction
Fix inaccurate or outdated data
Erasure
Request deletion of your personal data
Processing concerns
Ask us to review a concern about how your data is handled, subject to applicable law
Grievance redressal
Raise a complaint and get a timely response
Nominate
Name someone to exercise your rights on your behalf if you die or become incapacitated
Withdraw consent
Opt out of processing at any time, as easily as you gave it
7.1
To exercise any of these rights, email support@educantic.com. We may ask for identity verification before acting on a request.
7.2
We aim to acknowledge requests promptly and, where reasonably possible, respond within 5 working days. This is a service target and does not replace any statutory timeline that applies. Some data may need to be retained where required by law, for security, to resolve disputes, or under applicable educational or accounting requirements.
7.3
Withdrawing consent may mean we can no longer provide part or all of the Services to that account, but withdrawal does not affect the lawfulness of processing carried out before it. Where Educantic acts as Data Processor on behalf of an institute (Data Fiduciary), requests are routed to and executed for that institute.
7.4
If you are not satisfied with how we have handled a request, you may escalate it to our Grievance Officer (Section 17). You may also approach the Data Protection Board of India in accordance with the applicable law and the Board’s operational procedures when available for the relevant matter.
§08
Educantic AI & Data Sharing
Certain Platform features use artificial intelligence to assist with teaching and administration ("AI Features") — currently including the Educantic AI assistant, AI-generated report summaries, and AI-assisted lesson planning support. This list may change; the in-app disclosure always reflects what's currently active.
8.1
Consent first. AI Features are off by default. Before any data reaches an AI service provider, you see an in-app disclosure explaining what is shared and with whom, and must actively agree. If you don't, AI Features stay off and the rest of the Platform works as normal.
8.2
What is shared. Only: (i) the question or prompt you enter; (ii) text extracted from an attached document or photo — never the original file; and (iii) which class, subject, or record the query relates to.
8.3
Who receives it. This is shared with our AI model provider(s) solely to generate the response. It is not used to train their general-purpose models.
8.4
What is never shared. Your name is never sent to the AI provider — requests use a placeholder, and your name is reattached only after the response returns. We never share contact details, login credentials, marks/attendance records, or original files with the AI provider beyond what's stated above.
8.5
Withdrawal. You may withdraw consent for AI Features at any time by writing to the Grievance Officer (Section 17). This disables AI Features for your account without affecting the rest of the Platform.
Educantic AI output should always be reviewed by a teacher or administrator before it's used for grading, report cards, or parent communication.
§09
Disclosure of Data
9.1
Legal necessity. We may disclose data in response to a valid legal or statutory request, or where we believe it necessary to investigate fraud, protect safety, or prevent illegal activity.
9.2
Business transfer. If Educantic is involved in a merger, acquisition, or asset sale, your data may transfer to the new owner, subject to the same protections in this Policy.
9.3
Service providers. We may share relevant data with service providers that help operate the Platform, such as hosting, payment processing, messaging (including SMS or WhatsApp), support, security, and analytics providers. We seek to limit sharing to what is needed for the service, use appropriate contractual and security measures, and provide information or obtain consent where required by applicable law. Optional analytics or marketing technologies should be used in accordance with the choices presented in the cookie-consent interface.
9.4
User-initiated sharing. Content you choose to post in shared areas (e.g. class discussion boards, if enabled) is visible to other users of that space by design — share personal information there at your own discretion.
9.5
We do not use your personal data for third-party marketing or advertising without your prior consent.
§10
Data Security
No transmission or storage method is 100% secure, but we take reasonable security safeguards, as expected under the DPDP Act and the Information Technology Act, 2000, including:
- Encryption of data in transit and at rest;
- Role-based access, limiting data visibility to what each account role needs;
- Firewalls and regular security review of infrastructure;
- Restricting internal access to staff who need it to operate the Service;
- Payment data handled by PCI-compliant third-party payment processors, under their own security standards;
- A documented process for detecting and responding to any personal data breach, including notifying the Data Protection Board of India and affected users as required by law.
§11
Cross-Border Data Transfer
11.1
We aim to use infrastructure located in India where available and appropriate; however, the location of storage or processing can depend on the service provider and feature used. Where relevant, we will provide further information about material transfers or processing locations in the applicable notice or service agreement.
11.2
Where personal data is processed or transferred outside India, Educantic will do so subject to applicable Indian law, any restrictions or requirements notified by the Central Government, and relevant contractual and security safeguards. Some third-party providers, including cloud or AI providers, may process data in other jurisdictions; the applicable service and its processing locations should be checked before enabling such features.
11.3
We will take reasonable steps to assess relevant transfer restrictions and provider arrangements. This statement is not a guarantee that every third-party provider’s infrastructure is located only in India; contact us for information about a particular service where needed.
§12
Third-Party Links
12.1
The Platform may link to third-party sites or services not operated by us. We have no control over, and no responsibility for, their content or privacy practices — please review their policies before using them.
§13
Children's Privacy
13.1
Much of the student data handled by Educantic relates to children. Under the DPDP Act, a child is an individual who has not completed 18 years of age. Student information may be entered or managed by an institute, parent, or lawful guardian, depending on the feature and the institute’s processes.
13.2
We aim to collect and process only personal data reasonably necessary to provide the relevant academic and administrative Services, such as name, class/roll details, attendance, grades, and guardian contact information. We do not intend to process a child’s personal data in a manner likely to cause a detrimental effect on the child’s well-being.
13.3
Where applicable Indian law requires verifiable parental consent, the relevant Data Fiduciary must ensure that it is obtained before processing, unless a specific statutory exemption applies. Depending on the data and service, the institute may be the Data Fiduciary and may coordinate the consent process, while Educantic provides technical support under its agreement with the institute. Parents or lawful guardians may contact their institute or write to support@educantic.com to request access, correction, or deletion, subject to applicable law and record-retention obligations.
13.4
Educantic’s policy is not to use children’s personal data for behavioural advertising or to undertake tracking or behavioural monitoring of children, except where a specific legal provision or exemption lawfully applies. We do not use student academic records to target advertising. Any child-related processing will be reviewed against the applicable requirements of Indian law, including restrictions and exemptions that may apply to particular classes of Data Fiduciaries or purposes.
Educantic currently focuses on serving institutes in India. If we later offer services to institutes or users in another country, we will assess the privacy and child-protection laws that apply to that activity and update our practices and notices where required. This Policy does not claim that Educantic is currently certified or compliant with every foreign privacy regime.
§14
Regional & International Compliance
14.1
India (primary jurisdiction). The Platform is currently intended primarily for institutes based in India. This Policy is governed by applicable Indian law, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and applicable rules, directions, and amendments, to the extent in force and applicable. The role of Educantic and each institute depends on the relevant processing: an institute may be the Data Fiduciary for school records, while Educantic processes those records on its instructions; Educantic may be a Data Fiduciary for its own website, customer, support, security, and legal-compliance activities.
14.2
Regulatory authority. The Data Protection Board of India is established under the DPDP framework. Any complaint or escalation to the Board must follow the applicable provisions, commencement dates, rules, and procedures in force at the time.
14.3
Future international use. If Educantic later serves institutes or users outside India, the parties will assess which local laws apply to the relevant processing and allocate responsibilities through appropriate notices and contracts. Technical features such as data export, deletion workflows, and consent logs may support compliance but do not, by themselves, guarantee compliance with any foreign law.
14.4
Other jurisdictions. Educantic currently focuses on India. If services are later offered in the United States or another jurisdiction, applicable requirements (which may include COPPA or other child-privacy laws) will be assessed before the relevant service is offered. No statement in this Policy should be read as a claim of certification under a foreign law.
§15
Intellectual Property
15.1
"Educantic" and all associated names, logos, and Platform materials are the intellectual property of the Company and protected under applicable copyright and trademark law. This Policy does not grant any rights to that intellectual property.
§16
Changes to this Policy
16.1
We may update this Policy from time to time to reflect changes in our services, data practices, or applicable Indian law. Material changes will be posted on this page with an updated "Last updated" date, and additional notice or consent will be provided where required by applicable law.
16.2
Where required by applicable law, we will provide notice of material changes and obtain fresh consent before processing on a changed basis. Continued use of the Platform does not, by itself, replace any consent or notice required by law.
§17
Contact & Grievance Officer
For privacy complaints and data-rights requests, please contact the grievance contact listed below. The contact details and response targets should be kept current and aligned with the legal requirements applicable to Educantic.
Grievance Officer
Prathik Singh
Designation: Grievance Officer
Email: grievance@educantic.com
Registered address: Lalitha Nagar, Meerpet, Jillalguda, Hyderabad, Telangana 500097
Response time: acknowledged within 24 hours, resolved within 5 working days
17.1
General privacy or data-rights requests can also be sent to support@educantic.com; these are routed to the Grievance Officer.
17.2
If your complaint is not resolved to your satisfaction, you may use any escalation or complaint mechanism available under applicable Indian law and the procedures in force at the time.
In short: Educantic aims to collect and use only personal data needed to provide admissions, attendance, fee, and academic services; does not sell student personal data; keeps AI Features subject to the in-app disclosure and choice described above; and handles personal data in accordance with applicable Indian law and the service arrangements with institutes.