Privacy Policy
Template notice. This Privacy Policy is a good-faith starting template, not legal advice. It must be reviewed and adapted by qualified counsel for your jurisdiction and business before you publish or rely on it. Bracketed placeholders such as [Company legal name] and [contact email] must be completed.
This policy explains how [Company legal name] ("Vidyalaya", "we", "us") handles personal information when you visit our website, request a demo, or use the Vidyalaya school-management platform (the "Service").
Our two roles
We handle personal data in two capacities:
- As a controller for data about our website visitors, demo requesters, and the staff who administer a customer account — for example the contact details you submit to us.
- As a processor for the student, guardian and staff data a school ("Customer") puts into the Service. The Customer is the controller of that data and decides why and how it is processed; we process it on their documented instructions under our agreement with them.
Information we collect
Information you give us
- Contact and demo requests: name, school name, role, email, phone, approximate student count, and any message you send.
- Account & administration: the details needed to set up and support a Customer account.
- Communications: emails and support messages you send us.
Customer data in the Service
On a Customer's instruction, the Service stores records such as student and guardian profiles, admissions, attendance, timetables, exam results, fees and payments, HR and payroll, library, transport, hostel, health and communications. Some of this is sensitive, including data about children. We process it only to provide the Service.
Information collected automatically
- Usage & device data: IP address, browser type, pages viewed and similar log data, used to operate and secure the site.
- Cookies: we use strictly necessary cookies to run the site and, where you consent, limited analytics. See "Cookies" below.
How we use information
- To respond to demo requests and enquiries, and to provide, maintain and support the Service.
- To secure our systems — including authentication, abuse prevention, and audit logging of privileged actions.
- To communicate service, security and administrative notices.
- To comply with legal obligations and enforce our Terms of Service.
- With your consent, to send occasional product updates. You can opt out at any time.
We do not sell personal data, and we do not use student data for advertising.
Legal bases
Where applicable law (such as the EU/UK GDPR or India's DPDP Act) requires a legal basis, we rely on: performance of a contract; your consent; our legitimate interests in operating and securing the Service; and compliance with legal obligations. For Customer data we act on the Customer's basis and instructions.
How we share information
We share personal data only as needed:
- Service providers (sub-processors): vetted vendors who host, process payments, send email or provide support under contract. A current list is available on request.
- With the relevant Customer: data you provide in connection with a school is shared with that school.
- Legal & safety: where required by law or to protect rights, safety and the integrity of the Service.
- Business transfers: in a merger, acquisition or asset sale, subject to this policy.
Data isolation & security
Each Customer's data is kept in an isolated tenant, enforced both in the application and, progressively, at the database with row-level security. Access is governed by least-privilege, role-based controls; authentication is hardened; and privileged actions are audit-logged. See our Security page for detail. No system is perfectly secure, but we design to protect this data seriously.
International transfers
Depending on configuration, data may be processed in the country you select via our regional configuration ("country packs") or in other locations where we or our sub-processors operate. Where required, we put appropriate safeguards (such as standard contractual clauses) in place. [Confirm actual hosting regions with counsel.]
Retention
We keep contact and demo data for as long as needed to respond and for a reasonable follow-up period, then delete or anonymise it. Customer data is retained for the term of the Customer's agreement and per the retention window configured for that tenant; on request or on termination we delete or anonymise it, except where law requires longer retention (for example, financial records).
Your rights
Subject to your local law, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. This includes data-subject access requests (DSAR) and erasure requests.
- If your data sits in a school's account, please contact that school (the controller); we will support them in fulfilling your request. The Service provides tooling to export a complete record and to erase (anonymise) it.
- Otherwise, contact us using the details below. We respond within the timeframe your law requires.
You may also have the right to complain to your data-protection authority.
Children's data
The Service is used by schools to process data about children on the school's instruction and legal basis. We do not knowingly collect children's data directly through our marketing site.
Cookies
We use strictly necessary cookies to operate the site. Any non-essential cookies (such as analytics) are used only with your consent, which you can change at any time. [Insert your cookie details / banner configuration.]
Changes to this policy
We may update this policy from time to time. Material changes will be posted here with a revised "Last updated" date.
Contact us
Questions or requests: [contact email] · [Company legal name], [registered address]. For a school account, contact your school administrator, who can escalate to us.