Privacy Notice

Under the DPDP Act there is a meaningful difference between the organisation that decides why personal data is processed (a Data Fiduciary) and the one that processes it on instruction (a Data Processor). ShikshaFlow is sometimes one and sometimes the other, and which one it is decides what we may lawfully do.

For a school’s data, the school is the Data Fiduciary and we are its Processor. Pupils, guardians, staff, marks, fees, attendance, and the school’s own admission enquiries — the school decides why those are held, and we hold them to run the service for that school and for nothing else of our own.

For leads we collect ourselves, we are the Data Fiduciary. If you message our own WhatsApp number, scan the QR on this site, or write to us directly, we decide why we hold what you tell us, and this notice is how we tell you. That is a genuinely separate set of records, kept in a separate part of the system from any school’s.

The school holds your data and decides what happens to it. We run the software. If you want to see what is held about you, have it corrected, or have it erased, ask your school — they can do all three from within the product, and we will help them if they need it.

We will not use anything about you or your child for our own purposes. We do not sell it, we do not advertise to you, and we do not use it to train anything.

When you message our WhatsApp number or fill in a form here, we are told your phone number by WhatsApp itself, and we keep whatever you type — such as your school’s name, your city, your role, and when you would like us to call.

We use it for one thing: to have a conversation with you about the product. A person from our team may call or message you about it. We do not add you to a marketing list.

If you asked us to introduce you to a school, we will pass your phone number to the school you chose, and only that school. From that point the school handles your enquiry under its own privacy notice. We keep a record that we made the introduction.

Reply STOP on WhatsApp at any time. We stop immediately and we will not message you again from that number.

This product exists to run schools, so most of the data in it concerns children. It is held by the child’s school, under the school’s own responsibility, and we process it only on the school’s instruction.

Sensitive fields — government identifiers and medical notes — are encrypted in the database, and reading them is a separate, audited action available only to staff whose role explicitly permits it. A child’s personal details are never written into our operational logs.

We do not build profiles of children, we do not track them across websites, and we do not advertise to them or to their families.

A school’s records are kept for as long as the school needs them, on a retention policy the school sets. Academic and financial records are deliberately not deleted on request, because a transcript has to be reproducible years later; they are retired rather than destroyed.

Leads we collect ourselves are kept for a limited period and then erased: enquiries from people seeking a school for six months, and enquiries from schools about the product for two years, which is the length of a realistic sales conversation.

Sub-processors we use to run the service: our hosting provider, our email provider, and the messaging providers that carry WhatsApp and SMS. Each sees only what it needs to deliver the thing it delivers — a messaging provider sees a phone number and a message, not a school’s records.

Nobody else. We do not sell personal data, and we do not share it for anybody’s advertising.

Each school’s data is separated from every other school’s in the database itself, not only in the screens — so a person signed in at another school cannot read your records even if our application code were wrong about it.

Every action that touches a pupil’s record or money is recorded in a tamper-evident trail, and that trail cannot be edited by anybody, including us.

Under the DPDP Act you can ask what is held about you, ask for it to be corrected, ask for it to be erased, withdraw consent you gave, and nominate somebody to act for you if you cannot.

If a school holds the data, ask the school. If we hold it — because you contacted us directly — write to privacy@shikshaflow.in and we will answer.

If we have not dealt with you properly you can complain to the Data Protection Board of India.

Each version of this notice is kept and dated. If we change it in a way that affects you, we will tell you before it takes effect rather than after.