Legal

Privacy Policy

Last updated 2 September 2026.

This policy explains how Shaswat SchoolOs handles personal data across our website and platform. For the detailed, checkable version of how we handle students' and children's data under India's Digital Personal Data Protection Act, 2023, see our Data & Privacy page — this policy and that page are consistent.

Roles. For a school's operational data, the school is the Data Fiduciary and Shaswat SchoolOs is the Data Processor — we process it only on the school's instructions. For website enquiries, we are the Fiduciary.

What we collect

Website enquiries: the name, school, email, phone and message you submit when you request a demo or contact us.
Platform data: the student, staff, academic and financial records a school enters — processed on the school's behalf.
Technical data: basic logs (IP, timestamps) needed to run and secure the service.
Location data (staff app, drivers only): a school's transport staff can optionally use the mobile app to share a bus's live GPS location during an active trip, so parents and school staff can see where it is. Location is only collected while a driver has actively started a trip, is used solely to plot that vehicle's live position, and is never collected in the background or outside an active trip.

How we use it

To respond to your enquiry and provide the service.
To keep the platform secure, reliable and compliant.
We do not sell personal data, serve advertising, or build advertising/marketing profiles. We do not use one school's data to serve another.

AI processing

Some features draft text using a third-party language model. Personal identifiers — email, phone, Aadhaar/APAAR, PAN — are stripped from every request before it leaves our servers, and student-identifying AI runs on a paid, no-training model before any real student record is processed. Every AI output is a draft for human review.

Sharing & sub-processors

We share data only with sub-processors needed to run the service — cloud hosting (India), the AI provider, and the payment/SMS/WhatsApp/email gateways a school chooses to enable. Data is exchanged with government systems (DigiLocker, UDISE+) only where a school is legally required to file it or asks us to.

Retention & security

We keep data while a school is a customer and for the statutory period after; retention is configurable per school. Data is hosted in India with per-school database isolation, role-based access, and audit logging. We are not yet ISO 27001 certified — an assessment is underway and we will not claim a badge until the certificate is issued.

Your rights & grievances

Parents and students should contact their school (the Data Fiduciary) for requests about a child's records. For anything else, contact our Data Protection & Grievance Officer at grievance@shaswatschoolos.in. We acknowledge within 72 hours and aim to resolve within 30 days. See the breach-notification process on our Data & Privacy page.

Cookies

We use only the cookies necessary to keep you signed in and secure. We do not use advertising or cross-site tracking cookies.

Changes

We may update this policy; material changes will be notified. Questions: contact us.