Privacy Policy

1. Who we are

EDUJAC Technologies LLP ("EDUJAC", "we", "us") operates the EDUJAC School ERP & Management Platform at edujac.com — a software service that helps schools manage attendance, homework, timetables, examinations, report cards, fees, leave and parent communication.

This Privacy Policy explains what information is processed through EDUJAC, why, and the choices and rights available to schools, teachers, parents/guardians and students.

2. Scope of this policy

This policy applies to the EDUJAC website, the school-facing application, and the teacher and parent portals. It covers information processed on behalf of subscribing schools and information submitted through our public website (for example, demo enquiries).

This policy does not replace any agreement between EDUJAC and a subscribing school; where both exist, they are intended to be read together.

3. School data ownership and control

Schools retain their rights and control over their institutional data, subject to applicable law and the contractual arrangements between EDUJAC and the school. EDUJAC does not claim ownership of school or student data merely because it is stored or processed through the platform.

• This includes student records, attendance, marks, report cards, parent information, teacher/staff information, fee records, timetables, leave records and other institutional information.
• EDUJAC Technologies LLP retains ownership and intellectual-property rights in the EDUJAC software, source code, platform, technology, product design, branding, trademarks and other EDUJAC intellectual property.

4. Responsibilities: schools and EDUJAC

For institutional records, the subscribing school determines what information is entered and why.

• School responsibilities: deciding what student, parent and staff information is added; ensuring it has the authority and any consents required to process that information; keeping its user accounts limited to authorized staff; and responding to parents about school-controlled records.
• EDUJAC responsibilities: processing institutional data on the school's instructions to provide the service; applying appropriate technical and organizational safeguards; and supporting schools with access, export, correction and deletion of their data.

5. Children's personal data

Because EDUJAC is a school platform, much of the information processed relates to children. Children's personal data requires — and receives — heightened protection.

Children's information is processed only for appropriate educational, academic, administrative, communication, safety and school-management purposes on behalf of the subscribing school.

Where applicable law requires verifiable consent from a parent or lawful guardian, the subscribing school is responsible for obtaining and managing that consent for the records it maintains, and EDUJAC relies on the school's authority. EDUJAC does not itself enroll children or collect their data directly from them.

EDUJAC does not intend to:

• sell children's personal data;
• use children's data for targeted advertising or conduct behavioural advertising directed at children;
• use children's data for unrelated commercial profiling; or
• process children's information in a manner intended to cause detrimental effects on their well-being.

6. Information we process

Depending on how a school uses the platform, EDUJAC processes the following categories of information:

• School information — school name, contact details, plan/subscription status.
• Account and authentication information — names, email addresses, roles (school administrator, teacher, parent), securely hashed passwords, and single-use, time-limited password-reset tokens. Passwords are never stored in plain text.
• Teacher/staff information — name, email, assigned classes, staff attendance and leave records.
• Parent/guardian information — name, email, and their linked child(ren).
• Student information — name, class, roll number, date of birth and parent linkage.
• Attendance — daily present/absent records for students and staff.
• Homework — assignments, instructions, attachments and due dates posted by teachers.
• Timetable — class schedules, subjects, periods and teacher assignments.
• Examinations, marks and grades — exam names, subjects, dates, maximum marks and per-student marks, used to compute grades.
• Report cards — per-term academic summaries, teacher remarks and publish status shared with parents.
• Fees and payment-related information — fee invoices, amounts, due dates, payment status and transaction references. Online card payments are processed by our payment provider; EDUJAC does not store full card numbers, CVV or sensitive payment credentials.
• Leave information — student and teacher leave requests and their approval status.
• Communications and notifications — school broadcasts and notices delivered through the app and, where enabled by the school, via email, SMS or WhatsApp providers.
• Student portfolio/attachment information where enabled — files uploaded through the platform (for example, homework attachments), stored using cloud object storage.
• Visitor and staff records where enabled by the school.
• Website enquiries — information submitted through the public demo/enquiry form (school name, contact person, email, phone, school type, approximate student count and message).

7. How we obtain information

• Entered by subscribing schools and their staff (for example, student records, attendance, marks).
• Provided by parents/guardians through the parent portal (for example, leave requests).
• Submitted through our public website enquiry form.
• Generated automatically while providing the service (for example, account activity and security records).

8. Why we process information

• To provide, operate and secure the school ERP service subscribed to by the school.
• To enable attendance, homework, timetable, examination, report-card, fee and leave management.
• To deliver school communications to parents and staff.
• To respond to enquiries submitted through our website.
• To meet legal, contractual, security and dispute-resolution requirements.

9. Data sharing and service providers

EDUJAC may use carefully selected service providers to operate the platform, for functions such as hosting and cloud infrastructure, email delivery, SMS/WhatsApp notifications, payment processing, AI-assisted functionality, security/monitoring and technical support. These providers process information only as needed to deliver their services to EDUJAC and under their own applicable terms and privacy practices.

EDUJAC does not intend to sell school, student, teacher or parent personal data, and does not share it for unrelated third-party marketing.

10. AI-assisted functionality

EDUJAC offers AI-assisted features — for example, helping teachers draft homework content and suggestions. AI features are initiated by a teacher or other authorized user, and AI-generated educational content should be reviewed by that teacher/authorized user before it is shared.

Users should avoid including unnecessary student personal information in AI prompts. Third-party AI service providers may process the prompts sent to them where applicable, under their own data terms. EDUJAC does not itself train AI models on school or student data.

11. Payment information

Online fee payments are processed by third-party payment providers (such as Stripe) on their hosted payment pages. Those providers process payment instrument details according to their own terms and privacy practices.

EDUJAC stores fee invoices, amounts, payment status and transaction references — not full card numbers, CVV or other sensitive payment credentials.

12. Data security and access controls

EDUJAC applies appropriate technical and organizational safeguards to protect personal data. Measures in the current platform include:

• HTTPS/TLS encryption for data in transit between your device and the service.
• Passwords protected using bcrypt hashing; plain-text passwords are never stored.
• Token-based authentication (signed JSON Web Tokens) for API access.
• Role-based authorization so users can only access features appropriate to their role, and per-school data isolation so each school's records are separated from other schools.
• Password-reset links that are single-use, stored only in hashed form, and expire after a short period (currently 15 minutes); existing sessions are invalidated when a password is changed.

13. Cookies and device storage

EDUJAC uses limited browser device storage for authentication and preferences — not advertising trackers. Details are in our Cookie & Device Storage Policy.

14. Data retention

We retain information only for as long as reasonably necessary for the purposes described in this policy, to provide the service, and to meet contractual, security, dispute-resolution and applicable legal requirements. See our Data Retention & Deletion Policy for the per-category approach.

15. Data deletion

Schools may delete or request deletion of records through the platform or by contacting us. When information is no longer needed for the purposes described, it may be securely deleted or anonymized unless retention is required for legal, contractual, security or dispute-related purposes.

16. Data export

The platform provides export capabilities for several record types (for example, report cards and reports in PDF/CSV/Excel formats). Schools may request an export of their institutional data as described in the applicable agreement and within the platform's technical capabilities.

17. School termination and data exit

When a school stops using EDUJAC, an appropriate data-export mechanism or period may be provided according to the applicable agreement and technical capabilities. School data is not intended to be retained indefinitely without purpose: after applicable retention and export requirements are satisfied, information may be securely deleted or anonymized unless retention is required for legal, contractual, security or dispute-related purposes.

18. Your requests and data-principal rights

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the applicable Digital Personal Data Protection Rules, 2025 as relevant provisions become applicable, individuals may have rights to access, correct, update or request erasure of their personal data, and to raise grievances.

Where a request relates to school-controlled educational records (for example, a student's marks or attendance), it may need to be handled through or coordinated with the relevant school, which controls those records. Requests can be submitted using the contact details below.

19. Grievance redressal

Privacy questions, requests and grievances may be submitted to EDUJAC using the contact details below. We will review and respond in accordance with applicable law. The Grievance/Privacy contact person details are being finalized and will be updated here once registered.

20. Cross-border processing

Certain technology and service providers may use infrastructure located outside India. Where cross-border processing occurs, EDUJAC intends to follow applicable Indian legal requirements and applicable government restrictions on such transfers.

21. Security incidents and data breaches

If EDUJAC becomes aware of a personal-data security incident affecting the platform, it will take reasonable steps as appropriate to investigate, contain and mitigate risks, secure affected systems, preserve appropriate records, cooperate with affected subscribing schools, and make any notifications required under applicable law.

22. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above shows the current version. Material changes will be reflected on this page.

23. Applicable law

This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the applicable Digital Personal Data Protection Rules, 2025 as relevant provisions become applicable.