Vidyakrit (("Vidyakrit", "we", "us", "our")) is a multi-tenant School Management SaaS operated by Technokrits. This policy explains what data we collect, why we collect it, how we keep it safe, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law.
1. Who we are
The platform is operated by:
- Technokrits, India — registered platform operator and Data Fiduciary under the DPDP Act 2023.
- Grievance Officer / Contact: [email protected]
2. What data we collect
We collect only what is necessary to run a school management platform.
For platform users (school admin, teachers, accountant, etc.)
- Name, email, mobile number, role.
- Login activity (IP, user-agent, timestamp) for audit and abuse-prevention.
- Two-factor authentication secret (encrypted) when enrolled.
For students and parents
- Student name, date of birth, gender, class, admission number, parent contact (phone, email, address).
- Optional: Aadhaar last-4 digits, religion, caste, mother tongue — only when explicitly entered.
- Attendance, marks, fee receipts, certificates issued, behavior log entries.
3. Why we collect it
- To operate the school management features the school has subscribed to.
- To send transactional notifications (fee due, attendance alert, exam result) on the school's behalf.
- To enforce account security (login throttling, 2FA challenge, audit logs).
- To bill the school for the subscription plan and any communication credits used.
- To comply with statutory record-keeping required under Indian education and tax law.
4. Your rights under the DPDP Act 2023
You can exercise any of the following rights at any time by emailing the Grievance Officer:
- Right to access — a copy of the personal data we hold about you.
- Right to correction — fix inaccurate or incomplete data.
- Right to erasure — delete data we no longer need, subject to statutory retention.
- Right to grievance redressal — escalation path if you believe your data has been misused.
- Right to nominate — designate another person to act on your behalf in case of incapacity or death.
For minors (under 18), we collect data only with verifiable parental consent recorded against the parent's phone number, as required by §9 of the DPDP Act.
5. How we protect your data
- All passwords are hashed with Argon2id (12 rounds, salt + pepper).
- Sensitive columns (2FA secrets, recovery codes) are encrypted at rest using AES-256.
- All traffic is served over HTTPS (TLS 1.2+) with HSTS preload.
- Each school's data is isolated by tenant scoping at the application layer; subdomain cookies do not cross tenants.
- Daily encrypted backups are retained per the Spatie backup policy (7 days daily, 8 weeks weekly, 4 months monthly, 2 years yearly).
6. When we share your data
We do NOT sell personal data. We share it only when:
- The school owner instructs us to (e.g. exporting a class roster, issuing a TC).
- A government authority requires disclosure under law (subpoena, FIR, education department audit).
- A processor (SMS gateway, payment gateway, SMTP provider) needs the minimum data to deliver the message — and is contractually bound to handle it as confidential.
7. How long we keep it
We retain student academic and financial records for as long as the school account is active, plus a 5-year statutory period (matches Indian education regulations). Login logs and audit trails are retained for 12 months. Backups follow the standard Spatie rotation policy.
8. Cookies
We use first-party cookies only — a session cookie for authentication and an optional locale cookie for the Hindi/English switch. No third-party analytics or ad cookies are set on the platform itself.
9. Changes to this policy
We may update this policy as the platform evolves. Material changes will be announced via in-app notification at least 14 days before the new policy takes effect.
10. Contact us
Reach the Grievance Officer for any DPDP-related request, complaint, or escalation: