Introduction
EduNixx ("we", "our", "us") is a school management platform (School ERP) designed to help educational institutions organize, automate, and manage their daily academic, administrative, and financial activities. We value the privacy of our partner schools, their staff, students, and parents. This Privacy Policy explains what data is collected, how it is used, processed, stored, and protected within the EduNixx platform (Web Admin, Teacher App, Student App).
This policy is aligned with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian data protection frameworks, given the sensitive nature of student (minor) data processed on the platform.
Roles and Responsibilities
2.1 Data Controller (Institution)
The educational institution ("School", "Partner School") acts as the Data Fiduciary / Data Controller. Responsibilities include:
- Deciding what data is collected and entered into the platform
- Obtaining valid, verifiable consent from students, parents/guardians, and staff
- Ensuring accuracy of uploaded data
- Assigning appropriate roles and access permissions
2.2 Data Processor (EduNixx)
EduNixx acts as a Data Processor, meaning:
- We process data strictly on instructions from the school
- We do not independently determine the purpose of data processing
- We implement the technical and organizational security required to protect that data
2.3 End Users (Students, Parents, Staff)
End users access data as authorized by their institution and must route data requests (access, correction, deletion) through their school's administration, who in turn coordinates with EduNixx where platform-level action is required.
Information We Collect
Data collected corresponds directly to our active database schemas and is limited to what is necessary for ERP operation (data minimization principle).
3.1 Institutional Data
Institution name, address, contact details, subscription tier, billing registers, and module configurations.
3.2 Student Data (Minors)
Full name, DOB, gender, guardian parameters, attendance history, academic marks cards, Aadhaar IDs (always encrypted).
3.3 Staff Data
Names, contact indices, payroll bank accounts, bios, attendance scans, and securely bcrypt-hashed passwords.
3.4 Financial Data
Fee structures, payment receipts, accounting ledgers. Card numbers are never stored (processed via PCI-DSS gateways).
3.5 Usage & Technical Data: IP logs, access times, device tokens, and a complete system audit trail logging all Create, Update, and Delete operations for accountability.
3.6 AI Module Data (PaperScribe): Scanned handwritten question papers submitted temporarily for OCR transcription via the school's own configured Gemini API key.
How We Use This Data
We use collected data solely to deliver core ERP functionality. We do not sell, rent, trade, or distribute personal data to advertisers or third parties, and no data is used for behavioral profiling.
- Managing student admission cycles, section mappings, and annual class promotions.
- Tracking class attendance (students) and daily shift registers (staff).
- Reconciling fee payments, issuing invoices, and generating digital receipts.
- Generating printable templates (student ID passes, admit cards, notice boards, report cards).
- Broadcasting targeted communications (period changes, fee reminders, alert notifications).
- Maintaining database security audit trails.
Legal Basis for Processing
Our processing of personal data is justified under the following legal bases:
Consent: Schools onboard user records and confirm they have obtained appropriate consent from parents (verifiable parental consent for minors, as mandated by the DPDP Act).
Contractual Necessity: Required to fulfill the ERP licensing agreement and operational expectations of the partner school.
Legal Obligations: Retaining financial ledgers and tax records under applicable Indian fiscal laws.
Legitimate Use: Auditing user access, maintaining server defenses, and preventing cross-tenant security breaches.
How Sensitive Data Is Protected
EduNixx employs comprehensive technical and structural security mechanisms to protect sensitive data categories from unauthorized access or alteration.
Multi-Tenant Isolation
Enforced strictly via PostgreSQL Row-Level Security (RLS). One tenant's connection is structurally blocked from accessing another's.
Encryption at Rest
Sensitive fields like Aadhaar numbers, payroll bank details, and student wallets are encrypted using AES-256 before disk write.
Transit Security & Hashing
All data transfers use HTTPS/TLS 1.2+. Staff and parent passwords are saved as salted, irreversible bcrypt hashes.
Granular Access (RBAC)
Granular role permissions ensure only authorized coordinators can decrypt sensitive payroll or ID card credentials.
Third-Party Data Processors
We share only the minimum required data with authorized sub-processors. These services are bound by data-protection agreements restricting use strictly to their designated purposes.
| Sub-processor | Purpose | Data Shared |
|---|---|---|
| Resend | Verification OTPs, notification emails | User email, notification body |
| Firebase (FCM) | Mobile app push broadcasts | Mobile device tokens, title texts |
| Google Gemini API | OCR parsing of scanned exams | Temporary images (school key only) |
| AWS & Cloudflare R2 | Secure database & object storage | Encrypted database snapshots & files |
| Hostinger | Core application API hosting | ERP software processing |
Data Retention
We retain tenant records during the active subscription period. If a school terminates its license:
- All student master lists, staff logs, and fee ledgers are compiled into a secure zip file for export.
- Within 90 days, all records are permanently deleted from active PostgreSQL tables and Cloudflare R2 object storage.
- Temporary exam paper scans uploaded to the PaperScribe OCR pipeline are cleared automatically upon completion of the transcription step.
Data Principal Rights
Under the DPDP Act, users (or their guardians) have rights regarding their data. Since the school is the primary Data Fiduciary, individuals must route requests through school coordinators:
Administrators can report verified deletion requests to us at privacy@edunixx.com.
Grievance Officer
To address privacy complaints, we have designated a Data Protection & Grievance Officer:
Designation: Data Protection & Grievance Officer
Email: privacy@edunixx.com
Timeline: Acknowledged within 48 hours; resolved within 30 days.
Data Breach Notification
In the event of a confirmed security incident affecting school databases:
- We isolate affected systems immediately to stop any leak.
- We notify the school administrators within 72 hours with details of the breach and suggested mitigations.
- We report incidents to the Cert-In and DPBI regulatory authorities as required by Indian legal frameworks.
Cookies & Tracking
We use only essential, non-tracking cookies in our Web Admin application. These cookies are required to manage login sessions, prevent Cross-Site Request Forgery (CSRF), and verify active user tokens. We do not use advertising tracking cookies or compile behavioral profile logs.
AI / Automated Processing
The PaperScribe AI module processes scanned exam papers solely to extract handwritten text. All final evaluations, grading adjustments, and report card reviews require human intervention (the school's teachers). We do not perform fully automated grading or profiling of students.
Cross-Border Data Transfer
Our servers, database instances, and backup storage reside primarily on cloud infrastructure (AWS, Hostinger) situated within Indian national boundaries. To ensure low-latency media delivery, cached images are served through Cloudflare's CDN node network. We maintain standard safety clauses ensuring all data matches DPDP frameworks.
Children's Data
Because schools manage minor records, we apply strict safety measures:
- We process student data solely on behalf of, and under the instructions of, the school.
- The school represents that it has obtained verifiable consent from parents before onboarding students under 18.
- We do not track student behavior or display commercial advertising inside student/parent apps.
No Unauthorized Commercial Use
EduNixx is built strictly as a productivity ERP. Personal data of students, parents, and teachers is never monetized, shared with data brokers, or used to build marketing lists.
Institutional Responsibilities
Partner schools must maintain credential hygiene, prevent staff from sharing logins, configure strict role privileges, and obtain guardian permissions. EduNixx is not liable for data exposures resulting from weak admin passwords or incorrect access permissions assigned by the school.
Data Accuracy Disclaimer
We rely on institutions for the accuracy of entered data and are not responsible for incorrect data entry, outdated records, or misclassification made by school administrators/staff.
Changes to This Policy
We may update this policy periodically. We will notify school administrators of any material changes via email or dashboard alert at least 15 days before they go into effect.
Jurisdiction
This policy and all platform data practices are governed strictly by the laws of the Republic of India. Any legal disputes are subject to the exclusive jurisdiction of the courts of Noida, Uttar Pradesh.
Contact
For questions or compliance requests, contact us at:
Email: privacy@edunixx.com
Address: EduNixx HQ India