Privacy

Who we are

Nextyug School is operated by Nextyug Technologies Private Limited, CIN U62013PN2025PTC238635, a company incorporated in India with its place of business in Pune, Maharashtra.

Who decides what happens to the data

For the staff who sign in we are the data fiduciary. For students, their guardians and the rest of the school’s records, the school is the fiduciary and we are its processor: the school decides what to record about a child and why, and we hold it on the school’s instruction. A parent asking about their child’s record should ask the school, which is the custodian of it.

What we collect

About the school. The school name, its address, and its affiliation or registration number where you provide them, and the name, mobile number and email of the person setting it up. We ask for what the product needs to run and nothing more.

About students. What the school records: the child and their class, roll and admission numbers, attendance, marks, fees, library loans, and a guardian to contact. For a child who uses school transport, the route and the stop they get on at, which says roughly where the family lives; only the people who run transport see it. Some of it is collected only because a state return asks for it. A photograph of the child, if the school adds one; it and the school's other photos and documents are kept as files only the school's staff can open, and location and camera details are removed from every photo when it is uploaded.

About applicants. When a family applies, the school records the child and one parent or guardian: name, date of birth, contact details, the previous school, and the papers the family hands in, such as a birth certificate, a transfer certificate, a photograph and proof of address. Each paper is kept as a file only the school's staff can open, and every opening is logged. When the child is admitted, the application becomes the student's record.

Billing details. The legal name, GSTIN and address the school gives for its invoices, and a copy of them on each invoice.

About staff. The employment record the school keeps: name, contact details, qualifications and past jobs, designation, department and their history, joining date, reviews, and the papers handed in, such as an appointment letter. Optional fields a staff return or a nomination form asks for, such as marital status, a spouse's name, category and the last four digits of Aadhaar, are collected only if given. Pay details, the PAN and the bank account are seen only by people the school allows to see payroll; the account number is stored encrypted and shown only as its last four digits. For the school's drivers, the date of birth, mobile number, driving licence number and a reference the school can call, seen only by the people who run transport.

Forms the school asks you to fill. When the school asks a family or a member of staff to fill a form, such as a trip consent or a survey, it keeps the answers and any file sent with them. Each form states why it is asking and how long the answers are kept, and the answers are used for that alone. Only the people who run the school's forms can read them, and deleting the form erases them.

Signing in from the app. A parent or guardian, or a member of staff, signs in to the Edmingo app with the mobile number the school recorded for them. We keep that number on their user, the codes we text to it (only a scrambled copy, for thirty days), and for each phone they sign in on a random identifier the app makes for itself, the sessions that phone holds, and, once they allow notifications, the push address that reaches it, with the phone's platform and app version. We also keep the notifications the app has shown them for ninety days, which kinds they switched off, and which they have opened. The first time a guardian signs in, the app shows this notice and keeps a note that it was shown. A student never has an account in the app, and no code is ever sent to a student.

Chats. What staff and guardians write to one another in the product: the message, who wrote it, when, and how far each person has read. A message can be taken back by the person who wrote it, which empties it for everybody.

What we deliberately do not collect

No advertising, ever. We do not show advertising to students, parents or staff, and there is no advertising or behavioural tracker anywhere in the product. A child is never profiled, tracked or targeted.

Nothing sold, nothing trained on. We do not sell your data, we do not share student information with marketing partners, and we do not use your school’s data to train AI models.

Not a full Aadhaar. The product does not write a student’s or a guardian’s Aadhaar number, and the field is not asked for on any form.

Why we collect it, and on what basis

Running the school. Admission and the roll, attendance, marks, fees, timetable and staff records. These are legitimate uses under the Act, because a school cannot teach a child it has no record of.

Reaching a guardian. To contact a guardian about their own child — attendance, a fee reminder, a result, or something urgent. Safety and attendance are why a school must be able to call a parent.

Letting a person into a school. Somebody who asks to join a school gives their name, mobile, the role they hold, and, for a parent, the child's name and their relation to the child. The school uses it only to check that the person is who they say, and that a parent really is the child's guardian, before letting them in. Nothing else about the child is asked.

Statutory returns. Some fields exist only because a state or central return asks for them. Where that is the reason, it is the only reason they are used.

Where a purpose rests on your consent rather than on running the service you asked for, you may withdraw it at any time, and withdrawing is no harder than giving it was. Withdrawing consent does not undo what was lawfully done before.

Who else sees it

Ola Maps. Finds an address on the map when the school types one for itself, a student or an applicant. Our server asks Ola Maps, an Indian mapping service, with the words typed into the search box or the point dropped on the map. It never receives the child's name or anything else on the record.

Nextyug Report. Draws report cards as PDFs when the school generates them. For each card it reads, once and for a few minutes, what the card shows: the student's name, class, roll and admission number, date of birth, guardian, marks, grades and attendance, and the school's letterhead. It runs in the same data centre in Pune under Nextyug Technologies, keeps no copy of the card or its data, and records only that a card was made.

Razorpay. Takes fee payments where the school has enabled it. Card details are entered with Razorpay and never reach our servers. A school pays our plan through Razorpay too, on our account; we keep its payment reference and issue the GST invoice ourselves.

An SMS operator and an email provider. To deliver a message the school sends to a guardian, and to deliver sign-in codes to staff.

Expo, Apple and Google. Deliver the app's notifications to a phone: Expo passes each one to Apple for an iPhone or Google for an Android phone. They receive the phone's push address and the notification's title and one line, which never carry a child's name, a mark, an amount or a message's text.

Meta / WhatsApp. Only where the school connected a WhatsApp number, and only what is needed to deliver the message.

Nextyug Relay, Drive, Report and Agent. Our own products, run in the same place, and every school has them. Relay reads each parent or guardian's name, phone and email from this database when it needs them, and keeps no copy. Nothing about a student is shared.

Nobody else receives your data. We do not sell it, we do not build advertising profiles from it, and we do not train anything on it.

Whether it leaves India

The application and its database run in our own data centre in Pune, India. WhatsApp messages are delivered through Meta, which operates outside India, so a message a school sends that way leaves the country as part of being delivered. We will confirm the backup retention window for your school in writing on request. The app's notifications are delivered through Expo, Apple and Google, which operate outside India, so a notification's title and line leave the country as part of being delivered.

How long we keep it

While the school is with us. Records are kept for as long as the account is active, because they are the school’s register rather than ours to expire.

A frozen plan. When a plan lapses the school freezes and nothing is deleted. Its data is kept until the customer asks us to erase it.

After an account closes. We keep it for 90 days so it can be restored if the closure was a mistake, then delete it.

Sign-in codes and app sessions. A code texted to sign in to the app is deleted thirty days after it was sent. A session in the app lasts ninety days from the last time it was used, ends at once when you sign out, and is deleted thirty days after it ends.

App notifications. A notification shown in the app is kept for ninety days and then deleted.

Financial records. Invoices and payments are kept for as long as Indian tax law requires, and are then deleted. They are kept for that purpose only.

Attendance registers. [YOUR POLICY — how many years a class's daily attendance, and staff attendance, is kept. State rules usually require the register for several years; the number is the school's to supply.]

Chats. [YOUR POLICY — how long a chat between staff, or between staff and a guardian, is kept after its last message.]

A join request the school turned down. [YOUR POLICY — how long a rejected request to join a school, with the child's name it carries, is kept before it is erased.]

An application that did not lead to admission. [YOUR POLICY — how long a rejected or withdrawn application, and the documents uploaded with it, is kept before it is erased.]

A member of staff who has left. [YOUR POLICY — PF, ESIC and income-tax rules require pay and employment records to be kept for years after someone leaves. Say here how long, and what happens at the end of it.]

A student who has left. [YOUR POLICY — a school has its own statutory retention period for a leaver’s record and for a transfer certificate. Say here what it is, and what happens at the end of it.]

A file in the media trash. [YOUR POLICY – how long a photo or document moved to the trash is kept before it is purged. Until then a photo in the trash still shows where it is used; purging erases the file itself.]

What deletion actually removes

How to ask. Email us from an address on your school’s account. We confirm receipt within 2 working days and may ask you to verify that the request is genuine — a request to erase a school’s records deserves that check.

What happens then. Once verified we delete the school’s records and its uploaded files. Backups roll off on their own cycle within 30 days. We tell you when it is done, and it is permanent, so export anything you want to keep first.

Removing one person. A parent or staff member who wants their personal data removed should ask the school first, since the school is the custodian of its records and can usually do it from the app immediately.

Erasing a child's record. When a family asks, the school can erase a child who has left, or whose record is in the trash. Their name, birth date, address, family and contact details, health notes, guardian links, photograph, admission papers and messages are removed for good. Attendance, marks and fee receipts stay under the child's school ID alone, because the school must keep its register and tax law requires the receipts.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask for a copy of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, and nominate another person to exercise these rights on your behalf if you die or become unable to.

Write to [email protected], marked for the attention of the Grievance Officer. We answer within 30 days, and never later than the 90 the Act allows.

If we do not answer, or the answer does not satisfy you, you may complain to the Data Protection Board of India. Nothing here removes that right or requires you to come to us first.

Children

Almost every record here is a child’s, and the Act treats anyone under eighteen as a child. That governs the whole product: no tracking, no behavioural monitoring, no profiling, and no advertising of any kind, to anybody. A student’s data is entered and managed by authorised school staff, never by students themselves, and we do not knowingly collect personal information directly from a child. The verifiable consent of a parent or guardian, where the Act requires it, is held by the school as the fiduciary for that child. A guardian who wants a record seen, corrected or erased should ask the school first, because the school can usually do it immediately; if the school cannot help, write to us and we will work with the school.

If something goes wrong

If we become aware of a breach affecting you we will tell you, and the Data Protection Board, without delay, and follow with a full report within 72 hours.

Changes to this notice

This notice is versioned, and the version in force is shown at the top. A material change is announced 30 days before it takes effect, and earlier versions are available on request.

Contact

Grievance Officer, Nextyug Technologies Private Limited, Pune, Maharashtra, India. [email protected].