This policy explains what personal data Eduiey handles, why, who else receives it, how long it is kept, and how to use your rights. It covers the Eduiey apps, eduiey.com and institutions' public pages.
In short
- Your school, college or coaching centre (your institution) creates your account and decides what is recorded about you. It is responsible for those records, and Eduiey processes them on its behalf.
- We don't sell personal data. Eduiey has no ads, trackers or analytics tools, and we never profile or track children.
- A few providers help run Eduiey. Our database is in Singapore and the AI assistant works in the United States (sections 9 and 10).
- In the app you can see your records, correct some details, withdraw your consent, name a nominee, turn the AI assistant on or off, and ask for your account to be deleted (section 13).
- Questions or complaints: support@eduiey.com.
1. Who we are
Eduiey ("Eduiey", "we", "us") is an education software service run from Sector 27, Gurugram, Haryana 122002, India. When Eduiey is registered as a company, we will publish a new version of this policy naming that company and tell you in the app.
"Your institution" means the school, college, coaching centre or other organisation that gave you your account.
2. Two roles
India's Digital Personal Data Protection Act, 2023 (the "Act") uses two terms. A Data Fiduciary decides why and how personal data is processed and is responsible for it. A Data Processor processes it on a Data Fiduciary's behalf.
- Your institution's records (its people, classes, attendance, marks, fees, payroll, files, messages, notices, campus services, placements, and applications made on its public page) belong to your institution. It is their Data Fiduciary. Eduiey is its Data Processor and follows its instructions under our Data Processing Agreement.
- Eduiey is the Data Fiduciary for a small set of data it keeps for its own purposes (section 5).
So most requests about your records are decided by your institution (section 13).
3. How accounts are created
There is no public sign-up. Your institution creates your account, one at a time or by importing a spreadsheet, and decides what to record. The first time you sign in, you confirm your account with a one-time code and choose a password. If you didn't expect an account, contact your institution.
4. What we process for your institution, and why
What is held depends on the features your institution uses and what its staff record.
- Identity and contact: name, mobile number, email, date of birth, gender, address, photo, admission or employee number, role, and any extra details your institution asks for (which may include things like blood group). To identify you, give you an account and keep the institution's records.
- Sign-in: your password, stored only as a bcrypt hash that can't be read back, your sessions, and your IP address, used briefly to limit repeated sign-in attempts. To let you sign in safely.
- Academic: classes, timetables, attendance, marks, homework and work handed in, quiz answers, grades, report cards, transcripts and certificates. To teach, assess and report.
- Family: which parent or guardian is linked to which student, and their contact details. So parents see their own children's records.
- Fees: invoices, payments, concessions, receipts and payment references. To bill fees and issue receipts.
- Staff and payroll: staff attendance, salaries, deductions, payouts, and bank account or UPI ID. To run staff attendance and pay salaries.
- Communications: messages, announcements, circulars and acknowledgements, calendar entries and notifications. To communicate within the institution. If you report a message, your institution's administrators see it with your reason and decide whether to remove it; a removed message's words are erased from the conversation and kept only in the report. Whom you block is private to you.
- Campus services: library loans, hostel and meal records, and ID cards. To run those services.
- Placements: profiles, résumés, applications, interview outcomes and notes, and offers. To run placement drives.
- Admissions: enquiries and applications made on the institution's public page (answers, documents, application fees) and the consent box the applicant ticked. To handle admissions.
- Files people upload (documents, images, audio, video), for the purposes above.
- AI assistant chats: questions, attached files and answers (section 7).
- Audit trail: who changed what, sign-ins, and downloads of reports and documents, with IP address and device or browser. To keep Eduiey secure and show the institution who did what.
Your institution decides the lawful basis for its records, for example your consent (and a parent's for a child), employment for staff records, or a legal duty such as keeping fee records. Its own privacy notice, which you accept in the app, explains this.
5. What we process for ourselves, and why
Eduiey is the Data Fiduciary for:
- Consent records (section 6), to prove consent as the Act requires and to show you your choices.
- Demo and "list your organisation" requests made on eduiey.com: name, phone, email, country, city, organisation name and type, and your message. To reply to you.
- Feedback sent from the app: your name, phone, role, rating and message. To answer you and improve Eduiey.
- Platform administrators (the people who run Eduiey): their account details and actions. To run the platform securely.
- AI usage: how many questions each person asked and when, and totals by institution and role, never what was asked. To apply question limits and manage costs.
- Reports of AI answers: if you report an answer of the AI assistant, your question, the answer and your note. To check the assistant's safety and fix problems.
- The platform activity log: platform administrators' actions and platform sign-ins, with IP address and device. For security.
Our platform administrators can open a person's profile in any institution, only to give support or investigate a fault.
We rely on: your consent, given when you accept this policy; data you give us yourself for a purpose, such as a demo request (section 7(a) of the Act); employment, for our own administrators (section 7(i)); and our legal duties, such as proving consent and keeping security logs. We never sell personal data, use it for advertising, or use it to train AI models.
6. Consent, and withdrawing it
Before you use Eduiey, the app asks you to read and accept this policy and our Terms of Service. Members of an institution also accept its own privacy notice. You are asked again when a version is published that everyone must accept. For small corrections you are simply told.
Each acceptance is written to an append-only consent log, enforced by the database. It records who you are, which version of each document you accepted (with a SHA-256 fingerprint of its exact words), the language shown, the time, your IP address, your device or browser, and the app and its version. The log also records parents' approvals, consents your institution records, withdrawals, nominee changes and erasures. You can see your records, and download each as a PDF, in Profile → Privacy → Consent history.
You can withdraw your consent at any time in Profile → Privacy → Withdraw my consent. You are signed out on every device and can't use Eduiey until you accept again. Your institution is told, so it can decide what it must keep (records the law requires) and what to erase. Withdrawal doesn't affect what was done before it, and doesn't by itself delete your records.
7. The AI assistant
If your institution's plan includes it, the Eduiey AI assistant acts as you. It can read only what you could open yourself, and asks you to confirm before it changes anything. To answer, it sends Anthropic, in the United States, your question and the conversation so far, any files you attach, your first name, role and institution, and the records it reads for you. Under Anthropic's commercial terms this data isn't used to train its models.
Before your first question, the app asks your permission, naming Anthropic and what is sent. Until you allow it, the assistant doesn't work and nothing is sent. You can turn it off, or on again, in Profile → Privacy, and each choice is recorded with your consent records. If an answer is offensive, harmful or wrong, you can report it in the chat (section 5).
Only you can see your chats in the app. Deleting a chat hides it. Its content is deleted when your details are erased or your institution's data is deleted. Files attached to chats are deleted after 7 days. The assistant can be wrong, so check anything important.
8. Children
Eduiey treats a student as a child if their date of birth shows they are under 18, or if no date of birth is recorded, unless the institution has declared that all its students are 18 or older.
- A child's account needs a parent's or guardian's consent. A linked parent approves it in their own Eduiey app after signing in, or the institution records that it holds the parent's consent (for example a signed form), with how and when it was given.
- Until then, the child can use Eduiey for a grace period (normally 30 days) and is then locked out.
- A parent can withdraw consent for their child in Profile → Privacy. The child is signed out and locked out, and the institution is told.
- A parent can use the child's rights on the child's behalf.
- We never track children, monitor their behaviour, profile them or target them with ads. Records such as attendance and marks are kept by the institution for its educational work.
9. Who else receives data
These providers help us run Eduiey and receive data only for that:
- Railway: hosts the application, database, cache and server logs, in Singapore.
- Cloudflare: domain names, and storage of uploaded files (R2).
- Vercel: delivers the web app, and sees your IP address and browser.
- Google: fonts and web-app files (sees your IP address and browser), and our email (Google Workspace).
- Anthropic, United States: the AI assistant (section 7).
Others involved, not engaged by us:
- Your institution's own payment provider (Razorpay in India, Stripe elsewhere), when you pay online. It receives the amount, a description (for an application fee, the applicant's name), and what you enter on its page. The money goes to the institution, not to us.
- Your institution's own RazorpayX account, when it pays salaries. It receives the staff member's name, bank account or UPI ID, the amount and an internal person ID.
- Your phone's or browser's speech recognition (for example Google on Android or Apple on iPhone), if you speak to the AI assistant. It may process the audio on its own servers under its own terms. We receive only the text.
- Google Maps, YouTube (privacy-enhanced mode) and Vimeo, if an institution adds a map or video to its public page. They see visitors' IP addresses and may set their own cookies.
- Authorities, only when the law requires. Where allowed, we tell the institution first.
Reports and files an institution's staff download are then in its hands. We will add any new provider to this list before it receives personal data.
10. Data outside India
Our database is in Singapore. Uploaded files are stored by Cloudflare in a region it selects, which may be outside India. The AI assistant's processing happens in the United States. The Act allows this except for countries the Government of India restricts. If a country we use is restricted, we will move or stop that processing.
11. How long we keep data
- Institution records, including messages, files and AI chats: while the institution uses Eduiey, unless deleted or erased sooner.
- Files attached to AI chats: deleted automatically after 7 days.
- Working copies from spreadsheet imports: deleted automatically after 30 days.
- AI question counts: deleted automatically after 35 days.
- The audit trail: at least one year, and while the institution uses Eduiey.
- Consent records: as long as needed to prove consent. They are kept after an erasure and after an institution leaves.
- Demo requests and feedback: deleted by our team within 12 months after we close them.
- Reports of AI answers: deleted by our team within 12 months after they are reviewed.
- Platform administrators' accounts: while they help run Eduiey.
- When an institution stops using Eduiey: it may ask for a copy of its data within 30 days after the end, and we provide it within 30 days of the request. We delete its data within 60 days after the end, and backup copies within 90 days, except consent records, the audit trail (kept for one year after the end) and anything the law requires us to keep. Our team does this by hand, not automatically.
Our host also keeps short-term technical server logs.
12. Security
- All traffic is encrypted in transit (HTTPS).
- Passwords are stored only as bcrypt hashes.
- Bank account numbers, UPI IDs and payment-gateway keys are encrypted and shown only masked.
- Every request is checked against the signed-in account's institution, so each institution's data stays separate.
- Roles decide who can open each page. Students and parents see only their own or their child's records, and the AI assistant follows the same rules.
- Sign-in attempts are limited, accounts lock after repeated failures, and sessions can be ended.
- The audit trail and the consent log are append-only, enforced by the database.
- Uploaded files are private and served only to people allowed to see them.
- Photos are re-encoded to remove location data.
No system is completely secure, and we don't claim Eduiey is. Tell us at once if you think an account was misused.
13. Your rights, and how to use them
Your institution answers for its records and we answer for ours (section 5). We may need to check your identity first: tell us the mobile number or email you sign in with, and your institution. We answer requests about our own data within 30 days.
- See your data: Profile → My details, your "My …" pages, and your consent records in Profile → Privacy. For a full summary or a copy, ask your institution, or ask us about our own data. There is no "download all my data" button yet; copies are prepared by hand.
- Correct it: change the details your institution allows in Profile → My details. Your institution corrects the rest, such as your name, phone and email. For our own data, ask us.
- Erase it: in the app, Profile → Privacy → Delete my account, confirmed with your password. You are signed out at once and can't sign in to that account while your institution erases your personal details, or, if it must keep the account, tells you why. An institution administrator's own request comes to us. You can also ask your institution directly. When your details are erased, your name (then shown as "Erased person"), phone, email, date of birth, gender, address, photo, ID number, role details and password are wiped, your sessions and parent links end, and your AI chats and notifications are deleted. Records of the institution's history, such as attendance, marks, fees, receipts, placement records, certificates already issued, messages you sent and work you handed in, stay attached to the erased record, because the institution may need, or be required by law, to keep them. The consent log keeps your consents and the erasure as proof, and audit-trail entries made before the erasure stay. See eduiey.com/delete-account.
- Withdraw consent: Profile → Privacy (section 6).
- Name a nominee: in Profile → Privacy, name someone (name, relation, phone or email) to use your rights if you die or become unable to. Your institution can see who it is.
- Complain: write to our Grievance Officer (section 16). We acknowledge within 24 hours, and resolve within 15 days where the IT Rules apply and in any case within 30 days. If you write to us about your institution's records, we pass it to the institution within 5 working days and tell you. If you're not satisfied with the answer, you may complain to the Data Protection Board of India.
Eduiey doesn't yet record who viewed a record, so we can't tell you who has looked at yours. The Act also asks you to give true information, not to impersonate anyone, and not to make false or frivolous complaints.
14. Breaches
If a personal data breach affects your institution's records, we tell the institution within 24 hours of becoming aware of it and help it inform the Data Protection Board of India and you. If it affects data we hold for ourselves, we inform the Board and you ourselves, as the law requires. We tell you through a notice in the Eduiey app. We can't yet send email or SMS, so you will see it when you next sign in; your institution may also contact you directly.
15. On your device, languages and changes
The app keeps your sign-in session in your device's secure storage (on the web, in your browser) and a few preferences, such as your country code. Eduiey sets no cookies. Signing out ends your session.
This policy may also be shown in Hindi and Bengali. If a translation and the English version differ, the English version prevails.
Each version of this policy has a number and a date, and earlier versions are listed at eduiey.com/privacy. When a change matters, everyone is asked to accept the new version. For a small correction you are told, and your earlier acceptance stands.
16. Contact and Grievance Officer
Anirban De, Grievance Officer, Eduiey: support@eduiey.com, +91-9383169659, Sector 27, Gurugram, Haryana 122002, India.