# Privacy policy Source: https://scoolin.com/legal/privacy > What personal data Scoolin handles, why, who it goes to, how long it is kept, and your rights under the Digital Personal Data Protection Act, 2023. Legal centre Policies for schools, staff and parents [Terms](https://scoolin.com/legal/terms) [Privacy](https://scoolin.com/legal/privacy) [Refunds](https://scoolin.com/legal/refunds) [Data protection](https://scoolin.com/legal/data-protection) [Cookies](https://scoolin.com/legal/cookies) Section 1 of 16 · Who we are [Home](https://scoolin.com/) Privacy policy ## Privacy policy What personal data Scoolin handles, why, who it goes to, how long it is kept, and your rights under the Digital Personal Data Protection Act, 2023. Last updated **19 Oct 2026** ## Section 1 Who we are Scoolin is school software run by **HeySERP Marketing Services**, Plot No. 17, S/F, Sector 7 Dwarka, New Delhi, India (“we”, “us”). This policy covers our website, the Scoolin service, and the free tools on our website. For any question about your data, write to our grievance officer (section 15) or use the [contact page](https://scoolin.com/contact-us) . ## Section 2 Our two roles Under the Digital Personal Data Protection Act, 2023 (the **DPDP Act**) we have two roles: - **For the records a school keeps in Scoolin** (students, parents, staff, visitors), the **school** is the Data Fiduciary and decides what is kept and why. We are its **Data Processor** and handle the data only to run Scoolin for it, under our [data protection terms](https://scoolin.com/legal/data-protection) . If you are a student, parent or staff member, your school is the place to start for questions about your records. - **For the data we collect for ourselves** (website visitors, people who contact us or book a demo, the people who sign a school up, and billing contacts), **we** are the Data Fiduciary. ## Section 3 What we collect ourselves - **When you contact us or book a demo:** your name, email, phone number if you give it, your school, and your message. Demo bookings are made through Cal.com. - **When you sign a school up:** your name, email, mobile number if asked, the school’s name, city, country, kind, size and board, the web address you pick, and the people you invite. - **When you use Scoolin:** your account details, your role, your sign-in methods (such as a Google account or passkey), your sessions and the device and browser each is from, and your settings. - **When a school pays:** the billing contact’s name and email, the plan, and payment status from our payment provider. We never see or store card or bank details. - **Technical data:** basic request logs needed to run and secure the service, and the cookies and browser storage in our [cookie policy](https://scoolin.com/legal/cookies) . We don’t use advertising trackers. - **Visits to our public website:** Statsy counts them for us: the page, the page you came from, screen size, language, time zone, and the country it works out from your IP address. It sets no cookies, and it never runs inside Scoolin or on a school’s pages. - **Our free tools** (such as the TC maker and ID card maker): what you type stays in your own browser. We don’t receive it. ## Section 4 What schools keep in Scoolin A school decides what to keep. Depending on the school, its Scoolin account may hold: - **Students:** name, admission and roll number, date of birth, gender, class and section, photo, address, contact details, guardians, siblings, previous school, nationality, mother tongue, category and religion, attendance and the times they were scanned at the gate, fees and receipts, marks and results, behaviour notes, leave, library loans, certificates and ID cards, and fields the school adds. - **Students’ health details**, if the school records them: blood group, height and weight, allergies, conditions, medicines and doctor’s details, and disability (CWSN) details. - **Government and scheme details**, if the school records them: Aadhaar, APAAR (with the recorded consent), PEN, state ID, passport or visa numbers, and RTE or BPL status. - **Parents and guardians:** name, relationship, phone, email and occupation. - **Staff:** name, contact details, employee code, role, department, type of employment, joining date, status, photo, attendance and leave. - **Visitors:** name, mobile, purpose, whom they came to meet, vehicle number, the last four digits of an ID card (never the full number), and their times in and out. - **Admission enquiries:** the parent’s and child’s names, phone, email, the class wanted, and notes. ## Section 5 How we use it - To run Scoolin for schools, as each school instructs: keeping records, working out fees, printing documents, and sending the emails the school sets up. - To create and secure accounts: sign-in codes and links, stopping misuse, and keeping one school’s data apart from another’s. - To answer questions, give support, and run demos. - To bill schools that are on a paid plan. - To fix problems and improve Scoolin. - To meet our legal duties, and to protect our rights and the safety of users. Where we are the Data Fiduciary, we use your data on the basis of your consent, or for a legitimate use the DPDP Act allows, such as a service you asked for or a legal duty. ## Section 6 What we never do - We don’t sell personal data. - We don’t show ads, and we don’t use personal data for advertising or to build profiles. - We don’t use school data to train artificial intelligence models. - We don’t contact students, track them, or monitor their behaviour for ourselves. Any tracking a school does, such as attendance and gate scans, is for the school’s own educational and safety purposes. ## Section 7 Public check pages Some documents carry a QR code so that anyone can check they are genuine. Scanning one opens a public page, with no sign-in, that shows: - **For a student or staff ID card:** whether it is valid, lost, expired or the holder has left; the school’s name and logo; the holder’s name, class or role, and **photo**; the card number; and the session it is valid for. - **For a certificate:** whether it is valid or cancelled; the school’s name and logo; the kind of certificate and its number; the holder’s name and class or role at issue; and the dates of issue and cancellation. These pages never show phone numbers, addresses or dates of birth. The school decides whether to print these QR codes. ## Section 8 Who we share it with We share personal data only with: - **Our service providers**, each only for its job: hosting, email delivery (Emailit), payments (Lemon Squeezy, for school subscriptions), Google (sign-in, book look-ups and the public holiday list), Open Library, Cloudflare Turnstile, Gravatar, error reporting, and visit counts on our public website (Statsy). The full list for school data, and what each receives, is in our [data protection terms](https://scoolin.com/legal/data-protection#providers) . Emailit also sends our own marketing emails, only to people who agreed to them. - **The school**, for the records it keeps in Scoolin, and its users, as its roles allow. - **Authorities**, when the law, a court or a government order requires it. - **A buyer or successor**, if our business is merged or sold, under the same protections. ## Section 9 Where it’s kept Scoolin is hosted with **Vultr (Delhi, India)**. Some service providers may handle limited data outside India, only for their job. We don’t transfer personal data to any country the Government of India restricts under the DPDP Act. ## Section 10 How long we keep it - **School records:** while the school’s account is open, until the school deletes them. When a school closes its account, its data is deleted permanently after a 30-day grace period. - **Your account:** while it is in use. If you ask to delete it, it is deleted after a 30-day grace period. A school can keep its own staff record about you. - **Enquiries and demo requests:** as long as needed to answer them and follow up, and no longer than 2 years after our last contact. - **Billing records:** for as long as tax and company law require. - **Logs:** for the periods Indian law requires, then deleted. ## Section 11 How we protect it We take reasonable security safeguards: every school’s data is kept separate, access depends on each person’s role, everything travels over HTTPS, identity numbers such as Aadhaar are stored encrypted and shown masked, passwords and sign-in codes are stored only as hashes, and repeated failed logins are locked out. The [data protection terms](https://scoolin.com/legal/data-protection#security) give the details. No system is perfectly secure, but if a breach happens we will act as the law requires. ## Section 12 Your rights Under the DPDP Act, you have the right to: - get a summary of your personal data and how it is used; - have it corrected, completed or updated; - have it erased, where it is no longer needed or you withdraw consent; - withdraw consent you gave, as easily as you gave it (this doesn’t affect what was done before); - nominate someone to use these rights for you if you die or can’t act; and - have your grievances answered. **Students, parents and staff:** please ask your school first. The school controls your records and can see, correct and delete them in Scoolin. If you write to us about school records, we will pass your request to the school. **For data we hold for ourselves:** write to our grievance officer (section 15). We may need to confirm who you are first. ## Section 13 Children Students don’t have Scoolin accounts. Their records are added by their school, which is responsible for getting a parent’s or guardian’s consent where the law requires it. We don’t knowingly collect data directly from anyone under 18; if we learn that we have, we delete it. ## Section 14 Emails we send - **To users:** sign-in codes and links, security alerts, and messages about the school’s account and billing. These are needed to run the service. - **To parents, on the school’s behalf:** the emails the school switches on, such as fee reminders, gate alerts and behaviour notes. They are sent in the school’s name; ask the school to change or stop them. - **Marketing:** only if you agreed to it, with a way to stop in every email. ## Section 15 Grievances and complaints Our grievance officer is **Sunny Kumar**, **hey@scoolin.com**, +91-9258583838, HeySERP Marketing Services, Plot No. 17, S/F, Sector 7 Dwarka, New Delhi, India. We acknowledge a grievance within **3 working days** and aim to resolve it within **30 days**. If you aren’t satisfied with our answer, you can complain to the Data Protection Board of India. ## Section 16 Changes to this policy We may update this policy. For a material change, we will email school owners and account holders before it takes effect. The date at the top shows when it last changed. **Questions about this page?** Write to us from the [contact page](https://scoolin.com/contact-us) and we’ll answer in plain words. Contents - [Who we are] - [Our two roles] - [What we collect ourselves] - [What schools keep in Scoolin] - [How we use it] - [What we never do] - [Public check pages] - [Who we share it with] - [Where it’s kept] - [How long we keep it] - [How we protect it] - [Your rights] - [Children] - [Emails we send] - [Grievances and complaints] - [Changes to this policy] Last updated 19 Oct 2026