Privacy policy

The school is the controller of its pupil, parent and staff records. It decides what to record and why, and it is the school you ask to see, correct or erase a record.

EduOrbiq is the processor. We hold and process that data on the school's instructions in order to run the service, and we do not use it for our own purposes — we do not sell it, rent it, or use it to train anything.

• Pupils — name, date of birth, class, admission number, guardian details, attendance, marks, fee account, transport stop, library loans, and documents the school uploads.
• Parents and guardians — name, relationship to the pupil, phone number, email address, and the postal address the school holds.
• Staff — name, contact details, employment and payroll records the school keeps, attendance, and sign-in credentials.
• Payments — the amount, date, mode and reference of a fee payment. Card and bank details are never held by us; an online payment is taken by the payment gateway and we record only its result.
• Use of the service — sign-in times and device, and an error log, kept so an account can be secured and a fault diagnosed.

Almost all of it comes from the school. A parent gives their details to the school on the admission form, or through an application form the school publishes, and the school enters them into its record. We collect nothing about a pupil or a parent directly, and nothing from any third party.

Messages from this platform go only to the parents and guardians of pupils enrolled at a school that uses it, and to that school's staff. They are transactional: fee receipts and reminders, absence notices, examination results, portal credentials and school notices. There is no marketing mail and the product has no facility to send any.

Each school sends under its own verified address. A school that has not verified one sends nothing — the message is recorded as skipped rather than delivered from some shared address on its behalf.

To stop receiving messages, ask the school: it holds the record and can remove or suppress the address. An address that hard-bounces is suppressed automatically and is never written to again; a spam complaint suppresses the address for the school complained about. If a school does not act, write to eduorbiqtech@gmail.com and we will suppress it ourselves.

We use these providers to run the service, and no others:

• Supabase — the database and sign-in, hosted in Mumbai, India.
• Amazon Web Services — email delivery through Amazon SES, in the Mumbai (ap-south-1) region.
• Vercel — application hosting, served from the Mumbai region.
• Razorpay — online fee payments, where a school has enabled them.
• An SMS gateway — where a school has enabled SMS. The school's own sender ID is used.

Each receives only what it needs to do its part. We disclose data to nobody else, except where the law requires it.

In India. The database, the application and the mail account are all in the Mumbai region, and data is not moved out of the country in the ordinary running of the service.

• Every school is a separate tenant. Separation is enforced in the database itself, by row-level security on the tables, rather than by what a screen chooses to show.
• Traffic is encrypted in transit, and the database is encrypted at rest.
• What a member of staff can open is governed by per-page permissions the school sets. A parent sees only their own children.
• Passwords are stored hashed and are not readable by us or by the school.

For as long as the school keeps it, and for as long as its agreement with us runs. Schools are required to hold pupil records for years after a pupil leaves, and that decision is the school's. When a school leaves the platform its data is deleted or returned on its instruction.

You may ask to see the data held about you or your child, to have it corrected, or to have it erased where the school is not required to keep it. Ask the school first — it holds the record and can act immediately. If you cannot reach them, write to eduorbiqtech@gmail.com and we will pass the request to the school and help them answer it.

The records are largely about children, and they are held on the instruction of the school the child is enrolled at. A pupil's own portal login shows only that pupil's record. We do not profile children, advertise to them, or use their data for any purpose beyond running the school's administration.

If this policy changes, the date at the top changes with it and schools are told. Material changes are notified before they take effect.

EduOrbiq — eduorbiqtech@gmail.com. See also the terms of service.