Privacy Policy

1. Who we are and our role

Moksha EduSystems (“Moksha”, “we”, “us”) provides a school and hostel management platform: the website at mokshaedusystems.in and each school’s own address (for example yourschool.mokshaedusystems.in), and the Moksha Android app. This policy covers all of them.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”):

• Your school is the Data Fiduciary for student, parent, staff, hostel and transport data. The school decides the purposes, collects consent and answers for how the data is used.
• Moksha is the school’s Data Processor. We process that data only to provide the platform under our contract with the school, and for no purpose of our own.
• Moksha is the Data Fiduciary for a small set of data we use for ourselves: details of school administrators we contract with, our billing records, and the security logs we keep to protect the platform.

If your question is about why your school holds certain data, please contact your school first. We will help the school answer it, and you can always contact us directly (section 15).

2. Personal data we process

What is held depends on which modules your school uses. A school can only enter the fields it needs, and many fields are optional.

Students

• Name, admission number, roll number, class and section, date of birth, gender, photograph
• Attendance, timetable, homework, exam marks, report cards, syllabus progress
• Optional statutory details the school must report (for example to UDISE+ or CBSE): nationality, religion, caste or category, Aadhaar number
• Blood group, allergies, medical conditions and emergency contacts entered by the school
• Transport route and stop, and bus boarding records where the school uses transport
• Library borrowing records and any library fines, where the school uses the Library module

Parents and guardians

• Name, relationship to the student, mobile number, email address
• Whether the guardian may give consent for the student (for example hostel leave)
• Fee invoices, receipts and payment status (card and bank details stay with Razorpay; we never see or store them)
• People authorised to collect a hostel resident: name, relationship, phone, photograph, ID type and only the last 4 characters of the ID number

Teachers and staff

• Name, employee ID, contact details, role, department, qualifications, classes taught
• Lesson plans, marks entered, attendance taken
• Staff attendance, including the device location at check-in where the school uses campus check-in
• Where the school turns on selfie check-in: the selfie taken at each punch, which our server compares with the staff member’s reference photo to confirm who punched
• Payroll and statutory details where the school records them: bank account and IFSC, UAN, ESI number

Hostel residents (where the school uses the Hostel module)

• Room and bed, roll-call attendance (manual, QR code or RFID; biometric is switched off unless a school enables it)
• Leave requests and gate passes, with guardian approvals
• Visitor logs, and photographs taken at the gate or of visitors
• Health profile, sick bay visits, medicines given, vaccinations and referrals
• Mess menus, dietary needs and allergens
• Discipline incidents and counselling notes, visible only to authorised staff

Transport

• Bus routes, stops and assigned students
• The bus location, sent from the driver’s or attendant’s phone only while a trip is running
• Trip summaries and the alerts sent to parents

Everyone who signs in

• Login identifier (mobile number, admission number or email) and password, which is stored only as a one-way hash
• One-time passcodes for phone sign-in (sent and checked by Google Firebase)
• Session cookies, notification tokens for your device, and the school you chose in the app
• Security and audit records: sign-in attempts, IP address and browser or device details, and changes made to users and payments
• Crash reports from the app: the error, the app version and the device model, used only to find and fix faults

Some of this data is sensitive personal data under the SPDI Rules, 2011: passwords, financial details, and health and medical records. Section 6 explains the extra protection it gets.

3. Where the data comes from

• From the school: admission records, staff records and data its staff enter while running the school.
• From you: when you sign in, update your profile, pay fees, apply for hostel leave or approve a gate pass.
• From devices: the bus location sent by a driver’s phone during a trip, a staff member’s location at check-in, and RFID or QR scans at hostel roll calls.
• From payment partners: payment confirmations from Razorpay.

4. Why we use it and on what basis

We use personal data only for the purposes below, and only the data needed for each one.

We do not use personal data to train artificial intelligence models, for marketing by third parties, or for any purpose the school has not asked for. If a new purpose ever needs your consent, the school or we will ask for it first.

5. Children’s data

Under the DPDP Act, anyone under 18 is a child. Almost every student on the platform is a child, so we apply these rules:

• Verifiable parental consent. A school cannot create a student record without confirming that a parent or lawful guardian has given consent and has been shown this policy. The school keeps the consent the parent signed.
• Guardians of persons with disabilities. Where a student has a lawful guardian, consent comes from that guardian.
• No harmful processing. We do not process children’s data in any way likely to harm their well-being.
• No tracking for commercial purposes. We do not track or monitor children’s behaviour to profile them, and we never target advertising at them. The only monitoring is what a school needs for education and safety, which the DPDP Rules permit for educational institutions: attendance, hostel roll calls, gate passes, and bus location during trips. This information goes only to the school and the child’s own guardians.
• Student logins. Senior students (Classes 9–12) can sign in with their admission number to see their own timetable, homework and results. They cannot see other students’ data.
• Guardians stay in control. Parents can see their child’s records in the parent app and can ask the school to correct them, erase them or withdraw consent (section 14).

6. Health, Aadhaar and other sensitive data

Health information

• Hostel health records (health profile, sick bay visits, medicines, vaccinations, referrals) are visible only to staff with the hostel health permission, such as the nurse or warden, and to the student’s guardians.
• Medicines are given only with a guardian’s recorded consent, except in an emergency.
• In a medical emergency, authorised staff may use or share the information needed to protect the student’s life or health, for example with a doctor or hospital.
• Allergen and dietary information is shared with the mess team only as far as needed to serve safe food.

Aadhaar

• An Aadhaar number is optional. It is never required for admission or for any service on the platform.
• Where a school records it (for example for UDISE+ or APAAR), it is stored encrypted, and duplicate checks use a one-way keyed fingerprint rather than the number itself.
• Aadhaar numbers are never displayed in full, never used for sign-in or authentication, and never shared except where the law requires it.
• For people authorised to collect hostel residents, we store only the type of ID and its last 4 characters.

Religion, caste and category

These fields are optional. They exist only for statutory reporting and scholarship eligibility, and are never used to make decisions about a student.

Discipline and counselling records

These are visible only to the staff the school authorises. They are never shown to other students or parents.

Biometrics

Biometric attendance is switched off by default. If a school turns it on, the school must first get separate consent, and must give an alternative (QR, RFID or manual roll call) to anyone who declines. The same applies to staff selfie check-in: it is optional for each school, and the punch selfie is used only to confirm the staff member’s identity against their reference photo.

7. Location data

• School buses: the driver’s or attendant’s phone shares the bus location only while a trip is running. Parents see the bus their child travels on. We do not track students’ or parents’ phones.
• Staff check-in: where a school uses campus check-in, the app reads the device location once, at check-in, to confirm the staff member is on campus. It does not track staff throughout the day.
• Raw GPS points are deleted after 90 days. Only a summary of each trip is kept.

8. Cookies, app storage and notifications

• The website uses strictly necessary cookies only, to keep you signed in and protect your session. We use no advertising, analytics or third-party tracking cookies.
• Your browser stores small settings, such as display preferences. The Android app stores some data on your phone so it works offline. That data is removed when you uninstall the app or clear its storage.
• If you allow notifications, we store a notification token for your device so alerts reach you. You can turn notifications off in your phone or browser settings.

9. Who we share data with

We do not sell, rent or trade personal data. We share it only as follows.

Within your school

Each person sees only what their role needs. Teachers see their own classes, parents see their own children, coordinators see their assigned classes, and hostel and transport staff see only what their duties need. Each school’s data is kept in its own separate database area and cannot be read by other schools.

Service providers (sub-processors)

We use these providers to run the platform. Each may process data only on our instructions, for the service listed, and under confidentiality and security obligations.

Razorpay processes card and bank details under its own privacy policy and PCI-DSS obligations. Moksha never receives full card or bank login details.

Authorities

Your school may report data to education authorities such as CBSE, UDISE+ or the state education department as the law requires. We disclose data to courts, the police, CERT-In or other authorities only when the law requires it, and we tell the school unless the law forbids us to.

Business changes

If Moksha is merged or acquired, this policy and our contracts with schools continue to protect the data. We will tell schools before anything changes.

10. Where data is stored

The platform’s database, file storage and servers are in Singapore. Some providers process limited data elsewhere: Google Firebase handles phone numbers and notification tokens on its global network, and Resend sends emails from the USA (section 9).

The DPDP Act (s.16) allows personal data to be transferred outside India except to countries the Government of India restricts by notification. None of these locations is restricted. If the Government restricts any of them, or a sector rule requires data to stay in India, we will move the affected data. We will publish any change of region on this page in advance.

11. How long we keep data

We keep personal data only as long as the purpose needs it, or as long as the law requires, and then erase it.

12. How we protect data

We follow reasonable security practices under section 43A of the IT Act and Rule 8 of the SPDI Rules, and the safeguards the DPDP Rules require:

• Encryption in transit (HTTPS/TLS) and at rest, with extra column-level encryption for Aadhaar numbers.
• Passwords stored only as one-way hashes, and limits on repeated sign-in attempts.
• Every school’s data held separately, with row-level security in the database so that every request is checked against the user’s school and role.
• Role-based access for staff, need-to-know access for health and discipline records, and permission checks on every server action.
• Audit trails of changes to user accounts and payments.
• Security logs kept so that unauthorised access can be detected, investigated and fixed.
• Access to production systems limited to authorised Moksha personnel, who are bound by confidentiality.

No system is perfectly secure. If you notice anything suspicious, please tell us at once at grievance@mokshaedusystems.in.

13. Personal data breaches

If a breach affects personal data:

• We inform the affected school without delay, so it can meet its own duties as Data Fiduciary.
• We report cyber security incidents to CERT-In within 6 hours of noticing them, as the CERT-In Directions of 28 April 2022 require.
• Together with the school, we inform the Data Protection Board of India and the affected people as the DPDP Act and Rules require. That includes a detailed report to the Board within 72 hours of becoming aware of the breach.
• We tell affected people what happened, what it may mean for them, what we have done, what they can do to protect themselves, and whom to contact.

14. Your rights

Under the DPDP Act (sections 11 to 14) you have the right to:

• Access: get a summary of the personal data held about you (or your child), how it is used, and whom it has been shared with.
• Correction and erasure: have inaccurate or incomplete data corrected or updated, and have data erased when it is no longer needed. The only exception is data the law requires the school or us to keep.
• Withdraw consent: as easily as you gave it. Withdrawal does not affect processing that already happened. Some services may stop if they cannot run without the data.
• Grievance redressal: have your complaint answered by the school or by us (section 15).
• Nominate someone to exercise these rights for you if you die or become unable to do so.

How to ask: contact your school’s office, or email grievance@mokshaedusystems.in from your registered email or mention your registered mobile number. We may need to confirm who you are before acting. A parent makes requests for a child under 18. We will pass requests about school data to the school and help it respond.

Your duties: the DPDP Act also asks you to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.

15. Grievances and complaints

Please contact our Grievance Officer with any concern about your personal data. We acknowledge complaints within 7 days and resolve them within 30 days. If we need longer, we will tell you why. We will always respond within the time the law allows.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India once you have used this process. For general questions, email support@mokshaedusystems.in.

16. Users outside India

The platform is built for schools in India and governed by Indian law. We also follow the core principles of the EU General Data Protection Regulation: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. If you are in the EU or UK and use the platform through a school, the rights in section 14 are available to you, and you may also contact your local data protection authority.

17. Changes to this policy

We update this policy when the law, our providers or the platform change. The date and version at the top show the latest update. For important changes, such as a new purpose, a new provider or a new storage location, we tell schools in advance and show a notice in the app. Where the law requires it, we ask for fresh consent.