Privacy Policy

This Privacy Policy explains how Zerox Studios (“EduSphere”, “we”, “us”) handles personal data when schools, teachers and parents use the EduSphere school management platform and visit our website. It should be read together with our Terms & Conditions and our Student & Children’s Data notice.

We have tried to write this in plain language. If anything is unclear, contact us using the details at the end.

For information in a school’s workspace — student records, attendance, marks, messages and similar content — the School decides why and how the data is used. The School is the “data fiduciary” (or “controller”) and we are its “data processor”: we process that data only to provide the Service on the School’s instructions.

For information we collect for our own purposes — such as enquiries from people who contact us about EduSphere, website usage, billing and security — we are the data fiduciary (controller).

If you are a Parent or staff member and want to exercise rights over information in a school’s workspace, please contact the School first; we will help the School respond.

Depending on your role, information in the Service may include:

• Account information: name, email address, phone number, role, school, and a hashed password;
• Student information: name, admission and roll number, class, gender, date of birth, blood group, address and links to parents or guardians;
• Staff information: employee number, qualification, date of joining, subject and class assignments, position and permissions;
• School activity records: attendance, homework and completion, class diary, discussed portions, timetables, substitutions, exams and marks, report cards, leave requests, meeting bookings and announcements;
• Communications: private messages between users, notifications and read status;
• Audit and security information: sign-in times, actions such as approvals and result publishing, and the IP address and browser details present in standard server logs;
• Enquiry information: details you send us when you request a demo or support (for example your name, school, email, phone and message).

We do not intentionally collect government identifiers, financial account details or biometric data in the Service. Please do not enter them. If your school wishes to record any sensitive category of information, it must have a lawful basis and tell us first.

Most information is entered by the School and its Teachers, or by Parents (for example leave requests and messages). Some is generated by the Service (for example attendance percentages, ranks and audit records). Some comes from you when you contact us or use our website.

We use personal data only for purposes that are necessary to run and improve the Service, namely to:

• create and manage accounts and authenticate users;
• provide school functions such as attendance, homework, exams, leave, messaging and notifications;
• show each user only the information their role allows;
• send service notifications (in the application) about approvals, results, messages and similar events;
• keep the Service secure, prevent misuse and investigate incidents;
• provide support, diagnose problems and improve reliability and usability;
• comply with legal obligations and enforce our Terms;
• respond to enquiries and, with your agreement, arrange demonstrations.

We do not use Student or Parent data for advertising, we do not sell personal data, and we do not use it to make automated decisions that have legal effects on individuals.

Under applicable data-protection law, personal data may be processed with the consent of the person concerned or for certain legitimate uses permitted by law. For workspace data, the School is responsible for establishing the lawful basis, which for schools will usually be the consent of Parents or guardians for children’s data and the performance of the School’s functions and legal duties. We process that data on the School’s instructions.

For our own processing, we rely on your consent (for example when you send us an enquiry), on performing our agreement with the School, on our legitimate interests in securing and improving the Service, and on legal obligations. Where we rely on consent you may withdraw it at any time; withdrawal does not affect processing already done.

We do not sell personal data. We share it only as follows:

• Within the School: information is visible to users according to their role. Principals see their whole school; teachers see their classes and subjects; parents see their own children;
• Our service providers: infrastructure partners that host the application and database and deliver content, who may process data only to provide those services to us;
• Professional advisers: lawyers, auditors and insurers, under confidentiality obligations, where needed;
• Authorities and legal process: where we are required by law, court order or a lawful request from a competent authority, or to protect rights, safety and security;
• Business transfers: if the business is reorganised, merged or sold, personal data may transfer to the successor, who must honour this Policy.

We require service providers to protect data with appropriate safeguards and to use it only for our instructions.

The Service is hosted on managed cloud infrastructure and a managed PostgreSQL database. Depending on the provider’s configuration, data may be stored and processed in data centres outside the country in which you live, including outside India. Where we transfer personal data internationally we rely on the safeguards permitted by applicable law, such as contractual commitments from providers, and do not transfer to any country that the Indian Government has notified as restricted.

We keep School Data for as long as the School’s account is active so that the School retains its historical records (for example, a student’s attendance and results across years). When the School ends the agreement, we delete or anonymise School Data within a reasonable period, normally within 90 days of a written request or termination, unless the law requires longer retention.

Backups containing deleted data are overwritten in the ordinary backup cycle. Audit and security logs are kept for a limited period needed to investigate misuse and meet legal obligations. Enquiry details are kept for as long as needed to respond and for a reasonable period afterwards.

When a student leaves a School, the School decides whether to mark the record inactive or delete it, subject to its legal record-keeping duties.

Subject to applicable law, you may have the right to:

• access a summary of the personal data processed about you and the processing activities;
• have inaccurate or incomplete data corrected and completed, and data you no longer need erased;
• withdraw consent you have given;
• seek grievance redressal about how your data is handled;
• nominate another person to exercise your rights in the event of your death or incapacity;
• in the case of a child, have those rights exercised by a parent or lawful guardian.

To exercise a right regarding information in a school’s workspace, contact the School. To exercise a right regarding data we hold for ourselves, or if you are unable to reach the School, email zerox9861@gmail.com with the subject “Data request”. We may need to verify your identity, and we will respond within a reasonable time and in any case within the period the law requires.

If we cannot resolve your concern you may approach the Data Protection Board of India or the competent regulator where you live.

We apply technical and organisational safeguards that are appropriate to the sensitivity of the data. They include: encrypted connections (HTTPS); salted one-way password hashing; signed, expiring, HTTP-only session cookies; server-side role and school checks on every request; immediate deactivation of accounts; response headers that reduce clickjacking and sniffing risks; and an audit trail of significant actions. See the Security page for more.

No method of transmission or storage is completely secure. If a personal-data breach occurs, we will notify the affected School without undue delay and cooperate in notifying individuals and the regulator where the law requires.

Children do not hold accounts. Their information is entered and managed by the School and viewed by their parents or guardians and authorised staff. We apply the additional safeguards described in our Student & Children’s Data notice, including no tracking, behavioural monitoring or targeted advertising directed at children.

We use one essential session cookie to keep you signed in and do not use advertising or cross-site tracking cookies. See the Cookie Policy for details.

Dashboards, percentages, grades, ranks and trend charts are produced by calculations on data the School has entered. They assist human decision-makers and do not by themselves make decisions about students. Schools should review them before acting.

The Service or our website may link to other websites. We do not control them and are not responsible for their privacy practices. Please read their policies.

We may update this Policy to reflect changes in the Service or the law. We will change the “last updated” date and, for material changes, give reasonable notice, for example by email to School Administrators or a notice in the Service.

Questions, requests and complaints about privacy can be sent to Zerox Studios, Kerala, India.

• Email: zerox9861@gmail.com (subject “Data request” or “Privacy complaint”)
• WhatsApp: +91 94968 29330

We aim to acknowledge complaints within two business days and to resolve them within thirty days.