Privacy Policy

Last updated: March 1, 2026

This is a draft, not a published policy.

13 details the business must supply are still unset, so they appear below in brackets. Set the environment variables and rebuild; the policy should then be reviewed by Indian counsel before it is relied upon.

NEXT_PUBLIC_LEGAL_ENTITY_NAME — Registered legal name of the contracting company
NEXT_PUBLIC_LEGAL_REGISTERED_ADDRESS — Registered office address, including PIN code
NEXT_PUBLIC_LEGAL_CIN — Company identification number (CIN)
NEXT_PUBLIC_LEGAL_GSTIN — GSTIN, if fees are quoted exclusive of GST
NEXT_PUBLIC_GRIEVANCE_OFFICER_NAME — Grievance Officer's name — required by the DPDP Act, 2023
NEXT_PUBLIC_GRIEVANCE_OFFICER_EMAIL — Grievance Officer's published email address
NEXT_PUBLIC_GRIEVANCE_OFFICER_PHONE — Grievance Officer's published phone number
NEXT_PUBLIC_LEGAL_RETENTION_PERIOD — Post-termination data retention window agreed in school contracts
NEXT_PUBLIC_LEGAL_REFUND_POLICY — Refund policy for the current billing period
NEXT_PUBLIC_LEGAL_REFUND_PROCESSING_TIME — How long a refund takes to reach the payer
NEXT_PUBLIC_LEGAL_NOTICE_PERIOD — Notice period for terminating a subscription
NEXT_PUBLIC_LEGAL_DATA_EXPORT_WINDOW — How long a school can export its data after termination
NEXT_PUBLIC_LEGAL_UPTIME_COMMITMENT — Uptime commitment, or a statement that no SLA is offered

1. Who we are

ReSchool is school operations software operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] (CIN [CIN / REGISTRATION NO]). This policy explains what information the platform processes, on what basis, and how it is protected.

For the records a school enters about its students, staff, and families, the school is the Data Fiduciary and ReSchool acts as a Data Processor on the school's written instructions. For visitors to this website and for the account holders who administer a school workspace, ReSchool is the Data Fiduciary.

2. Information we process

User account information (name, email, phone, role assignments)
Institutional data (school profile, academic settings, operational records)
Student and guardian records entered by authorized school users — including enrollment details, attendance, assessments, documents, transport assignments, and hostel or library activity where those modules are enabled
Payroll and employment records where the HR module is enabled
Payment and transaction metadata returned by our payment provider (we do not store card numbers, UPI credentials, or bank credentials)
Device, session, and usage data (IP address, user agent, request logs, audit trail entries) for security and reliability
Enquiry data you submit on this website (contact form, demo request, onboarding request, newsletter subscription)

3. Lawful basis for processing

Under the Digital Personal Data Protection Act, 2023, we process personal data on the following bases:

Contractual necessity — processing school, staff, and student records to deliver the platform under the subscription agreement with the school.
Consent — website enquiries, demo requests, and newsletter subscriptions, which you may withdraw at any time by writing to the address in section 11.
Legitimate uses and legal obligation — security monitoring, audit trails, fraud prevention, tax and statutory record-keeping.

Where a school instructs us to process student data, the school is responsible for obtaining the notice and consent required from parents or lawful guardians.

4. Children's data

ReSchool is used to administer K-12 institutions, so most records in the platform relate to children. The platform is not marketed to children and children do not sign up directly: student and parent portal accounts are provisioned by the school.

The school, as Data Fiduciary, must obtain verifiable consent from a parent or lawful guardian before a child's personal data is processed, as required by section 9 of the DPDP Act, 2023.
We do not carry out behavioural tracking, profiling, or targeted advertising directed at children. The platform contains no advertising and no third-party advertising or analytics trackers.
Child records are visible only to users the school has granted a role with the corresponding permission, and only within that school's tenant.
Requests from a parent or guardian to access, correct, or erase a child's record should be made to the school. We will support the school in fulfilling them and will not act on such a request independently of the school.

5. How we use information

To provide and maintain platform functionality
To deliver communication and operational notifications
To process billing and payment workflows
To support customer requests and issue resolution
To improve platform performance, security, and reliability

We do not sell personal data, and we do not use student data to train third-party models or for advertising.

6. Cookies and browser storage

This site does not use advertising or cross-site tracking cookies. The platform relies on your browser's local storage rather than cookies for the following strictly necessary purposes:

Session tokens — after you sign in, your access and refresh tokens are stored in your browser's localStorage when you choose “Remember me”, and in sessionStorage (cleared when the browser session ends) when you do not. Signing out removes them.
Theme preference — your light/dark selection is stored locally so pages render in the theme you chose.
Offline assets — a service worker may cache application assets so the app loads reliably on poor connections.

Clearing your browser storage for this site removes all of the above and signs you out.

7. Data security controls

We apply encryption in transit, hashed credential storage, role-based access control, audit logging, and tenant-scoped data isolation — every record is bound to a single school and every query is scoped to it. Access to production data is restricted to personnel who need it for support and operations. Security controls are reviewed as part of our platform operations lifecycle.

If a personal data breach occurs, we will notify the affected school and the Data Protection Board of India as required by the DPDP Act, 2023.

8. Service providers

We use the following processors to deliver the service. They receive only the data needed for their function and are bound by contract:

Razorpay — payment processing for fee collection and subscription billing
Amazon Web Services — cloud hosting, document storage (S3), transactional email (SES), and SMS delivery (SNS)
Google Firebase — mobile and web push notifications

School data is hosted in [SUB-PROCESSOR REGIONS]. Where a provider processes data outside India, transfers are made only to jurisdictions not restricted by the Central Government under the DPDP Act, 2023.

9. Data retention

Data is retained while a school account is active. After termination it is retained for [DATA RETENTION PERIOD] to support export and recovery requests, then deleted or anonymised, unless a longer period is required by law or by the school's contractual terms. Audit and security logs may be kept for longer where statutory record-keeping requires it.

10. Your rights

Request access to your personal information
Correct or complete inaccurate information
Request erasure where applicable
Request data export in a structured format
Nominate another person to exercise your rights
Withdraw consent where processing is based on consent
Raise a grievance (section 11) and escalate it to the Data Protection Board of India

If your data was entered by a school, address your request to that school first — we will act on it under the school's instructions.

11. Grievance Officer and contact

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, the Grievance Officer for [LEGAL ENTITY NAME] is:

Name: [GRIEVANCE OFFICER NAME]
Email: [GRIEVANCE OFFICER EMAIL]
Phone: [GRIEVANCE OFFICER PHONE]
Address: [REGISTERED ADDRESS]

We acknowledge grievances on receipt and aim to resolve them within 30 days. General privacy requests can also be sent to [email protected].

12. Changes to this policy

We will update this page when our processing changes and revise the “last updated” date above. Material changes affecting schools are communicated through the account contacts on file.