1. Overview & Scope
This Privacy Policy describes the policies and practices of MyEduOS (“we”, “our”, or “the Platform”) regarding the collection, storage, processing, and transfer of personal information when educational institutions, administrators, teachers, staff, students, and guardians access our cloud-based educational management system.
MyEduOS serves K-12 schools, pre-university colleges, coaching academies, and multi-campus educational trusts. Our systems are engineered from the ground up to uphold the highest standards of student data privacy, complying with the Digital Personal Data Protection Act (DPDP Act 2023) and international educational data guidelines.
2. Educational Data We Process
To deliver core administrative, academic, financial, and logistical capabilities, MyEduOS processes data entered directly by authorized institution personnel or submitted through guardian portals and student applications:
| Data Domain | Specific Data Elements | Operational Purpose |
|---|---|---|
| Student Academic & Identity Records | Full legal name, date of birth, enrollment ID, roll number, class/section, photos for ID Card Studio, grades, exam answer keys, attendance marks. | Curriculum management, report card generation, class rosters, graduation, and CBSE/ICSE board compliance. |
| Guardian & Family Information | Parent names, relationship, mobile phone numbers, residential addresses, emergency contacts, WhatsApp notification preferences. | Critical communications, attendance notifications, fee demand notices, report card distribution, and transport pickup authorization. |
| Faculty & Staff Data | Employee ID, designation, educational qualifications, biometric punch timestamps, duty rosters, payroll slabs, bank account details. | Staff scheduling, substitution planning, payroll processing, and statutory compliance. |
| Fee & Financial Transactions | Invoice numbers, payment mode (UPI, card, net banking), Razorpay transaction reference IDs, concession flags, receipt vouchers. | Fee collection, reconciliation, financial auditing, and institution ledger accounting. (Raw card details & CVVs are never stored by MyEduOS). |
| Campus & Fleet Telemetry | Real-time vehicle GPS coordinates, stop timestamps, visitor pass logs, biometric gate check-ins. | Student transit safety, live school bus tracking for parents, and campus perimeter security. |
3. Legal Roles: Fiduciary vs. Processor
Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and global privacy standards:
- The Educational Institution is the Data Fiduciary (Data Controller): The school determines the purpose and legal basis for collecting student, guardian, and staff information. The institution is responsible for obtaining lawful guardian consent for minors under 18 years of age.
- MyEduOS is the Data Processor: We process institutional data strictly in accordance with the institution’s written instructions and our service agreement. We never use student data for machine learning training without express institutional authorization, and never for third-party commercial marketing.
4. Tenant-Level Data Isolation
MyEduOS employs a multi-tenant cloud architecture backed by PostgreSQL Row-Level Security (RLS). Every single database query is scoped to the specific organization_id of the authenticated tenant.
This guarantees that no school or institution can ever query, inspect, or modify records belonging to another school, even within multi-campus trusts where individual branches maintain strict administrative partitions.
5. Security Controls & Data Protection
We protect your educational records through enterprise-grade defenses:
- Encryption in Transit: All HTTP traffic is enforced over TLS 1.3 with Perfect Forward Secrecy and Strict-Transport-Security (HSTS).
- Encryption at Rest: Database volumes, backup snapshots, and student document assets (ID photos, transfer certificates) are encrypted using AES-256.
- Access Governance: Role-Based Access Control (RBAC) across 12 distinct roles ensuring least-privilege access.
- Multi-Factor Authentication (2FA): TOTP-based two-factor authentication available for all administrative and faculty accounts.
- Tamper-Evident Audit Trails: Immutable audit logs record every sensitive administrative change (marks modification, fee waivers, permission grants).
6. Data Subject Rights & Self-Serve Portal
MyEduOS provides built-in tools for institutions to fulfill data subject rights directly:
- Right to Access: Guardians and staff can view all personal details directly in their respective portals or request a complete JSON/CSV data export via Privacy Requests.
- Right to Correction: Discrepancies in student names, spellings, blood groups, or addresses can be corrected by administrators with audit logging.
- Right to Erasure / Forgotten: Where permitted by statutory board regulations (e.g., following mandatory retention periods), administrators can trigger secure cryptographic erasure of departed student profiles.
7. Data Retention & Disposal
We retain institutional records only for as long as your institution maintains an active MyEduOS subscription or as required by applicable state or central board retention mandates (such as CBSE affiliation guidelines requiring permanent preservation of admission and withdrawal registers).
Upon termination of service, institutions are provided a 30-day window to export all records, after which all tenant database partitions and document caches are permanently purged.
8. Grievance Officer & Inquiries
In accordance with the Information Technology Act and the DPDP Act 2023, MyEduOS has designated a dedicated Grievance Officer for data protection and privacy inquiries:
Grievance & Data Protection Officer
MyEduOS Cloud Platforms • AISoftvision
Email: privacy@myeduos.com
Response Time: Within 48 business hours