Privacy policy

Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the school you or your child belong to is the data fiduciary: it decides why and how your personal data is processed. Scolvya acts as the school's data processor. We process personal data only to provide the service to the school, under our agreement with it, and not for our own purposes.

The school is therefore your first point of contact for anything about your records — what is kept, a correction, a copy. We help the school answer, and you can also write to us (see Contact and grievances).

Scolvya is the data fiduciary only for the small amount of data we handle to run the service itself: the security logs described below and correspondence you send us directly.

Depending on what your school uses, Scolvya may hold:

• Account details — name, email address, mobile number, role (parent, pupil, teacher, office staff), school and campus, and a password stored only as a one-way hash. If you turn on two-step sign-in, its secret is stored encrypted.
• Pupil records entered by the school — name, admission number, class and section, date of birth, gender, photograph, address, blood group, medical notes and allergies, previous school, government identifiers the school is required to record (such as APAAR ID, PEN and UDISE codes), and, where the school collects it, category, religion and mother tongue. Where the school records an Aadhaar number, it is stored encrypted and only its last four digits are shown.
• Parent and guardian details — name, relationship to the pupil, phone, WhatsApp number, email address, and any occupation, qualification or income details the school's admission form asks for.
• School activity — attendance, marks, report cards, homework, timetables, library loans and fines, leave requests, gate passes, transport boarding, notices and circulars, and messages between parents and teachers sent through Scolvya. If the school uses attendance terminals (card or fingerprint readers), Scolvya receives the time and the card or enrolment number of each punch; fingerprint data stays on the terminal and is never sent to us.
• Fees and payments — invoices, amounts paid and due, receipts, advances and, for bank transfers, the bank reference the school's bank reports. For online payments we receive the gateway's payment reference, the amount, the status and the payment method — not card or bank credentials.
• Staff records entered by the school — employment details, attendance, leave, payroll, bank account for salary, and statutory identifiers such as PAN, UAN and ESIC numbers.
• Visitor records, if the school uses them — a visitor's name, phone number, the ID they showed and whom they came to see.
• Security logs — when you sign in or change something, we record what was done, by which account, when, and the IP address and browser or app identifier (“user agent”) it came from. To stop password guessing, failed sign-in attempts are counted for up to an hour, and the network addresses an account has signed in from successfully are remembered for 30 days so that they are not slowed down.
• Device registration — if the school sends push notifications, the notification token the phone gives us, so a message can be delivered to it.

• The app shows the same records as the website, for the signed-in account only. It keeps your sign-in tokens in the phone's encrypted secure storage and the server address in ordinary app storage.
• It requests only network access and, for tapping feedback, vibration. It does not request location, camera, microphone, contacts, photos or storage access, and it does not read other apps' data.
• It contains no advertising, no advertising ID and no third-party analytics or tracking software.
• To pay fees, the app opens the payment gateway's checkout page in your browser, or your UPI app; payment details are entered there, not in Scolvya.
• All traffic between the app and our servers is encrypted (HTTPS). The app will not connect to a server over unencrypted HTTP.

Personal data is used only to provide the service the school has asked for:

• running the school's administration — admissions, classes, attendance, examinations, fees, payroll;
• showing parents, pupils and staff the information that concerns them;
• sending the notices, alerts and reminders the school chooses to send (app, SMS, WhatsApp or email);
• taking fee payments and issuing receipts;
• keeping accounts secure — sign-in, password resets, detecting misuse, and the audit trail;
• meeting legal obligations, such as keeping financial records and answering lawful requests.

We do not use personal data for advertising, we do not sell it, and we do not use children's data for tracking, behavioural monitoring or targeted advertising.

Most pupils are under 18. Their data is entered and used by the school, for the school's educational and administrative purposes. Under the DPDP Act the school is responsible for obtaining verifiable consent from a parent or lawful guardian where consent is the basis for processing a child's data; Scolvya records and processes children's data only on the school's instruction. Pupil accounts are created by the school, not by children signing themselves up.

A parent or guardian can ask the school — or us, and we will pass it on — to see, correct or erase their child's data, or to withdraw consent. Some records the school must keep regardless (see How long data is kept).

Personal data is shared only as far as needed to provide the service:

• Your school, whose authorised staff see what their role permits. Each school's data is kept separate from every other school's.
• Payment gateways the school has chosen — Razorpay or PayU — which receive the payment amount and reference and process your payment under their own privacy policies.
• Messaging providers, if the school sends messages through them: an SMS gateway, Meta (WhatsApp Business), an email service, and Expo / Google Firebase Cloud Messaging for app notifications. They receive the phone number, address or device token and the message.
• Hosting and infrastructure providers that store and run the service for us, bound by confidentiality and security obligations.
• Authorities, when the law requires it — for example a court order or a request under tax law.

Some of these providers (Meta, Google, Expo) may process data outside India. We use them only as the DPDP Act permits.

• While the school uses Scolvya, records are kept for as long as the school needs them.
• Deleted accounts. When a deletion request is approved, the account is closed, signed out everywhere, and its email address, phone number, photo, password and two-step sign-in are erased. The school's records that mention the account — receipts, attendance, marks, the audit trail — are kept, because the school is required to keep them. See Delete your account.
• When a school leaves. Its accounts are closed. Personal identifiers — names, phone numbers, email and postal addresses, Aadhaar, photos, guardian contacts — can then be erased, leaving amounts, dates, and receipt and invoice numbers so the books still balance. Financial records are kept for 8 years after the school closes, the longest period Indian accounting and tax law may require.
• Security logs are kept for as long as the records they describe, so that changes to fees, marks and accounts can be traced.

• All connections to the website and the app are encrypted with HTTPS.
• Passwords are stored as one-way hashes; Aadhaar numbers and two-step sign-in secrets are encrypted.
• Access is limited by role — a parent sees their own children, a teacher their own classes — and every school's data is separated from the others'.
• Sign-in attempts are rate-limited, sessions can be ended on every device at once, and significant changes are written to an audit trail.

If a personal data breach occurs, we will inform the affected school without delay so that it and we can notify the Data Protection Board of India and the people affected, as the DPDP Act requires.

Under the DPDP Act you can:

• ask for a summary of the personal data held about you and who it has been shared with;
• ask for inaccurate or incomplete data to be corrected, and out-of-date data to be updated;
• ask for data to be erased, unless it must be kept by law;
• withdraw consent you gave, for the future;
• nominate someone to exercise these rights if you die or become incapable;
• complain to us, and then to the Data Protection Board of India if you are not satisfied.

Start with your school, which holds the records. You can also write to us and we will work with the school to respond. Parents and guardians exercise these rights for children under 18.

The website sets only the cookies it needs to work: a sign-in session cookie, a protection token against cross-site request forgery, and, for platform operators, the school they are viewing. Your light or dark theme choice is kept in your browser's local storage. There are no advertising or analytics cookies.

For questions or complaints about your personal data, contact your school first. You can also write to our Grievance Officer, Scolvya at privacy@scolvya.com. Tell us your school, your role and what you are asking for; we will acknowledge your message and respond within the time the DPDP Act and its Rules allow.

If you are not satisfied with the response, you may complain to the Data Protection Board of India.

When this policy changes, the date at the top changes with it. Significant changes will be announced to schools before they take effect.