Privacy Policy

Schoolivo (“Schoolivo”, “we”, “us”) provides school management software to schools in India. This policy applies to schoolivo.in, the Schoolivo Android app, the parent app and the web dashboard.

Schoolivo is operated by [Schoolivo], registered at [Khurmabad, Siwan, Bihar 841226], [Siwan, Bihar 841226]. You can reach us at 3daditya@gmail.com or +91 83750 04856.

This is the most important clause on the page, so it comes first. Under the Digital Personal Data Protection Act, 2023, responsibility depends on who decides why data is processed, not who stores it.

• For student, parent and staff records: your school is the Data Fiduciary and Schoolivo is a Data Processor. The school decides what to collect and why. We process it only on the school’s instructions, only to run the service, and for no purpose of our own.
• For enquiries, referrals and staff accounts we create: Schoolivo is the Data Fiduciary. If you filled in a form on this website, that is our responsibility directly.

Practically, this means the school’s records belong to the school. We do not sell them, we do not use them to train any model of our own, and we do not use one school’s data to build anything for another school.

From a school using Schoolivo

• Student records — name, admission number, class and section, date of birth, guardian names and contact numbers, address, and documents the school uploads such as transfer certificates, Aadhaar copies and marksheets. Purpose: to run admissions, attendance, fees and reporting.
• Fee and payment records — fee structures, installments, discounts, receipts and payment status. Purpose: collection, receipts and the audit trail the school is accountable for.
• Staff records — name, role, mobile number, email, salary and leave data where the school uses payroll. Purpose: logins, permissions and payroll.
• Activity logs — which staff account performed which action, and when. Purpose: the audit log. This exists so a school can prove who cancelled a receipt, and it is deliberately not editable.

From you, on this website

• Enquiry forms — school name, your name, mobile, and optionally email, city, approximate student count and your message. Purpose: to call you back about a demo.
• Referrals — if someone refers a school, we store the referrer’s name, mobile, optional email and their stated relationship to the school, so we can pay the reward if the school signs up.
• A hashed form of your IP address and your browser user-agent, kept only to detect spam and duplicate submissions. We store a one-way hash, so the original address is not retained.

We do not run behavioural advertising, we do not operate advertising trackers on this site, and we do not buy or sell contact lists.

Most of the records in Schoolivo belong to children. Under the DPDP Act, processing a child’s personal data requires verifiable consent from a parent or lawful guardian, and prohibits tracking, behavioural monitoring and targeted advertising directed at children.

• That consent is obtained by the school, as Data Fiduciary, through its admission process. We rely on the school’s confirmation that it holds it.
• We do not profile children, do not serve advertising of any kind, and do not track children across other websites or apps.
• Children do not have Schoolivo logins. The parent app is for the guardian, and access is verified by an OTP to the guardian’s registered mobile number.

We use a small number of service providers to run Schoolivo. Each processes data only to deliver its part of the service. This list is exhaustive as at the date above.

• Google (Gemini API) — powers the AI assistant. When a parent or staff member asks a question, the question and the relevant extract of school records needed to answer it are sent to Google’s API. Ask nothing of the assistant and nothing is sent.
• Meta (WhatsApp Business API) — used to deliver receipts, fee reminders, absence alerts and OTPs. The recipient’s mobile number and the message content pass through Meta.
• Razorpay — processes online fee payments. Card and bank details are entered on Razorpay’s systems and are never seen or stored by Schoolivo.
• Cloud hosting and object storage — our servers, database and uploaded documents are held with our infrastructure providers under contract.

Some of these providers process data on servers outside India. If your school requires that data stays within India, tell us before you sign — for some of these we can configure an Indian region, and for others we cannot, and you should know which before you commit.

We take the security measures below. We describe them precisely rather than in the usual language, because a school should be able to check them.

• Traffic between your device and Schoolivo is encrypted in transit over HTTPS.
• Passwords are stored only as bcrypt hashes. Nobody at Schoolivo can read a user’s password, including us.
• Each school’s data is isolated by organisation, and every query is scoped to the signed-in user’s school. A staff login cannot reach another school’s records.
• Access is role-based, and staff actions are written to an append-only audit log. Receipts can be cancelled but never deleted or silently edited.
• Rate limiting and standard hardening headers are applied to the API.

No system is perfectly secure, and we will not claim otherwise. If we become aware of a personal data breach we will notify the affected school and the Data Protection Board of India as required under the DPDP Rules, and we will tell you what happened rather than the minimum we can get away with.

• School records — for as long as the school’s subscription is active. School records are historical by nature: a student who left in 2021 still appears in that year’s fee ledger, and deleting them would break the school’s own accounts.
• After a school leaves — we keep the data for 90 days so it can be exported or the school can change its mind, then delete it. A school can ask us to delete sooner, in writing.
• Website enquiries — we keep these until you ask us to remove them. We say this plainly rather than inventing a period we would not honour: an enquiry that went cold in June is one we may call again next February.
• Referral records — retained while a reward may still become payable, and afterwards as a record of payments made.

Under the DPDP Act you can ask us to:

• tell you what personal data of yours we hold, and who we have shared it with;
• correct anything inaccurate, or complete anything missing;
• erase data where we no longer need it for the purpose it was collected;
• nominate someone to exercise these rights if you die or become incapacitated;
• withdraw consent, where we relied on your consent to process the data.

If you are a parent, student or staff member of a school that uses Schoolivo, raise the request with your school first — the school is the Data Fiduciary and holds the relationship. If you contact us directly, we will forward it to the school and help them action it.

For anything we hold as Data Fiduciary — a website enquiry or a referral — write to us and we will act within 30 days.

If you are not satisfied with how we have handled your data or your request, you can escalate to our Grievance Officer, appointed under the DPDP Act and the Information Technology Act:

We acknowledge grievances within 48 hours and resolve them within 30 days. If you remain dissatisfied you may complain to the Data Protection Board of India.

If we change how we handle data in a way that affects you, we will update the date at the top of this page and, for material changes, tell schools by email before the change takes effect. We will not quietly widen what we do with data you have already given us.

See also our Terms of Service and Refund & Cancellation Policy.