Privacy Policy

SchoolManagementServices provides School Management System, a software platform that schools use to manage admissions, attendance, fees, academic records, transport and communication with parents.

Almost all of the personal data on this platform belongs to a school and its students, staff and parents. In those cases the school decides what is collected and why, and we process that data on the school's instructions as its service provider. If you are a parent, student or staff member, your school is your first point of contact about your data; we will help the school respond.

The one exception is a query sent through the form on our own website (schoolmanagementservices.in). For that data we decide what is collected and why; see section 2.

Depending on which parts of the platform your school uses, this can include:

• Identity and contact details — name, date of birth, gender, photograph, address, phone number and email address of students, parents or guardians, teachers and other staff.
• School records — class and section, roll number, admission and UDISE details, parent/guardian names, category (such as SC/ST/OBC/GEN) where a school records it, and assigned transport route or stop.
• Aadhaar number — only if your school has chosen to collect it, and never as a condition of admission. It is stored encrypted, only its last four digits are ever displayed, and it is erased with the rest of the student's identity.
• Academic and attendance data — daily attendance, marks, grades, report cards, remarks, leave applications and the reasons given for them.
• Fees and payments — fee assignments and dues, receipts, payment mode and status, and the reference identifiers returned by the payment gateway. We do not receive or store your card number, UPI PIN, CVV or net-banking credentials — those are entered on the payment provider's own checkout.
• Transport data — the live GPS position of a school bus and a short history of its route, so that schools and parents can see where the bus is. This tracks the vehicle, not a student's personal device.
• Gate pass and visitor records — the name, relationship, phone number and photograph of the person collecting a student, and visitor details recorded at the gate, used to confirm that a child is handed to the right person.
• Admission enquiries — when a parent uses the enquiry form on a school's own website: the child's name, the class applied for, the parent's name and mobile number, and — only if the parent gives them — the child's date of birth, an email address and a message. The enquiry is stored for that school only and is seen only by its admin and accountant. It is sent only after the parent agrees to be contacted, and we record when they agreed.
• Queries sent to us — when someone uses the query form on our own website: their name, school name, mobile number and, optionally, email, city and message. It is sent only after they agree to be contacted, and we record when they agreed. We use it only to reply about our software.
• Account and technical data — login times, session tokens, password-reset and verification codes, and basic usage information described in section 6.

Most students on this platform are children. Their data is entered and controlled by the school, which is responsible for obtaining any parental consent required by law. We process children's data only to provide the platform to the school — we do not use it for advertising, we do not profile children, and we do not sell it to anyone.

A parent or guardian who wants to see, correct or remove a child's data should contact the school. Schools can reach us using the details in section 10 if they need help doing so.

• To run the features a school has enabled — admissions, attendance, examinations and report cards, fee collection, transport tracking, gate passes and notices.
• To authenticate users and keep accounts secure, including password resets and one-time codes.
• To send transactional email such as account, verification and password-reset messages.
• To keep records a school is required to keep, and to produce the reports and receipts it needs.
• To maintain, debug and improve the reliability and security of the platform.

We do not sell personal data, and we do not use student or parent data for advertising.

We share data only with the service providers needed to operate the platform, and only the data each one needs:

• Payment gateways (such as Razorpay) — when a fee is paid online, the payer's name, email address, phone number and the amount are passed to the gateway so it can process the payment and return its status.
• Cloud storage (Amazon Web Services S3) — photographs, ID cards, logos and uploaded documents are stored there.
• Google Sign-In — if you choose to sign in with Google, Google confirms your verified email address to us.
• Google Analytics — anonymous usage measurement, described in section 6.
• Email delivery providers — used to send the transactional emails described above, and to forward a query sent through our website form to our own mailbox.
• Map tiles (OpenStreetMap) — used to draw the map on bus tracking screens.

We may also disclose data where the law requires it, or to protect the safety of a student or another person.

The platform stores your login session and a few preferences (such as your chosen theme) in your browser's local storage. These are necessary for the service to work — signing out clears the session.

We use Google Analytics 4 to understand how the site is used, for example which pages are opened and how often. This is aggregate usage measurement; we do not send student records, marks, fee details or contact information to Google Analytics. You can block it with your browser's privacy settings or an extension without affecting the rest of the platform.

School records are kept for as long as the school's account is active, because a school needs its historical attendance, fee and academic records. Deletion is an administrative action carried out on the school's instruction — there is no automatic purge, and the platform does not offer self-service account deletion.

One exception is bus location history, which is limited to roughly the last 24 hours and is trimmed automatically after that.

A query sent to us through our website form is kept until we have dealt with it. There is no automatic deletion; you can ask us to delete it at any time using the details in section 10.

• Each school’s data is stored in its own separate database, so one school cannot read another’s records.
• Passwords are stored only as salted hashes, never in a readable form.
• Sessions use signed tokens; refresh tokens are stored only as hashes, are rotated each time they are used, and can be revoked.
• Stored payment-gateway credentials are encrypted.
• Traffic to the site is served over HTTPS, and the API applies rate limiting and role-based access checks.

No system is completely secure, and we do not claim any formal security certification. If you believe an account or record has been compromised, contact us immediately using the details below.

You can ask to access, correct or delete personal data, or object to how it is used. For student, parent and staff records, please raise the request with your school, which controls that data; we support schools in fulfilling such requests. Where we decide how data is used, you can contact us directly.

We may update this policy as the platform changes. The “Last updated” date at the top of this page always reflects the version in force. If a change materially affects how personal data is handled, we will inform the schools using the platform.

For any question about this policy or about your data, contact: