Campusentra — Privacy Policy

1. Our role — your school is the data fiduciary

Campusentra is a school-management platform provided to schools ("Schools"). Your School decides what data is collected about you and your child and why — under India's Digital Personal Data Protection Act, 2023 (DPDP Act), your School is the Data Fiduciary and Campusentra acts as a Data Processor on the School's documented instructions. For questions about how your School uses your data, contact your School directly; for how Campusentra secures and processes it, contact us (Section 12).

2. Information we process

• Account & identity: your registered mobile number and/or email, name, and your relationship to your child(ren), as provided by your School.
• Your child's school records (viewed via the app): attendance, timetable, exam results and report cards, fees and payment history, transport/bus assignment and boarding scans, announcements, certificates and documents. This data originates from your School.
• Device & technical data: a push-notification token (Firebase Cloud Messaging), app version, device model and OS, IP address, and diagnostic/crash data.
• Usage data: in-app actions needed to operate features (e.g., marking a notification read, declaring a bus absence).
• Approximate/real-time location — of the bus, not you: the live map shows the school bus's GPS position; the app does not collect your device's location.
• Payments: fee payments are processed by our payment gateway. Card/bank details are entered on the gateway and are not stored by Campusentra.

3. How we use it

To authenticate you; show your child's school information; deliver notifications you've opted into; process fee payments; provide support; maintain security, prevent abuse, and diagnose crashes; and comply with legal obligations. We do not sell your personal data or use it for third-party advertising.

4. Legal basis / consent

We process data to deliver the service your School has engaged us for and that you use, and on the basis of consent where required by the DPDP Act. Notification channels (email, push, Telegram) are opt-in/opt-out in the app's Settings.

5. Children's data

The app is intended for parents/guardians, not children. It processes minors' school records on the School's behalf; the School obtains guardian consent as required by the DPDP Act. We do not knowingly allow children to create accounts, and we apply the Act's protections for minors' data.

6. Who we share data with

• Your School and its authorised staff (the data fiduciary).
• Service providers (processors) under contract: Google Firebase (authentication, push notifications, crash reporting, analytics), Google Maps (bus map), our email provider, our SMS/OTP provider, our payment gateway, and our cloud hosting provider (AWS, India region). Each receives only the data needed for its function.
• Legal / safety: where required by law or to protect rights and safety.

7. Third-party services

Firebase (Authentication, Cloud Messaging, Crashlytics, Analytics) and Google Maps are governed by Google's Privacy Policy (policies.google.com/privacy). Fee payments are processed by PhiCommerce and are subject to its terms.

8. Data security

Encrypted transport (HTTPS/TLS); the session credential is stored in Android EncryptedSharedPreferences; access is scoped so you see only your own children's data; encryption of sensitive data at rest on our servers; and least-privilege access controls. No method is 100% secure, but we maintain safeguards appropriate to the sensitivity of the data.

9. Data retention

We retain personal data for as long as your School's account is active and as needed to provide the service, then delete or anonymise it per the School's instructions and applicable law. Diagnostic/crash data is retained for a limited period.

10. Your rights (DPDP Act)

You may request access, correction, updating, and erasure of your personal data, withdraw consent, and nominate another person to exercise your rights. Because your School is the data fiduciary, please raise requests via your School or our Grievance Officer (Section 12); we will act within the timelines the Act requires.

11. International transfers

Data is primarily processed in India. Where a service provider processes data outside India, we require appropriate safeguards consistent with applicable law.

12. Grievance Officer & contact

Grievance Officer: Arvind Cletus · Email: grievance@campusentra.com. General queries: contact@campusentra.com.

13. Changes to this policy

We will post changes here and update the "Last updated" date; material changes will be notified in-app or by your School.