Privacy policy

SkolaOS is school management software. Schools use it to run their administration — and that means schools entrust us with information about their students, staff and families. We take that seriously. This page explains, in plain language, what we collect and how we handle it.

What we collect

Account information — when a school administrator registers: their name, username, email, and school name.

School records — the information schools enter to run their operations: student and staff profiles (names, dates of birth, guardian contact details, addresses), admissions, fee structures and payments, attendance, exam marks, certificates, notices and uploaded documents. This data belongs to the school; SkolaOS processes it on the school's behalf.

Enquiries — messages sent through our contact form, with the contact details you provide.

Children's data

Student records inevitably describe children. Schools, as the guardians' point of contact, are responsible for collecting this information lawfully and with appropriate consent, consistent with India's Digital Personal Data Protection Act, 2023. We process it only to provide the service to the school — never for advertising, profiling, or sale. We do not knowingly collect information directly from children.

How data is stored

Records are stored in a managed MongoDB database; uploaded files (photos, documents) are stored with Cloudflare. Transactional email (password resets, notices, approvals) is delivered through our email provider. Passwords are stored only as salted bcrypt hashes — we cannot read them. Public result pages show academic information only, behind unguessable links, and never expose contact details, addresses or identifiers like Aadhaar.

What we never do

We do not sell personal data. We do not show ads. We do not share school records with third parties except the infrastructure providers named above, strictly to run the service.

Data ownership & deletion

The school owns its data. Schools can export their records (CSV exports are built into the product) and can request full deletion of their account and records at any time via our contact page.

Changes & contact

If this policy changes materially, registered administrators will be notified by email. Questions? Reach us through the contact page.