Privacy policy

This Privacy Policy explains how AakarLab (“we”, “us”, “our”), the developer and operator of ClassUps, collects, uses, stores, shares, and protects personal data when you visit our public website or when a school uses the ClassUps school management platform in India.

We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules framed under it, the Information Technology Act, 2000 (including reasonable security practices), and other applicable Indian law. This page is an information notice. It is not legal advice to your school.

On this page

• Who we are
• What this policy covers
• Our role and your school’s role
• Information we collect
• Children’s personal data
• How we use information
• Sharing and processors
• Cookies
• Retention
• Security
• Your rights
• Grievance officer

1. Who we are

ClassUps is a cloud school operating system for Indian schools: student and staff records, attendance (including RFID/QR hardware), fees, exams, timetables, parent messaging, admissions, and related portals. The product is designed, built, and maintained by AakarLab.

Registered / correspondence address: India.

For day-to-day questions you may also use our contact page.

2. What this policy covers

This policy applies to:

• This public website — home, features, about, contact, inquiry forms, cookies, and similar pages.
• The ClassUps platform — school portals for administrators, teachers, students, parents, and public school sites hosted on our infrastructure.

It does not apply to third-party websites, payment pages on a bank or Razorpay checkout, WhatsApp/SMS operator networks, or a school’s own offline records.

3. Our role and your school’s role (DPDP Act)

Under the DPDP Act, the person who decides why and how personal data is processed is a Data Fiduciary. A party that processes data on behalf of a Data Fiduciary is a Data Processor.

• Your school is the Data Fiduciary for personal data it enters or instructs us to process about students, parents, teachers, and staff (for example admission numbers, attendance, marks, fees, and phone numbers used for notices). The school must have a lawful ground, give required notices, and obtain consent — including verifiable parental consent where the DPDP Act requires it for children.
• We are a Data Processor for that school-held data. We process it only to provide ClassUps as contracted, to keep the service secure, and as Indian law requires.
• We are a Data Fiduciary for data we collect for our own purposes: website inquiries, demo and sales records, school administrator accounts we issue, billing and GST invoices, support tickets, and security logs of our systems.

Students, parents, and teachers who want a copy, correction, or deletion of school records should first contact their school. We cannot lawfully change a school’s academic or fee records on a parent’s request alone.

4. Information we collect

4.1 Public website and inquiries

• Name, email, phone, school name, city, and message you submit on demo or contact forms.
• Technical data such as IP address, browser type, device type, pages viewed, and approximate timestamps, used for security and to run the site.

4.2 School accounts

• School profile (name, address, contact, branding, academic sessions).
• Login credentials and role of administrators, teachers, students, and parents.
• Subscription, demo period, invoices, and payment status (not full card numbers; those are handled by the payment gateway).

4.3 Data the school enters (processed on the school’s instructions)

• Student and parent details, admission and enrolment, class/section, attendance, leave, fees and receipts, exam marks and report cards.
• Teacher and staff details, timetable, leave, and payroll-related records the school chooses to store.
• Messages, notices, homework, admissions applications, library/lab records, photos or documents the school uploads.
• RFID or QR identifiers linked by the school to a person for attendance gates.

4.4 Optional modules

If the school enables SMS, WhatsApp, email campaigns, AI assist, or online payments, additional data needed for that module (mobile numbers, message content, AI prompts, payment references) is processed for that purpose only.

5. Children’s personal data

Most student users of ClassUps are children (under 18 years) under the DPDP Act. We do not use children’s data for advertising, sale of data, or behavioural profiling for marketing. We do not track children across other websites for ads.

Operational features such as attendance, exams, fees, and parent notices are provided only because the school (as Data Fiduciary) instructs us to run its campus. The school is responsible for notices to parents/guardians and for verifiable parental consent where the DPDP Act requires it. Parent and student logins exist so the school can involve families in education administration — not so we can market to children.

6. How we use information

We use personal data to:

• Provide, host, secure, and support the ClassUps service the school has subscribed to (or is trialling).
• Create and authenticate logins, apply role-based access, and prevent abuse or unauthorised access.
• Send operational messages the school initiates (fee reminders, attendance alerts, notices) through channels the school enables.
• Process subscription payments and issue GST-compliant invoices where applicable.
• Respond to inquiries, demos, and support requests.
• Improve reliability (error logs, aggregated usage that does not sell student profiles).
• Comply with Indian law, court or government orders, and tax or audit requirements.

We do not sell student, parent, or staff personal data to advertisers or data brokers.

7. Sharing and processors

We share personal data only as needed to run the service:

• The school’s authorised users — according to roles the school assigns.
• Payment gateway (for example Razorpay) — to collect fees or subscription amounts. Card data is handled by the gateway under RBI-authorised payment rules; we store payment references and status, not full card PANs.
• SMS / WhatsApp / email providers configured for the platform — to deliver messages the school or we send. The school must follow TRAI TCCCPR (DLT templates, promotional vs transactional) and Meta/WhatsApp rules where those channels are used.
• AI providers (when the school enables AI features) — prompts and drafts may be sent to the configured model. Schools should avoid unnecessary student identifiers in AI prompts.
• Hosting, backup, and email delivery vendors acting as our processors under contract and reasonable security.
• Law enforcement or regulators when Indian law requires disclosure.

If processing involves a server or vendor outside India, we do so only as permitted under the DPDP Act (including any government restriction on transfer to specified countries) and with appropriate safeguards.

8. Cookies and similar storage

We use cookies and browser storage to operate the website and the platform:

• Essential — session login, CSRF/security tokens, and an optional “save login on this device” cookie for up to 60 days when you choose it at sign-in. These are required to use the service.
• Preference — display theme, only if you accept optional cookies in our banner. Language is kept in your essential session (and your account, when signed in).

You can accept all cookies or essential-only via the banner on this website and sign-in pages. Blocking essential cookies will prevent sign-in. We do not use third-party advertising cookies on the ClassUps marketing site.

9. Retention

• Inquiry and sales records — kept as long as needed to respond and for a reasonable period for follow-up, tax, or dispute handling.
• School platform data — retained for the life of the school’s account and thereafter as the school’s instructions, backup cycles, and Indian education/tax record-keeping may require. Schools can export data and should take backups before year-end or cancellation.
• Security logs — kept for a limited period to investigate incidents.
• When an account is closed we delete or anonymise personal data we control, except where law requires us to keep it.

10. Security

We use role-based access, encrypted transport (HTTPS) in production, hashed passwords, and access limited to personnel who need it for support or operations. No method of transmission or storage is perfectly secure. Schools must use strong passwords, assign roles carefully, keep device firmware and API keys private, and take regular backups.

Personal data breaches will be handled as required under the DPDP Act and applicable IT law, including informing the school (for school-held data) and authorities where mandated.

11. Rights of Data Principals

Depending on whether we or the school is the Data Fiduciary, you may have rights under the DPDP Act to:

• access a summary of personal data and processing activities;
• correct, complete, or update inaccurate data;
• erase data that is no longer necessary for the stated purpose, subject to legal retention;
• withdraw consent where processing is based on consent;
• nominate a person to exercise rights in case of death or incapacity, where the Act so provides;
• grievance redressal, and a complaint to the Data Protection Board of India after exhausting our (or the school’s) grievance process.

To exercise rights in school records, write to your school first. To exercise rights in data we hold as Data Fiduciary (inquiries, our billing, our logs), use the grievance details below.

12. Grievance officer

In line with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you may contact our Grievance Officer:

• Designation: Grievance Officer, ClassUps (AakarLab)
• Email: use the form on our contact page
• Address: India

We will acknowledge a written complaint within 72 hours where practicable and aim to resolve it within 15 days, or within any longer period allowed by applicable law. If you are not satisfied, you may approach the Data Protection Board of India or other competent authority.

13. Changes

We may update this policy when the product or Indian law changes. The “last updated” date on this page will change. Continued use of the public website or the platform after an update means you have read the revised policy. Material changes affecting schools will be notified through the platform or registered email where practical.

14. Contact

Privacy questions: Contact us. Governing law: India. Correspondence and notices relating to this policy may be sent to the address above (India).

AakarLab / ClassUps provides this notice to explain our practices. Schools remain responsible for their own privacy notices to parents, students, and staff.