Data & Privacy — Shaswat SchoolOs

Who is responsible for what

Under the Digital Personal Data Protection Act, 2023, your school is the Data Fiduciary — it decides what data is collected and why. Shaswat SchoolOs is a Data Processor: we hold and process that data on the school's instructions, and we do not decide its purpose.

That distinction matters for parents: requests about a child's records go to the school, and the school can action them in the product. We support the school; we do not sit between a parent and their school.

Children's data

Under DPDP, anyone under 18 is a child. Processing a child's data requires verifiable parental consent, and the Act places an absolute bar on tracking, behavioural monitoring, and targeted advertising directed at children.

Things we do not do, by design:

We do not run behavioural or attention tracking on children.
We do not serve advertising of any kind — targeted or otherwise.
We do not sell, rent, or broker student data. There is no data-monetisation product.
We do not build advertising or marketing profiles from student records.
We do not use one school's student data to serve another school.

Artificial intelligence — exactly what leaves our servers

Some features draft text using a large language model operated by a third party (currently openrouter). Three things are true of every such request:

Structured identifiers are stripped before the request leaves our servers. Email addresses, phone numbers, Aadhaar/APAAR numbers and PAN are automatically redacted by pattern-matching. Our AI features are additionally written to work from role and context — a class, a subject, a relationship — rather than a child's name, to keep personal names out of the prompt in the first place.
Every request is logged for audit — purpose, timestamp, and a hash of the prompt. We store the hash, never the prompt text.
Output is a draft for a human. No AI output is acted on automatically; a teacher, administrator or counsellor reviews it.

Teaching material is shared between schools; student data never is. A lesson plan for "Class 8 Science, Chapter 3" is the same everywhere, so we generate it once and reuse it. That reuse is limited to curriculum content, and two schools can only ever share a result when their requests were byte-for-byte identical — so anything school-specific is never shared.

Current limitation — stated plainly. Features that analyse individual student patterns (attendance risk, counselling prioritisation, wellbeing signals) currently run on a free-tier model whose provider may retain prompts. For that reason these features are not enabled for any live school and are exercised only against demonstration data. They will be moved to a paid model with a no-retention, no-training agreement before any real student record is processed by them. This page will be updated when that is done — not before.

Where data lives, and who else touches it

Data residencyHosted in India.

Tenant isolationEach school's records sit in a separate database, not a shared table with a school column.

Sub-processorsCloud hosting; the AI provider named above; payment, SMS/WhatsApp and email gateways your school chooses to enable.

Government systemsData is exchanged with DigiLocker, UDISE+ and NSP only where your school is legally required to file it, or asks us to.

RetentionRecords are kept while a school is a customer and for the statutory period afterwards. Per-school self-service retention controls are on our roadmap, not yet available in the product.

Security — including what we have not done

Access is role-based and scoped per school. Administrative actions are recorded in an audit log. Platform billing and pricing screens are restricted to the platform owner.

We are not certified yet. Shaswat SchoolOs does not currently hold ISO 27001 or SOC 2. An accredited auditor has been engaged and our ISO 27001:2022 certification process has begun; until the certificate is actually issued, we will not display a badge for it. If a vendor shows you a security certificate, check its expiry date and version — a withdrawn standard is not a certification.

Grievance Officer, and requests about a child's data

Parents and students: please contact your school — as Data Fiduciary, it holds the relationship and can action requests directly in the product.

Schools, DPOs and regulators: contact our Grievance Officer, designated under the DPDP Act to receive and act on data-protection queries and grievances.

Grievance OfficerOffice of the Data Protection & Grievance Officer, Shaswat SchoolOs

Emailgrievance@shaswatschoolos.in

AcknowledgementWe acknowledge grievances within 72 hours and aim to resolve within 30 days.

If there is a data breach

On becoming aware of a personal data breach, we notify the affected school (the Data Fiduciary) without undue delay and, in any case, within 72 hours — describing the nature and likely scope of the breach, the records affected, and the remediation underway. The school, as Fiduciary, notifies the Data Protection Board of India and affected individuals as the Act requires; we provide the logs, timeline and support needed to do so.