Student data is among the most sensitive data any institution holds, and it belongs to people who cannot consent for themselves. Under India’s Digital Personal Data Protection Act, processing a child’s data requires verifiable parental consent and prohibits tracking and behavioural monitoring directed at children — which rules out several features vendors market.
This is a practical summary, not legal advice. Rules and their enforcement are still developing; take advice on your own obligations.
A school holds more sensitive information about a child than almost any other institution: where they live, who collects them, their health conditions, their family’s financial position, their academic record, and increasingly their location during the school day.
It holds all of it about people who cannot meaningfully consent, for purposes those people did not choose, and it holds it for years. That combination is why the standard here should be higher than for ordinary customer data, and why several things that are normal in consumer software are not acceptable in a school.
The Act treats anyone under eighteen as a child and applies stricter rules to their data. For a school, several consequences follow directly.
The single most common gap we find in school admission forms is one blanket agreement covering everything. It does not establish agreement to anything in particular, and it collapses the moment a parent objects to one specific thing.
Each recorded with a date, so a withdrawal later has something specific to act against.
The school remains accountable for data it hands to a vendor, so these belong in the contract rather than in a sales conversation.
Two specific risks arise when AI is applied to data a school already holds legitimately.
Purpose creep. Attendance is collected to run a register. Using it to build a behavioural profile is a new purpose, and consent for the first is not consent for the second — even though no new data was collected.
Inference about children. A model that scores a child on likely performance, or a family on likely payment, creates sensitive new information that did not exist before and that nobody consented to. Whether such profiling is permissible where children are concerned is precisely the ground the DPDP Act’s restrictions cover, and it is a good reason not to build it regardless.
We hold no security certifications and do not claim any. What is listed above is what we actually do, and it is checkable.
Phrased the way they arrive, answered so each one stands on its own.
For communication necessary to run the school, the basis is generally the school relationship itself. Where a third-party channel such as WhatsApp is used, that involves another processor and is worth recording as a separate, specific consent.
Biometric data about children is about as sensitive as it gets, and provisions restricting tracking and behavioural monitoring of children bear directly on it. Take proper advice before deploying it. A card or an app achieves the same register at a fraction of the risk.
Academic records legitimately last for decades, because certificates get requested years later. Operational data such as gate logs, bus locations and message delivery receipts does not, and keeping it indefinitely is a liability with no benefit.
No, and we do not claim to be. The practices listed above are what we actually do. We would rather state that plainly than display a badge we have not earned.
Checked by the Product desk on 7 September 2026. Corrections go in the page, dated, rather than quietly.
Pricing is on the page, in the open, with the counting rule written next to it. Nobody has to book a call to find out what it costs.
See pricingForty minutes with an implementation engineer — your classes, your fee heads, your grading scheme, entered as we go. No slides, no sample school.