Privacy
What we store, who can see it, and how to control it.
Plain-English summary first, then the details. Campustics is built for Indian schools and aligned with the Digital Personal Data Protection Act (DPDP) 2023.
Who controls your data
Each school (the organisation that signed up) is the data controller for the records of its students, parents, and staff. Campustics is the data processor — we host and operate the platform on the school's behalf. We never sell, share, or use school data for anything other than running the platform for that school.
What we collect
Only what's needed to run the school's day-to-day operations: student records (name, code, class, attendance, marks, fees), parent contact details (name, phone, email) so the school can reach them, staff profiles, and the actions an authenticated user performs (for audit trail). No tracking pixels, no advertising cookies, no third-party analytics on the parent / student portals.
Who can see what
Strictly permission-based. A parent sees only their own children. A teacher sees only the classes they teach (and their assigned subject's bank of questions). A school admin sees only their school. Org admins see roll-ups across the schools in their organisation. Campustics support staff do not have access to school data and only see anonymised metrics.
Cross-school isolation
Every database row carries both an organisation id and a school id. Every service call checks both before reading or writing. A user belonging to School A cannot list, search, or print data belonging to School B — enforced in code, not just UI.
Where data lives
Application servers run on Vercel (Mumbai / Singapore edge). The database is Neon Postgres in AWS Mumbai. Email goes through Resend; SMS through Fast2SMS or MSG91; payments through Razorpay. We hold backups for 30 days in line with Neon's policy.
AI features
AI is opt-in per deployment. When enabled, two surfaces use it: (1) the question-paper generator sends only academic prompts (no PII), and (2) the parent chatbot grounds answers in your child's record (first name + the same numbers the school already shows you). When AI is off, both features degrade gracefully to deterministic stubs.
Your rights
Parents and students can ask their school's office for a copy of all their stored data, correction of inaccuracies, or deletion of records subject to retention rules (e.g. financial records held for 8 years). Schools can export full CSVs on demand from /students and the audit log. For a Campustics-level request, write to privacy@campustics.com and we will route it to the relevant school.
Cookies
We set one cookie: an authentication session token (HTTP-only, secure, SameSite=Lax) so you stay signed in. The locale switcher writes a second cookie (NEXT_LOCALE) so the UI remembers your language. That's the entire cookie surface.
Changes to this notice
We will publish material changes 30 days before they take effect, with an email to org admins. The latest version is always at /privacy.
Last updated: 2026-05-23. Questions: privacy@campustics.com.