What we store, who can see it, and how to control it.

Each school (the organisation that signed up) is the data controller for the records of its students, parents, and staff. Campustics is the data processor — we host and operate the platform on the school's behalf. We never sell, share, or use school data for anything other than running the platform for that school.

Only what's needed to run the school's day-to-day operations: student records (name, code, class, attendance, marks, fees), parent contact details (name, phone, email) so the school can reach them, staff profiles, and the actions an authenticated user performs (for audit trail). No tracking pixels, no advertising cookies, no third-party analytics on the parent / student portals.

Strictly permission-based. A parent sees only their own children. A teacher sees only the classes they teach (and their assigned subject's bank of questions). A school admin sees only their school. Org admins see roll-ups across the schools in their organisation. Campustics support staff do not have access to school data and only see anonymised metrics.

Every database row carries both an organisation id and a school id. Every service call checks both before reading or writing. A user belonging to School A cannot list, search, or print data belonging to School B — enforced in code, not just UI.

Application servers run on Vercel (Mumbai / Singapore edge). The database is Neon Postgres in AWS Mumbai. Email goes through Resend; SMS through Fast2SMS or MSG91; payments through Razorpay. We hold backups for 30 days in line with Neon's policy.

AI is opt-in per deployment, and which features use it is a per-deployment setting — ask your school which it has enabled. Where it is on: (1) Question, paper and import tools send the teaching material a teacher uploads — the text of a document, and for scanned PDFs or photographs the page images themselves — along with existing question text, answers and options when questions are being enriched. That is school material, not student records. (2) The parent chatbot and (3) report-card remark drafting work from a student's or parent's personal information — your question, your child's name, marks, attendance and fees. That information is never sent to an outside AI service: these two features use AI only when the school runs its own AI model on its own infrastructure, and otherwise answer, or draft, from templates generated on our own servers. A teacher edits and approves every remark before it is published. This describes what the code sends today rather than a permanent guarantee. Schools wanting more detail before enabling AI should ask us directly rather than rely on this summary being exhaustive.

Parents and students can ask their school's office for a copy of all their stored data, correction of inaccuracies, or deletion of records subject to retention rules (e.g. financial records held for 8 years). When a family applies for admission and the child does not join, the documents and form answers they sent are deleted six months after the school closes the enquiry; only the last four digits of an Aadhaar number are ever asked for. Schools can export full CSVs on demand from /students and the audit log. For a Campustics-level request, write to privacy@campustics.com and we will route it to the relevant school.

We set one cookie: an authentication session token (HTTP-only, secure, SameSite=Lax) so you stay signed in. The locale switcher writes a second cookie (NEXT_LOCALE) so the UI remembers your language. That's the entire cookie surface.

We will publish material changes 30 days before they take effect, with an email to org admins. The latest version is always at /privacy.