Privacy Policy

1. Overview

ZenCampus ("we", "our", or "us") is school management software used by schools, their staff, and parents. This Privacy Policy explains what information we collect, how we use it, who we share it with, and how we keep it safe.

Your school decides what student, parent, and staff information goes into ZenCampus and why. We hold and use that information on the school's behalf and follow its instructions. Section 9 explains what this means under India's Digital Personal Data Protection Act, 2023.

By using ZenCampus, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information Schools Provide

School and staff data:

• School name, address, campuses, and official contact details
• Staff names, phone numbers, email addresses, employee code, designation, department, joining and leaving dates, emergency contact, and photo
• Staff attendance check-ins, shifts, corrections, and leave requests (including medical leave)
• Staff location at check-in - only if the school turns on this optional setting. It is off by default, and the school must tell its staff before using it. We do not collect fingerprints or any other biometric data for staff attendance
• Staff who do not sign in, such as drivers and housekeeping staff, may also be recorded

Student records (entered by the school):

• Full name, admission number, date of birth, gender, nationality, class, section, roll number, and photo
• Aadhaar number - optional. Schools may also upload ID documents
• Blood group, medical notes, and other notes the school chooses to enter
• Permanent and current address, and emergency contact details
• Attendance, grades, report cards, and academic progress notes
• Homework submissions, marks, and teacher feedback
• Leave requests, certificates, and enrolment details such as class assignment and student status

Student welfare and discipline:

• Suspensions and the reasons for them
• Follow-ups for students with low attendance, including notes from home visits

Exams:

• Exam roll numbers, seating plans, and exam hall attendance
• Eligibility checks, such as attendance percentage and fees due
• Exam accommodations, such as extra time or a separate room. These can reveal a student's health condition or disability, so schools should record only what is needed

Parent and guardian data:

• Full name, relationship to the student, phone number, alternate phone, and email address (used for account access and WhatsApp messages)
• Occupation, annual income, qualification, and photo
• Whether the guardian is allowed to collect the child, and whether they are an emergency contact

Parent-teacher meetings:

• Meeting bookings and agreed action items
• Teacher notes on learning, behaviour, and parent concerns. These stay private unless the teacher chooses to share them

Financial data:

• Fee category configuration and per-student fee amounts
• Payment amounts, dates, modes, and receipt references
• Fee waivers, discounts, and outstanding balances
• Online payments go through Razorpay into the school's own Razorpay merchant account. We send the student's name to Razorpay so the payment can be identified. We store the payment reference numbers, status, amount, payment method type, fees and tax, any failure reason, and the bank reference or settlement number. Razorpay's payment notifications are stored as we receive them and may include the payer's contact details. We never store full card numbers, CVV, or bank account numbers

Admissions enquiries (prospective students who are not yet enrolled):

• Applicant's name, date of birth, gender, class applied for, and previous school
• Parent/guardian name, relationship, phone, alternate phone, email, and address
• Quota type (including RTE), links to siblings or referrals, and answers to the school's own enquiry form questions
• Entrance test results, and notes from calls and visits
• Supporting documents and application fee payments

Transport data (where your school uses the transport module):

• Student route and stop allocation, and boarding and drop-off records
• Static stop locations and vehicle details (registration, insurance, fitness and permit expiry, and an optional GPS device ID)
• For drivers and transport attendants: licence details, police verification status, and medical check dates
• Trip records and odometer readings
• Daily transport opt-outs and the reasons given
• Incident reports, which may include photos
• We do not track the live GPS location of vehicles or children

Messages:

• For each WhatsApp message: the recipient's number, the message template, and the details filled into it (such as the text of an announcement). We keep these to send the message, retry it if needed, and show delivery history

Certificates and shareable links:

• Documents we issue on your school's behalf - such as bonafide, transfer, character, and study certificates, and fee receipts - are stored in our systems so they can be verified
• Each certificate has a QR code. Anyone who scans it or has the link can see the holder's name, certificate number, issue date, validity, and school name
• Fee payment links open without signing in and show the school name, the child's name, the amount due, and the receipt. Share them only with the person paying

2.2 Information Collected Automatically

• Audit log entries for important actions: who acted (user and role), what they did, which record it affected, when, the IP address, and the browser or device type
• IP addresses, used to limit repeated sign-in attempts and requests
• Error reports that help us find and fix problems (see Sentry in Section 5.1)
• Mobile push notification tokens - only if you allow notifications in the ZenCampus app, and used only to send them

2.3 Mobile App

• You can choose to unlock the app with Face ID or your fingerprint. This check happens on your device. No biometric data reaches us
• Your sign-in session is stored on your device
• The app does not access your camera, photo library, or location, and it has no analytics or advertising trackers

2.4 Website Visitors

Our public website, zencampus.org, is separate from the school portal. When you fill in a demo or contact form there, we collect your name, role, email address, phone number, school name, city, school size, and message. We store this with Supabase and email it to our team through Resend, so we can reply to you. The website also uses Google Analytics to understand how visitors use it (see Section 10).

3. How We Use Your Data

• Provide, operate, and maintain ZenCampus platform services
• Send notifications - including fee reminders, attendance alerts, and school announcements - by WhatsApp (through the school's own WhatsApp Business account), as in-app alerts, and as mobile push notifications in the ZenCampus app (where you allow them). We do not send these by email or browser push
• Process fee payments, generate receipts, and maintain financial records
• Keep audit logs of important actions, which users cannot edit, for accountability
• Respond to support requests and fix problems
• Understand how visitors use our public website, using Google Analytics. The school portal and mobile app have no analytics or advertising trackers
• Comply with legal obligations

We never use student data for advertising, targeted marketing, or resale. Automatic checks such as low-attendance flags and exam eligibility are produced only for the school's own staff.

4. Who Can See What

Each person sees only what their role needs. Access is checked on our servers and by the database.

• Super Admin - the school owner or director. Sees all campuses. Only a Super Admin can create staff accounts and change roles
• Principal - the campuses assigned to them, and can edit the timetable
• Teacher - their assigned classes: attendance, grades, and homework. Can view the timetable and apply for their own leave
• Admissions Officer - admissions enquiries and new student admissions
• Finance Officer - fees, payments, and receipts
• Transport Manager - vehicles, routes, allocations, trips, and incidents for their assigned campuses. No access to admissions, fees, or staff records
• Parent - their own linked children only. Can pay fees, submit homework, book parent-teacher meeting slots, request certificates, apply for leave, and opt out of transport. Cannot change school records
• ZenCampus staff - authorised members of our team can sign in to a school's account, export its data, or reset its Super Admin's password, to provide support or keep the service secure. Each sign-in is recorded in our platform log with the staff member's name and the time

Students do not have accounts. ZenCampus sets a limit on how many accounts each role can have in a school, and the school cannot raise it.

5. Data Sharing

5.1 Service Providers

We use trusted service providers who handle data only to run ZenCampus for you. Current providers:

• Cloudflare - hosts and runs the ZenCampus app on Cloudflare's network, including school-specific web addresses.
• Supabase - database, sign-in, and file storage.
• Meta (WhatsApp Cloud API) - sends attendance alerts, fee reminders, and school announcements to parents, through each school's own WhatsApp Business account and Meta-approved templates. Meta receives the recipient's number and the message to deliver it. We store the recipient's number, the template, and the details filled into it, so we can send, retry, and show delivery history.
• Razorpay - an RBI-authorised payment gateway. Payments go into the school's own Razorpay merchant account and settle to the school's bank. ZenCampus never holds the money and takes no commission. Razorpay collects card, UPI, and bank details directly, and receives the student's name to identify the payment. ZenCampus never stores full card numbers, CVV, or bank account numbers.
• Expo - delivers mobile push notifications (a title and message) to the ZenCampus app.
• Sentry (EU region) - error reports. Before a report is sent, labelled personal fields such as names, emails, phone numbers, and addresses are removed, along with request contents and cookies. Reports can still include internal account IDs, the school ID, and the address of the page where the error happened.
• Google Fonts - the portal loads an icon font from Google, so Google receives your IP address when the page loads.
• OpenStreetMap - shows the campus map on the School Details page. Your browser loads the map from OpenStreetMap, which receives your IP address.
• Upstash - may be used to limit repeated requests, based on IP address.
• Google Analytics - public website only. Not used in the school portal or mobile app.
• Resend - emails demo and contact form submissions from our public website to our team. Website forms only.

5.2 Where Data Is Stored

School data is stored with Supabase and served through Cloudflare. Error reports are stored with Sentry in the EU. Some of our providers may handle data outside India.

5.3 Legal Disclosure

We may disclose information if required by law or valid requests by public authorities. We will notify your institution prior to disclosure unless legally prohibited.

5.4 Business Transfers

In the event of a merger or acquisition, we will notify affected institutions at least 30 days in advance and provide an option to export and delete data.

6. Data Retention

We keep your school's data while your subscription is active. You can export it at any time (see Section 8).

• Account closure - we keep your data for 90 days after the account is closed, then permanently delete it. During those 90 days, we can prepare a full export for you on request
• Missed payments - if a payment fails, there is a 7-day grace period. After that, the subscription is paused and the school is suspended, so no one can sign in. Your data is not deleted because of a suspension
• Admissions enquiries - for enquiries that are rejected, lost, or duplicates, documents are deleted 12 months after the enquiry closes, and contact details are anonymised after 24 months
• WhatsApp messages - queued messages are removed 30 days after they are created, or 90 days if sending failed. Delivery history, including message details, is kept for the life of the account
• Audit logs - kept for up to 1 year on Essential and Plus plans, and up to 2 years on Complete and Enterprise plans, then removed. A Super Admin can choose a shorter period (at least 7 days)
• Password reset codes - deleted one day after they expire
• Data exports - export files can be downloaded for 30 days
• Archived students - stay on record until the school deletes them or the account is closed

7. Security

• All traffic to and from ZenCampus uses HTTPS
• Stored data is encrypted by our database provider, Supabase. We add our own AES-256 encryption for payment gateway keys and WhatsApp access credentials
• Every request is tied to the signed-in user's school, and database rules also block reading another school's data
• ZenCampus staff accounts support two-factor sign-in
• Regular internal security reviews
• Daily automated backups by our database provider
• Authorised ZenCampus staff can sign in to your school's account, export its data, or reset your Super Admin's password, to provide support or keep the service secure. Each staff sign-in is recorded in our platform log

In the event of a confirmed data breach, we will notify your school within 72 hours.

8. Your Rights

• Access - request a copy of personal data we hold
• Correction - update inaccurate or incomplete data
• Erasure - request deletion of your data
• Portability - every plan can export records as CSV files, module by module. Plus and higher plans can also download a full archive (CSV or JSON) and schedule regular backups. Exports include your records, not uploaded files such as photos and documents. Export files can be downloaded for 30 days. After your account is closed, we can prepare a full export on request within the 90-day period
• Account closure - request deletion of your school's data or full account closure. A deletion request made from the Backup & Data screen needs a completed export first. ZenCampus then carries out the deletion
• Opt-out - unsubscribe from marketing communications anytime

To exercise any right, contact hello@zencampus.org. Parents and staff can also ask their school. We acknowledge requests within one business day and resolve them within 30 days.

9. India's DPDP Act

Under India's Digital Personal Data Protection Act, 2023, your school is the Data Fiduciary: it decides what personal data is collected and why. ZenCampus is the Data Processor: we handle that data on the school's behalf and follow its instructions.

• Withdrawing consent - where your school relies on your consent, you can withdraw it by contacting the school. We will act on the school's instructions. Withdrawing consent does not affect anything done before you withdrew it
• Nominating someone - you can nominate another person to exercise your rights if you die or are unable to act for yourself
• Grievance Officer - contact hello@zencampus.org. We acknowledge grievances within one business day and resolve them within 30 days
• Complaints - if you are not satisfied with how your grievance was handled, you can complain to the Data Protection Board of India

10. Cookies

• School portal and mobile app - set no cookies. The portal keeps your sign-in session and preferences in your browser's local storage. The mobile app keeps them on your device
• Public website - Google Analytics sets cookies on zencampus.org to help us understand how visitors use the site. You can block or delete them in your browser settings

We do not use advertising cookies.

11. Children's Privacy

ZenCampus is a B2B platform sold to schools, not directly to students. Students do not hold user accounts on the platform - their records are managed by the school. Parents/guardians are the registered users who can view their child's data, and homework is submitted by parents on the child's behalf. As the Data Fiduciary, the school is responsible for obtaining any parental consent required under applicable law (including the DPDP Act) before entering student data. We process that data only on the school's behalf.

Sensitive student data - including Aadhaar numbers, medical notes, blood group, and exam accommodations - should only be entered when the school genuinely needs it, and must be handled in line with applicable data protection law.

12. Policy Changes

When we make material changes, we will notify the primary school administrator via email at least 14 days before they take effect. Continued use of ZenCampus after changes constitutes acceptance of the revised policy.

13. Contact Us

• Privacy, grievances, and general: hello@zencampus.org
• Phone: +91 79891 82434 (Mon–Fri, 9am–6pm IST)