Privacy Policy
Version 1.0 · Effective 6 October 2026
This Privacy Policy explains how Infovion Technologies ("Infovion", "we", "us") handles personal data in connection with the Infovion school management platform at https://app.infovion.in and our website https://infovion.in. It is written to meet the Digital Personal Data Protection Act, 2023 and the rules under it ("DPDP law"), and the Information Technology Act, 2000 and its rules.
1. Who is responsible for your data
If you are a student, parent/guardian, teacher or staff member of a school that uses Infovion: your school decides what data is collected and why. The school is the Data Fiduciary and Infovion is its Data Processor — we store and process that data only on the school's behalf and on its instructions. For questions about your data, or to exercise your rights, please contact your school first. If you cannot reach your school, write to our Grievance Officer (section 10) and we will forward your request to the school and help it respond.
For data about school staff who sign up, buy or administer our subscription, website visitors, and people who contact us, Infovion is the Data Fiduciary.
2. Data we process for schools
Depending on the features a school uses:
| Category | Examples |
|---|---|
| Student records | name, admission/G.R. number, class and section, roll number, date and place of birth, gender, photograph, previous school, mother tongue, nationality, religion and caste category (only where the school records them), blood group, address, Aadhaar number (only where the school chooses to record it) |
| Parent/guardian data | names, mobile numbers, email, occupation, relationship, login account |
| Academic data | attendance, timetables, examination marks and results, report cards, promotions, certificates issued (transfer/leaving, bonafide, character) |
| Fee data | fee plans, concessions, amounts due and paid, receipts, opening balances; online payment references from the payment gateway (we never see card or UPI PINs) |
| Staff data | names, contact details, roles, staff attendance, leave, salary structure and payslips (where used) |
| Transport data | route, stop, pickup/drop times, transport fees, daily boarding marks (boarded / dropped / absent); driver and attendant details and their documents (licence, police verification); the location of the bus, taken from the phone of the driver/attendant only while a trip is running |
| Communication | messages between parents and teachers, announcements, in-app notifications |
| Account & security data | login identifiers, password hashes, sign-in events, IP address, device/browser type, audit logs of actions |
We do not collect the live location of children. Bus location is the location of the crew phone during a trip; it is shown only while the trip is in progress and is erased from the trip record when the trip ends.
3. Children's data
Most student data relates to children. Under DPDP law the school must obtain verifiable consent of the parent or lawful guardian, except where an exemption applies (for example, processing by educational institutions for educational activities or the safety of children). Infovion:
- processes children's data only to provide the school's services;
- does not carry out tracking, behavioural monitoring or targeted advertising directed at children, and shows no advertisements;
- does not sell or rent personal data;
- does not use children's data in a way likely to cause a detrimental effect on their well-being.
4. Purposes
We process personal data to: provide and operate the Service for the school; authenticate users and keep accounts secure; send service messages (sign-in codes, password resets, receipts, transport and other notifications the school enables); provide support; maintain backups and recover from incidents; detect and prevent fraud and abuse; comply with law; and, for our own customers, manage contracts, invoicing and payments. We use aggregated, de-identified statistics to improve the Service.
5. Sharing
We share personal data only with:
- the school that controls it (and, within the school, with users the school authorises — e.g. teachers see their classes, parents see their own children);
- sub-processors that host or support the Service, under written terms requiring confidentiality and security — see the list of sub-processors;
- authorities where required by law, court order or for the investigation of cyber incidents (e.g. CERT-In), after informing the school where lawful;
- a successor in a merger or acquisition, under the same protections.
6. Where data is stored
Our application servers and database are hosted in Singapore. Some sub-processors (email delivery, file storage, content delivery) may process data in other countries such as the United States or the European Union. Transfers are made under contractual safeguards and only to countries not restricted by the Government of India under section 16 of the DPDP Act.
7. How long we keep data
We keep Customer Data for as long as the school's subscription is active and the school keeps it. Specific periods applied automatically by the Service include: attendance and bus-trip records — 12 months; audit logs — 6 months; in-app notifications — 90 days; bus location — until the trip ends. When a school leaves, its data is available for export for 30 days and then permanently erased, including uploaded files. Details are in our data retention schedule, available on request.
8. Security
We protect data with encryption in transit (HTTPS/TLS), salted password hashing, role-based access, strict separation of each school's data, sign-in rate limiting and lock-out, short-lived access tokens, audit logging, and restricted administrative access protected by a second factor. No system is perfectly secure; if a personal data breach occurs we will act under our incident response plan and notify the school, which will inform affected persons and the Data Protection Board of India as required.
9. Your rights
Under DPDP law you have the right to: obtain a summary of your personal data and how it is processed; correct, complete or update it; have it erased where it is no longer needed for the purpose or consent is withdrawn (subject to records the school must keep by law, such as admission registers and transfer certificates); withdraw consent; nominate a person to exercise your rights in case of death or incapacity; and have your grievances redressed.
Please make requests to your school. Requests that reach us are forwarded to the school promptly and we help it respond. We will respond to requests about data for which Infovion is the Data Fiduciary within 30 days.
10. Grievance Officer
Name: Sankalp Deshpande Email: contact@infovion.in Address: 1306/T3, Godrej Green Vistas, Tower 3, Nande–Balewadi Road, Mahalunge, Pune, Maharashtra 411045, India
We acknowledge grievances within 48 hours and aim to resolve them within 15 days (see the Grievance Redressal Policy). If you are not satisfied, you may complain to the Data Protection Board of India.
11. Cookies
We use only cookies needed to keep you signed in and secure; we do not use advertising or analytics trackers. See the Cookie Policy.
12. Changes
We will post changes here with a new effective date and, for material changes, notify schools by email at least 30 days in advance.
13. Contact
Infovion Technologies · 1306/T3, Godrej Green Vistas, Tower 3, Nande–Balewadi Road, Mahalunge, Pune, Maharashtra 411045, India · contact@infovion.in