Privacy Policy

1. Data Collection

We collect information necessary to operate the Aksharum platform across five user roles: Super Admin, School Admin, Teacher, Student, and Parent.

• Information you provide directly: Names, email addresses, phone numbers, role designations, and institutional details entered during onboarding or everyday use.
• Automatically collected data: Session information, login timestamps, IP addresses, and browser type to secure accounts and improve the platform.
• Academic & institutional data: Attendance records, exam results, aptitude scores, fee payments, salary slips, leave balances, timetables, documents, and assignment submissions.
• Communication data: Messages and notifications sent through the Communication and Notification modules, including real-time SSE alerts and system-generated emails.

2. Types of Data

The following categories of personal data may be processed depending on which modules your school has activated:

3. Use of Data

Aksharum uses collected data exclusively to deliver, maintain, and improve our school management services. We do not use your data for advertising.

• Platform operation: Processing attendance, results, fees, salary slips, leave approvals, and timetables as requested by authorised users.
• Authentication & security: Verifying identity via sessions, JWT magic login links, and OTP password resets.
• Notifications: Delivering real-time SSE alerts and emails for results, attendance flags, leave approvals, and system events.
• Reporting & exports: Generating PDF and XLSX reports for results, attendance, fees, and salary slips via PDFKit and xlsx.
• Anti-cheat monitoring: Recording violation events during timed aptitude exams to maintain academic integrity.
• Platform improvement: Anonymised, aggregated analytics to identify bugs and improve performance.

4. Multi-Tenancy & Data Isolation

Aksharum is a multi-tenant platform — multiple schools share infrastructure but each school's data is completely isolated.

• Tenant scoping: Every record is tagged with a school identifier. No query can return data outside the authenticated school's scope.
• Super Admin limits: Our Super Admin can manage school configurations but cannot access academic records, student data, or financial data within individual school tenants.
• Module isolation: Schools that have disabled specific modules do not have that data collected or stored on their behalf.
• No cross-tenant sharing: Student results, attendance, salary slips, and documents from one school are never visible or accessible to any other school on the platform.

5. Role-Based Access Control

Aksharum enforces strict RBAC across all five user roles. Each role can only access data relevant to their function.

• Super Admin: Platform-wide school configuration and module toggling only. No access to student, teacher, or financial records.
• School Admin: Full access to all data within their own school tenant — students, teachers, results, fees, salary slips, documents, and reports.
• Teacher: Attendance marking, result entry for assigned subjects, exam creation, leave requests, and document sharing for their classes.
• Student: Access only to their own academic records — personal results, exam attempts, submitted assignments, and notifications addressed to them.
• Parent: View-only access to their linked child's attendance, results, fee status, and documents shared with their child's class.

6. Third-Party Services

Aksharum uses a limited set of third-party services necessary to operate the platform. These providers are bound by data processing agreements.

• Nodemailer / Email SMTP: Used to send system-generated emails including magic login links, OTP codes, result notifications, and fee receipts.
• Cloud storage: Uploaded documents — notes, assignments, circulars, salary files — are stored securely and only accessible by users with appropriate permissions.
• MongoDB Atlas: All structured data is stored in MongoDB, encrypted at rest and in transit. Atlas is ISO 27001 certified.
• Anonymised analytics: We may use aggregated, non-identifiable analytics to understand platform usage. No personally identifiable information is included.

We do not integrate advertising networks, social media tracking, or any tools that collect student or parent data for external purposes.

7. Data Security

We implement multiple layers of security to protect your data across Aksharum.

• Authentication: Session-based auth with HTTP-only cookies, JWT magic login links with expiry, and OTP-based password reset — no plain-text passwords stored.
• Encrypted transmission: All data between your browser and our servers is encrypted via HTTPS/TLS.
• Database encryption: Data at rest is encrypted. Database access is restricted via IP allowlisting and authenticated connections.
• File upload security: Files are validated for type and size via Multer. Documents are stored with access controls.
• Exam anti-cheat: Violation events are logged server-side. Exam sessions auto-submit on timeout.
• Approval workflows: Result publishing, leave approval, and attendance corrections require multi-level authorisation.
• Audit logging: Key admin actions are logged with timestamps and user identifiers for accountability.

8. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data. Aksharum is committed to facilitating these rights.

• Right to access: Request a copy of the personal data we hold. Students can view their own records directly within the platform.
• Right to correction: Inaccurate records — wrong attendance or result entry — can be corrected through the platform's amendment workflows.
• Right to deletion: School Admins can request account and data deletion from their tenant. Platform-wide requests should be sent to our privacy team.
• Right to portability: School Admins can export results, attendance, and reports as PDF or XLSX files at any time via the Reports module.
• Right to object: If you believe your data is being processed incorrectly, contact your School Admin or our privacy team.

9. Children's Data

Aksharum is designed for educational institutions that include minors. We treat student data with the highest level of care.

• Institutional control: Student accounts are created and managed by School Admins — not directly by students or parents — ensuring institutional oversight.
• No marketing to children: We never use student data for advertising, profiling, or marketing of any kind.
• Parental access: Parents linked to a student account can view their child's attendance, results, and fee status through the read-only parent dashboard.
• Data minimisation: We collect only the student data necessary for the modules your school has enabled.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how Aksharum handles your data, please reach out to us.