Privacy policy

1. About this policy

This policy explains how SchoolTrendz ("we", "us", "our"), the team behind SchoolTrendz, handles personal data in two different places:

• This website (schooltrendz.com) — where a school owner, principal or administrator can read about SchoolTrendz and send us an enquiry.
• The SchoolTrendz platform (app.schooltrendz.com) — the school ERP itself, where a school and its staff, students and parents actually work.

We have tried to write this in plain language rather than dense legal wording. Where a shorter word doesn't quite capture a legal term, we have kept the legal term alongside it. This is a working draft — see the notice at the top of this page.

2. Information we collect on this website

We do not use advertising trackers or analytics cookies on this website at present (our cookie policy has the detail). The only personal data this website collects is what you choose to type into our enquiry form:

• Your name
• Your school's name
• Your role at the school
• Your e-mail address
• Your phone number
• Your city
• Roughly how many students your school has
• Your message to us

Your name, school name, role, e-mail address, city and number of students are required so we can reply sensibly; your phone number and message are optional.

3. How we use that information

We use enquiry-form data only to reply to you — to answer your question, arrange a demo, or help you get started with a free registration. We do not sell it, rent it, or use it for advertising, and we do not share it with anyone outside our own team except a service that helps us send or store the reply (for example, an e-mail or form-handling provider), acting on our instructions.

4. The SchoolTrendz platform: who is responsible for what

Once a school signs up, the picture changes: the school itself decides what personal data it enters into SchoolTrendz — student records, staff records, fee and attendance data, and so on — and is responsible for that data, in the way data-protection law describes as the data fiduciary (what some other laws call the data controller). This includes deciding what to collect, telling parents, students and staff how it will be used, and getting any consents the school needs under its own rules and applicable law.

SchoolTrendz acts as a data processor: we process that data on the school's documented instructions, to run the software the school has chosen to use, and we do not use a school's data for our own purposes such as advertising. Our data-processing terms set this relationship out in more detail for schools.

If you are a parent, student, teacher or other staff member and you have a question about your own data on the platform, the fastest route is usually your own school — see section 10.

5. Categories of data on the platform

Depending on how a school configures and uses SchoolTrendz, the platform can hold:

• Student data, including that of children — name, date of birth, photo, class and section, roll number, health notes, guardian relationships, attendance, homework, exam marks and results, fee invoices and payments, library, transport and hostel records
• Staff data — name, contact details, designation, salary grade, attendance, payroll
• Guardian (parent) data — name, contact details, and their link to one or more children
• Visitor data from the front office, with ID numbers masked to the last four digits
• Communications sent through the platform's messages, notices and announcements
• Account and security data — usernames, hashed passwords, sign-in history, audit-log entries

Because much of this is children's data entered by schools, we treat it with particular care — see section 11.

6. How we protect data

Our security page describes our controls in full. In summary:

• Every school's data is kept apart, and access follows each of the 9 roles' permissions strictly
• Strong password rules, account lock-out after repeated failed attempts, and optional two-step sign-in
• Short-lived sign-in tokens and a refresh cookie that scripts cannot read (HttpOnly, Secure, SameSite=Strict)
• In our cloud design: encrypted file storage and a managed database with automatic backups (and point-in-time recovery)
• In our cloud design: a web application firewall with sign-in rate limits, and secrets kept in a secrets manager
• An audit log of changes (from a screen or the system) and of every AI assistant lookup, and a 30-day recycle bin for undoing deletions
• Visitor ID numbers masked to their last four digits, and directory-only views for staff who don't need full profiles

We do not yet hold formal certifications such as ISO 27001 or SOC 2, and we do not describe ourselves as "DPDP compliant" or "GDPR compliant" — see section 13.

7. The AI assistant

SchoolTrendz includes an AI assistant (early access), powered by Anthropic's Claude, that answers questions such as "which students in my class were absent today?" using only data the asking user is already permitted to see.

• The assistant is read-only — it never changes data.
• Once the assistant is switched on, the user's question and the permitted data needed to answer it are sent to Anthropic, acting as our sub-processor, solely to generate the answer.
• Every AI lookup is logged in the same audit log as any other action.
• Sensitive details — national ID numbers, health data, passwords, contact details — are left out of answers unless the area genuinely needs them.

To be confirmed: whether each school can switch the assistant off

8. Payments

When a parent or student pays a school fee online, they are taken to a secure hosted checkout run by our payment gateway (connected at launch). Card numbers and other payment-card details never touch our servers — the gateway sends us a signed confirmation, which we verify before marking the fee as paid.

9. How long we keep data

A school's data on the platform is kept for as long as the school's account is active, plus a short period afterwards to allow for export or reactivation, unless the school and we agree otherwise or the law requires a longer period (for example, financial records for tax purposes).

• Deleted records normally go to a 30-day recycle bin first, so a mistaken deletion can be undone.
• After that window, or when a school's account ends, data is deleted or returned to the school as described in our data-processing terms.
• Website enquiry-form messages are kept only as long as we need them to handle your enquiry and keep a reasonable record of it.

10. Your rights

Because a school decides what data it holds about you and why, the right first step for most requests — to see, correct, or ask for the deletion of your personal data on the platform — is to contact your own school, since it holds your records and any consents it collected. If your school needs help carrying out a request, it can ask us, and our data-processing terms commit us to assist.

If you have contacted your school and still need our help, or your enquiry is about this website rather than a specific school, you are welcome to contact us directly.

11. Children's data

SchoolTrendz is built for schools, so it inevitably holds data about children — entered and managed by the school, not by the child directly. Schools are responsible for obtaining any parental or guardian consent that applies to them and for deciding what a student account can see and do. We do not use children's data for advertising, and the platform sets no advertising or tracking cookies.

12. Grievance officer

To be confirmed: the name, designation and contact details of our grievance officer under the Digital Personal Data Protection Act, 2023, once appointed

Until then, please use our contact page for any privacy question or complaint, and we will make sure it reaches the right person.

13. Law that applies

This policy is written with Indian law in mind, in particular the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (and rules made under it), as applicable to how we and schools using SchoolTrendz handle personal data. We are not stating, and this policy should not be read as stating, that we hold any certification or have been assessed as "compliant" with these or any other laws — that is a legal question for our advisers and, ultimately, for a court or regulator to decide, not a marketing claim we make about ourselves.

14. Changes to this policy

We may update this policy as the product, our sub-processors, or the law change — particularly as we move from early access towards a full public launch. We will update the "last updated" date at the top of this page whenever we do, and, if a change is significant, we will try to flag it more clearly here or through the platform.

15. Contact us

Please use our contact page — we read every message ourselves.