Privacy Policy

School+ (also written SchoolPlus) is a school-management platform operated by Untecho Labs (“Untecho”, “we”, “us”). It is offered as a subscription to schools, who then invite their teachers, staff, students and parents to use it through the web app, school-branded web addresses and the School+ Android app.

This policy covers the School+ platform, our public website and our apps. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules made under them.

Your school is the Data Fiduciary — it decides which students, parents and teachers are added, what is recorded and who may see it. Untecho acts as the school's Data Processor: we store and process that data only to run the platform for the school, on its instructions and under our agreement with it.

For the small amount of data we collect directly — demo requests on our website, the school's billing contact and the console accounts of our own team — Untecho is the Data Fiduciary.

Depending on your role, the platform may hold:

• Account details — name, email, mobile number, role, school, password (stored only as a one-way hash), optional profile photo, two-factor authentication secret.
• Student records entered by the school — class and roll number, date of birth, blood group, address and area, father's and mother's names and phone numbers, emergency contacts, achievements, transport stop and bus route, and where the school chooses to record it, the Aadhaar number for admission records.
• Academic data — attendance, syllabus progress and understanding responses, homework and submissions, exam marks, report cards, certificates, leave requests, notices and messages.
• Fee and payment data — invoices, receipts, payment mode and reference numbers, uploaded payment proofs; card and bank details are never stored by us — online payments are handled by the payment gateway.
• Teacher and staff data — qualifications, subjects, timetable, attendance, salary records kept by the school, ratings and feedback.
• Technical data — IP address, browser and device type, timestamps and security logs generated when you use the service.
• Website leads — name, school, email, phone, city and message when you request a demo.

Students are typically under 18. Their data is added by the school, which obtains the verifiable consent of a parent or lawful guardian where the law requires it, and student and parent accounts are created and controlled by the school.

• We never show advertising, run behavioural tracking or build profiles of children for any purpose other than delivering the school's service.
• Children's data is visible only to their own school's authorised users, and to the parents linked to that child.
• Optional knowledge-library content is curated by our team and reviewed for age bands; no third party can post to it.

• To run the school's operations you were invited for — marking attendance, publishing timetables, tracking syllabus, collecting fees, issuing report cards and certificates, managing transport, sending notices.
• To keep accounts secure — sign-in, two-factor authentication, role and tenant checks, suspicious-activity review.
• To bill schools for the subscription and to issue GST-compliant tax invoices and receipts.
• To provide support when a school asks us to, including temporary, logged support access to its dashboard.
• To send service messages such as fee reminders and receipts on the school's behalf through SMS or WhatsApp, where the school has enabled it.
• To comply with law — tax records, court orders, lawful requests from authorities.

We process data on the basis of the school's instructions and consent obtained by it, our contract with the school, and our legitimate operational and legal obligations. We do not sell personal data and we do not use it to train advertising models.

Only the minimum needed, and only with providers bound by contract to protect it:

• Hosting — our servers and database run in an Indian data-centre region (Mumbai) on encrypted disks.
• Payments — when a school enables online fee payment, the transaction is processed by Razorpay under its own privacy policy; we receive only the payment status and reference.
• Messaging — fee reminders and receipts may be delivered through an SMS/WhatsApp gateway chosen by us; it receives the phone number and message text.
• Authorities — when required by law or to protect the safety of a child.

Personal data is stored and processed in India. We do not transfer it outside India for storage.

We use only functional cookies: an encrypted, HTTP-only session cookie to keep you signed in, short-lived cookies during two-factor sign-in, and a brand cookie remembering which school's sign-in page to show. The browser may also keep your theme preference, your remembered email (never your password) and notification state locally on your device. There are no advertising or cross-site tracking cookies.

• HTTPS everywhere; passwords hashed with bcrypt; optional TOTP two-factor authentication for administrators and mandatory for our console.
• Strict tenant isolation — every query is scoped to the school, and roles decide what each user can see.
• Encrypted storage, nightly backups retained for 14 days, and access limited to named team members.
• Support access to a school's dashboard is time-limited, logged and visibly flagged inside the dashboard.

No system is perfectly secure. If we become aware of a breach affecting your data we will notify the affected school and, where required, the Data Protection Board of India and the individuals concerned.

Data is kept for as long as the school's subscription is active. After a subscription ends we keep the school's data for a limited period (normally up to 90 days) so it can be exported, then delete it from live systems; backups expire on their own schedule. Invoices, receipts and tax records are retained as long as tax law requires. Website demo requests are deleted once handled or after 12 months.

Under the DPDP Act you may ask to:

• see a summary of the personal data held about you or your child;
• have inaccurate or incomplete data corrected or updated;
• have data erased when it is no longer needed for the purpose it was collected;
• nominate a person to exercise these rights on your behalf;
• raise a grievance and receive a response.

Because your school controls the records, the fastest route is your school office — most details can be corrected from the school's dashboard immediately. You may also contact us directly and we will coordinate with the school. If you are not satisfied with our response you may approach the Data Protection Board of India.

We will post any changes on this page and update the date at the top. Material changes will also be announced inside the platform to school administrators.

For privacy questions, data requests or grievances, write to us — please mention your school's name and your role. We acknowledge grievances within 72 hours and aim to resolve them within 30 days.

See also our Terms & Conditions.