Privacy Policy

• Institute — a coaching centre or school tenant on the Platform.
• Institute User — staff authorised by an Institute.
• Student Data — personal data about students in the ERP.
• Parent Data — parent/guardian contact and portal data.
• Personal Data — as defined under the DPDP Act, 2023.

• For staff account data, Scholant OS is a Data Fiduciary.
• For Student and Parent Data entered by an Institute, the Institute is the Data Fiduciary and we act as a Data Processoron the Institute's instructions.
• Institutes must process data lawfully and obtain consent where required.

Institute Users

• Name, email, role, permissions, session logs, password hashes
• Institute branding and subscription status

Students & academics

• Identity, class/section, attendance, fees, exams, admissions
• Documents when admission uploads are enabled

Parents

• Contact details (stored with encryption at rest where enabled), portal/OTP sessions, payment references

Integrations & technical

• WhatsApp (Meta), email delivery, optional Razorpay
• IP, cookies, security and rate-limit logs, institute audit events
• Optional owner two-factor authentication (TOTP) settings

Enterprise AI (optional, Enterprise plan)

When enabled and configured by Scholant OS, authorised staff may use AI drafting tools. Prompts sent to our AI provider may include:

• Text staff paste (e.g. parent WhatsApp messages, admission notes) or document text they upload or paste
• Limited operational context we load for that request (e.g. student name, batch, fee balances, attendance summaries, timetable slots, aggregate institute metrics)
• Spreadsheet rows during bulk-import review (sample rows only)

AI is not used for unrelated advertising. Institutes must review all AI outputs before sending messages to parents or relying on them for official records.

We process data to operate the ERP, authenticate users, send service emails, enable integrations, provide optional Enterprise AI features at the Institute's direction, and keep the Platform secure.

We do notsell student data or use it for unrelated third-party advertising. We do not use Customer Data to train our own models. Optional AI requests are processed by Google's generative AI services under Google's terms; we configure those features only when an Enterprise tenant uses them.

Processing is based on contract, legitimate operational needs, legal compliance, and consent where the DPDP Act requires it (e.g. parent OTP or WhatsApp, as arranged by the Institute).

We share data only to run the service, including with:

• Hosting (e.g. Vercel), database (e.g. Supabase), storage (e.g. AWS S3)
• Email (e.g. Resend), payments (Razorpay), WhatsApp (Meta)
• Google (Enterprise AI APIs) — only when Enterprise AI features are enabled and a staff member triggers a request; prompt content is transmitted to generate drafts or analysis, not your full database
• Authorities when required by law

Subprocessors

The table below lists typical infrastructure and integration providers. Your Institute's use of optional features (WhatsApp, Razorpay, AI) determines which apply.

Some providers may process data outside India (including the United States). We use contractual and technical safeguards appropriate to each vendor. Institutes should inform parents where required, especially for messaging, payments, and AI-assisted replies.

• Active tenants — for the subscription period
• After termination — typically deleted within 90 days unless law requires longer
• Billing — as required for tax/accounting

Deletion requests: contact@scholantos.com

• HTTPS, httpOnly sessions, role-based access, and per-institute data isolation
• Bcrypt password hashing, login rate limits, and security headers
• Encryption at rest for sensitive fields (e.g. parent phone numbers and integration tokens) when platform encryption keys are configured
• Optional TOTP two-factor authentication for institute owners; audit log of sensitive institute actions
• File uploads validated by type and size; cloud storage may use server-side encryption (SSE) and time-limited signed download links

1. Notify parents/staff about data use
2. Process data lawfully for education/admin purposes
3. Respond to Data Principal requests for data they control
4. Keep fee, attendance, and result records accurate
5. Review all AI-generated drafts before sending WhatsApp messages, saving admissions data, or treating outputs as official advice

Data Principals may have rights to access, correct, erase, withdraw consent, and lodge grievances under the DPDP Act.

Parents/students: contact your Institute first.

Institute owners: may export a JSON backup of institute operational data from Settings (subject to your plan and role).

Platform matters: contact@scholantos.com (we respond within applicable timelines, ordinarily within 30 days).

We process minor's data only as instructed by Institutes for legitimate school operations—not for unrelated commercial profiling.

Essential cookies only (auth, locale, security). No advertising cookies on the ERP interface.

Institutes connect their own Meta Business account. Meta's terms apply to message delivery and retention.

Available on the Enterprise plan when Scholant OS enables it and configures the Enterprise AI provider API key. Features may include owner briefings, natural-language data questions, bulk-import checks, attendance message drafts, parent-reply suggestions, WhatsApp template review, admission document field extraction, and timetable analysis.

• Requests are initiated by authorised Institute Users and logged in our institute audit trail where applicable
• Outputs are suggestions only — not guaranteed accurate, complete, or lawful for your jurisdiction
• Rate limits apply to prevent abuse; AI may be disabled globally or per deployment

For Google's processing, see Google AI terms and their privacy documentation.

We will notify Institutes and authorities as required if a breach poses risk to Data Principals.

We may update this Policy; the date above will change. Material changes may be notified by email or in-app notice to institute owners.

• Email: contact@scholantos.com
• Platform: https://app.scholantos.com

Grievance officer (DPDP): Privacy Grievance Officer — contact@scholantos.com (Scholant OS).

Security or abuse reports: contact@scholantos.com.

Governed by the laws of the Republic of India, including the DPDP Act and IT Act, 2000. See also our Terms of Service.