Privacy Policy
Effective Date: January 15, 2026
Last Updated: January 15, 2026
Welcome to EduCore ("we," "our," or "us"). We provide a multi-tenant School Enterprise Resource Planning (ERP) Software-as-a-Service (SaaS) platform designed for educational institutions, school administrators, teachers, students, and parents (collectively, the "Platform").
This Privacy Policy outlines how we collect, use, disclose, and safeguard personal and institutional data processed through our Platform.
1. Role Definitions & Data Ownership
1.1 Data Controller vs. Data Processor
- Educational Institutions (Subscribers): School districts, private schools, academies, and universities subscribing to the Platform act as the Data Controller for all educational, administrative, student, parent, and staff data uploaded or generated under their account instance.
- [Company Name]: Acts as the Data Processor (or Service Provider), processing data strictly in accordance with documented instructions from the Subscriber institution, applicable service agreements, and relevant privacy laws.
1.2 Data Ownership
All student records, attendance logs, academic marks, financial invoices, and employee records remain the sole property of the subscribing institution. We do not claim ownership of, sell, rent, or monetize any institution or student data.
2. Information We Collect
We collect information directly provided by users, automatically generated through Platform use, and supplied by school administrators during account provisioning.
2.1 Information Provided by Subscribers & Users
| Category | Description & Examples |
|---|---|
| Institutional Account Data | School name, official address, administrator contact name, business email address, phone number, tax identifiers, and billing preferences. |
| Student Records | Student name, date of birth, grade level, roll number, guardian details, emergency contacts, medical notices, academic marks, and attendance logs. |
| Parent & Guardian Data | Guardian name, relationship to student, email address, mobile number, communication logs, fee receipts, and payment transactions. |
| Teacher & Staff Data | Staff name, employee ID, designation, departmental assignments, salary details, attendance, leave applications, and contact information. |
| Communications | Messages, announcements, assignment submissions, feedback forms, and support ticket submissions. |
2.2 Information Collected Automatically
- Log & Device Data: IP address, browser type, operating system version, access timestamps, page views, and diagnostic crash logs.
- Authentication Tokens: Secure JSON Web Tokens (JWT) and encrypted session cookies to manage logged-in states across role portals.
3. How We Use Information
We process personal and institutional information solely to operate, maintain, and secure the Platform.
3.1 Primary Operational Uses
- Provisioning multi-tenant school instances and isolated databases.
- Enabling role-based access for Super Admins, Principals, Teachers, Parents, and Students.
- Calculating and tracking attendance, exam grades, progress reports, and fee collections.
- Sending automated SMS, push notifications, and email alerts for announcements, fee reminders, and attendance notifications.
- Processing subscription billing and generating financial reports for institutional administrators.
3.2 System Integrity & Compliance
- Monitoring system stability, server performance, and security threats.
- Auditing administrative activity to prevent unauthorized access or fraud.
- Complying with applicable legal obligations and regulatory requests.
4. Multi-Tenant Architecture & Data Separation
Our Platform utilizes strict logical data isolation mechanisms to ensure that data belonging to one subscribing institution is completely inaccessible to other tenants.
- Tenant Isolation: Each school tenant operates within a distinct logical environment with database-level isolation.
- Role-Based Access Control (RBAC): Users are assigned explicit permissions. Parents can only view records related to their enrolled children; teachers access only assigned classes.
5. Third-Party Subprocessors & Services
We engage trusted third-party service providers to assist in delivering cloud infrastructure, notification delivery, and payment processing. All subprocessors are bound by data protection contracts consistent with this policy.
| Subprocessor Category | Purpose | Data Processed |
|---|---|---|
| Cloud Hosting Providers | Infrastructure, database hosting, and daily automated backups | Encrypted data at rest and in transit |
| SMS & Notification Gateways | Delivering urgent school alerts, OTPs, and notifications | Recipient phone numbers and message text |
| Payment Gateways | Processing online fee payments and subscription billing | Payment card tokens, transaction IDs, fee amounts |
| Email Service Providers | Sending password resets, receipts, and system alerts | User email addresses and alert contents |
6. Data Retention & Deletion
6.1 Retention Period
We retain institutional data for the duration of the active subscription agreement. Account data is maintained to fulfill educational record-keeping requirements mandated by regional laws or institutional policies.
6.2 Data Deletion Upon Termination
Upon cancellation or termination of a school subscription:
1. The institution has a 60-day grace period to request a complete export of all student, academic, and financial records.
2. Following the export window, all database records, backups, and media associated with the school tenant are permanently wiped from production and backup storage within 90 days.
7. Security Controls
We implement technical and organizational measures to safeguard data against accidental loss, unauthorized access, alteration, or disclosure:
- Encryption in Transit: TLS 1.3 encryption for all network requests.
- Encryption at Rest: AES-256 encryption for database volumes and backup files.
- Access Governance: Multi-factor authentication (MFA) for administrative roles and automated audit logging.
8. Children's Privacy
The Platform is designed for educational institution use. Student profiles are created solely by authorized school administrators or parents. We do not market to children under 16 or collect student personal data without institutional or parental authorization.
9. Contact Information
For inquiries, data access requests, or privacy concerns, please contact our Data Protection Officer:
- Company Name: [Company Name]
- Privacy Officer Email: [Contact Email]
- Postal Address: [Company Address]