Privacy Policy
Last updated: 22 July 2026
1 · What we collect
- School (tenant) data — school name, branding, plan tier, billing details.
- User data — full name, role, email, and phone for Principals, teachers, admin staff, parents, and students. Parents and students provide this via school onboarding, not directly.
- Educational records — attendance, marks, homework, admissions applications, fee receipts, transfer certificates, gate passes. Owned by the school; we store and process on their behalf.
- Technical logs — request logs, error traces, and audit_logs of every mutation for security and support.
2 · Legal basis
Under the Digital Personal Data Protection Act 2023 (India), we process personal data on the following bases:
- Consent obtained by the school (data fiduciary) from parents and students at enrolment.
- Legitimate interests of the school (running an educational institution).
- Compliance with legal obligations (transfer certificates, GST invoicing).
3 · Who sees what
Row-Level Security in Postgres enforces tenant isolation. Roles inside a school see only their scope:
- Super Admin (us, Clicknify) — cross-tenant metadata for billing and support. Never business rows unless the school explicitly requests support.
- Principal / Admin Staff — everything at their tenant.
- Teacher — their classes only.
- Parent — only their linked children.
- Student — only their own record.
4 · Retention
Data is retained for the life of the subscription plus 90 days for grace/recovery, then deleted. Legally required records (GST invoices) are retained for the statutory 8-year period.
5 · Sub-processors
- Supabase (Postgres + Auth + Storage) — Mumbai region.
- Vercel (hosting) — Mumbai (bom1) region.
- Razorpay (payments) — India.
- Interakt/Gupshup (WhatsApp) — India.
- Resend/Postmark (transactional email).
6 · Your rights
Under DPDPA you have the right to access, correct, and erase your personal data. Requests should go to the school (data fiduciary). If you cannot reach the school, contact us at privacy@clicknifyschool.com.
7 · Children
The Service is used in K–12 schools where most users are minors. Access is provisioned by the school under the school's legal responsibility. Parents may request deletion of their child's data through the school at any time.
8 · Cookies
We use session cookies (Supabase Auth) and a functional cookie for density preference. No advertising cookies.
9 · Contact
Data Protection Officer: privacy@clicknifyschool.com · Grievance Officer (India): grievance@clicknifyschool.com.