Privacy Policy

For the portal of your college · Effective

In short

Your college decides what is collected and why. runs the CampusPan software for it and uses the data only to provide that service.
At a school, children do not have accounts. A parent or guardian signs in and sees only their own children.
Students, staff and applicants each see only what their role allows; nobody sees another student's records unless their job needs it.
Every has its own separate database. One institution's data is never visible to another.
We never sell personal data, never show advertising, and never track you across other websites.
Card and bank details are entered on Razorpay's secure page and are never stored by CampusPan.
You can ask to see, correct or delete your data from My account → Your data & privacy.

Who is responsible
What we collect
Why we use it
Children's data
Who can see it
Who it is shared with
Where it is stored
How it is protected
How long it is kept
Your rights
Cookies
Changes
Contact & grievances

1. Who is responsible for your data

Under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000:

your college is the Data Fiduciary. It decides what personal data is collected, for what purpose, and who in the may see it. Contact: .
, which makes CampusPan, is the Data Processor. It hosts and runs the portal on the 's instructions and under a written agreement with it. It does not use the data for its own purposes.

2. What personal data is collected

About	Data
Students	Name, roll number, class/section, date of birth, gender, photo, contact details, address, community/category (where the college must report it), previous school and marks, parent/guardian name and contact, attendance, marks and results, assignments, leave requests, fees and payments, hostel/transport/library records, certificates requested, placement details, feedback and grievances they submit.
Children (students)	Name, admission number, class/section, date of birth, gender, photo, address, previous school, attendance, marks and report cards, homework, leave applied by the parent, fees and payments, transport and library records, certificates requested. Children do not sign in and give no data themselves.
Parents / guardians	Name, relationship to the child, mobile number (used to sign in), email (optional), the children linked to the account, payments made, leave requests, grievances and messages.
Applicants	What the admission form asks for: name, contact details, date of birth, course choice, qualifying marks, documents uploaded (marksheets, certificates, ID), and the application fee payment.
Admission applicants	What the admission form asks for: the parent's name and contact details, the child's name, date of birth, class sought, previous school, documents uploaded (birth certificate, transfer certificate, ID), and the application fee payment.
Staff	Name, role, wingdepartment, contact details, date of birth, qualifications and service records, timetable, leave, appraisals, payroll and payslip details (including bank account for salary, where the uses payroll).
Joining documents (KYC)	Copies of documents the asks for at admission — for example Aadhaar, transfer certificate, community certificate, marksheets. Stored encrypted; see section 8.
Sign-in and security	Username/email or mobile number, a one-way hash of the password (never the password itself), two-factor settings, sign-in times, IP address and browser type, and an audit log of important actions (who did what, and when).
Payments	Fee amount, date, method and the payment reference from Razorpay. Card, UPI PIN and bank login details go only to Razorpay and are never seen or stored by CampusPan.

Aadhaar numbers are collected only where the needs them, are not used for authentication, and are handled as the Aadhaar Act, 2016 requires.

3. Why it is used

To run the 's work: admissions, classes, timetables, attendance, assessments, examinations and resultsunit tests, examinations and report cards, fees and receipts, certificates, hostel, transport, library, staff and payroll.
To keep parents informed about their own children: attendance, homework, marks, fees, notices and events.
To send messages the service needs — sign-in links, password resets, fee reminders, notices — by email or SMS.
To keep the portal secure: preventing misuse, investigating problems, and keeping an audit trail.
To meet legal duties of the (for example records required by the university, AICTE/UGC or NAACboard (CBSE, State board, ICSE) or education department).

The legal basis is the consent given at admission or joining, and the 's legitimate uses under section 7 of the DPDP Act (for example, an employer's purposes for staff, and compliance with law). Data is never used for advertising, profiling for marketing, or sold.

4. Children's data

Every student at a school is a child under the DPDP Act. So:

Children do not have accounts and cannot sign in. A parent or lawful guardian signs in and acts for the child.
The school obtains the parent's verifiable consent at admission (the parent applies, or the school records the parent's consent when it adds the child).
There is no tracking, behavioural monitoring or targeted advertising of children, and no data is used for anything that could harm a child's well-being.
A parent sees only the children linked to their account. Adding or removing a link is done by the school office and recorded in the audit log.

Most college students are adults. Where a student or applicant is under 18, the college obtains the consent of a parent or guardian at admission, and the same protections apply: no tracking, behavioural monitoring or targeted advertising, and no use that could harm their well-being. A college may let parents see records only if it chooses to and the student has agreed; CampusPan colleges do not have parent accounts.

5. Who can see your data inside the

Access is by role and is checked on the server for every request, not just hidden on screen:

Students see their own records only. Teachers see the classes they teach; class teachers their class; HODs their department; the Principal and Vice Principal the whole college.
Parents see their own children only. Teachers see the classes they teach; class teachers their class; Coordinators their wing; the Principal and Vice Principal the whole school.
Office staff see only their area — for example the accountant sees fees, the librarian sees library records, the transport officer sees bus records.
The 's Admin manages accounts and settings but cannot see attendance, marks, fees, admissions or other student records.
's staff do not look at the data. They may access it only when the asks for help, or to keep the service secure and running, under confidentiality obligations — and such access is limited to what the task needs.

Only with the service providers needed to run the portal, each bound by contract to protect the data and use it only for this purpose:

Provider	What for
Vercel Inc.	Hosting the website and the portal's servers
Neon Inc.	The database (a separate database for each college and school)
Razorpay Software Pvt. Ltd.	Online fee payments, into the 's own Razorpay account
Resend / Twilio (if the enables them)	Sending emails and SMS messages

Data is otherwise disclosed only when the law requires it (for example a court order or a lawful request from a government authority), or to the 's regulator (university, AICTE/UGC, NAAC) (education board or department) as the directs. It is never sold, and never shared with other colleges or schools on CampusPan.

7. Where it is stored

Each 's database is hosted by Neon in its Asia Pacific (Singapore) region, and the application runs on Vercel's global network. This means data may be processed outside India. Such transfer is permitted under section 16 of the DPDP Act (Singapore is not a restricted country), and the same protections described here apply wherever the data is.

8. How it is protected

Separate database per institution — one 's data is physically kept apart from every other's, and each sign-in works only at the that issued it.
Encryption in transit — all connections use HTTPS (TLS), enforced with HSTS.
Encryption at rest — the database is encrypted on disk, and in addition uploaded documents and photos, two-factor secrets and payment keys are encrypted with AES-256-GCM using a key unique to each .
Passwords are stored only as salted one-way hashes. Sign-in attempts are rate-limited, sessions expire after 8 hours, and the Admin can require two-factor sign-in for any role and end sessions at any time.
Role-based access checked on the server for every request, and an audit log of important actions.
Strict browser security headers (Content Security Policy, no framing, no content sniffing).

If a personal data breach happens, the and will inform the Data Protection Board of India and the affected people as the DPDP Act requires, and take steps to contain it.

9. How long it is kept

Data is kept while you are a student, applicant or staff member of the collegea parent of a child at the school, or a staff member, and afterwards only as long as the needs it for its records and legal duties — for example transfer certificates, marks, and fee and account records the law requires it to keep. Applications that do not lead to admission are kept only for the admission cycle and any period the needs to answer queries, then deleted on its instructions. When the stops using CampusPan, its data is returned to it and then deleted from CampusPan, except where the law requires otherwise.

10. Your rights

Under the DPDP Act you may:

see a summary of the personal data held about you and your children, and how it is used;
correct or complete inaccurate data, and update it;
erase data that is no longer needed (some records must be kept by law — the will tell you which);
withdraw consent — this stops further use based on consent, but may mean the cannot provide some services;
nominate someone to exercise these rights if you die or cannot act;
complain — first to the or to us (section 13), and then to the Data Protection Board of India.

To ask, sign in and open My account → Your data & privacy, or contact the office. Requests are answered within the time the law allows.

11. Cookies and local storage

CampusPan uses only what it needs to work — no advertising or tracking cookies:

Name	Purpose
sw_token	Keeps you signed in (secure, not readable by scripts, expires after 8 hours)
sw_child	Remembers which of your children you are viewing
Browser storage	Remembers preferences on your device such as language, theme and the role chosen on the sign-in page

12. Changes to this policy

If this policy changes, the new version is posted here with a new effective date. Significant changes are announced in the portal before they take effect.

13. Contact and grievances

The (Data Fiduciary): — . Its grievance officer is named on its notice board and in the portal.

(Data Processor) — Grievance Officer: , , . We acknowledge grievances within 24 hours and resolve them within 15 days.

This policy explains how CampusPan works. Each may add its own privacy notice for anything specific to it.