Privacy policy

1. The short version

• Your school owns its data. For everything inside the platform, your school decides what happens; we only act on its instructions.
• We do not sell data. Not to advertisers, not to brokers, not to anyone.
• We do not profile children. There is no advertising and no behavioural analytics inside the signed-in application.
• AI never sees a student record. AI Studio sends the topic to write about, never your data.
• You can leave with everything. Export any time, deletion on request.

The rest of this page is the detail behind those five statements.

2. Who we are, and in what capacity

Infoleen is operated by TO BE CONFIRMED — registered entity name, registered at TO BE CONFIRMED — registered address, India. In this policy "we" and "Infoleen" mean that entity, and "you" means whoever is reading — a school, a member of staff, a guardian or a student.

We handle personal data in two distinct capacities, and the difference matters:

• As a processor, for school data. Student records, marks, attendance, assignments, report cards, library loans, canteen orders, transport boardings and safeguarding reports belong to your school. Your school is the data fiduciary (controller); we process that data only on its documented instructions. If you are a parent or student asking about this data, your school is the right first point of contact, and we support them in answering you.
• As a controller, for our own business data. Enquiries you send us through the contact form, correspondence with us, and aggregate measurement of our public marketing pages. Here the decisions are ours and this policy governs them directly.

3. What we process

3.1 School data, on your school's instructions

The categories depend on which modules your school uses, and typically include:

• Identity and enrolment — name, class and section, admission or staff number, role, the schools a person belongs to, contact details, profile photo where uploaded.
• Academic — attendance, marks and results, assignment submissions, quiz attempts, report cards, certificates issued.
• Relationships — the link between a guardian and the children they are responsible for.
• Operational — library loans, canteen orders and dietary flags, lost-and-found entries, transport route assignment and boarding records.
• Safeguarding — anti-bullying reports and their handling. This is sensitive by nature and access is restricted accordingly.
• Communications — announcements and internal mail sent within your school.
• Account security — sign-in records including time, approximate location and device, kept so that you and we can spot misuse of an account.

3.2 Data we collect as controller

• Enquiries. When you submit the contact form we receive your name, role, school or group name, country, work email, optional phone number, the size of your school, what you use today, and whatever you write in the message box. We use it to reply to you and to prepare a demo and quotation. Nothing else.
• Marketing-site measurement. Aggregate, cookie-free page measurement on our public pages only — described in section 6.
• Technical logs. Standard server and security logs generated by our hosting provider, used to keep the service running and to investigate abuse.

4. Children's data

Most people signed in to Infoleen on a given morning are under eighteen. India's Digital Personal Data Protection Act 2023 places specific restrictions on processing children's data, including on behavioural profiling and on tracking-based advertising directed at children. We treat those as design constraints:

• No advertising in the product. There is no ad network, no ad SDK, and no ad revenue. We are paid by schools for software.
• No behavioural analytics in the signed-in application. Our measurement script is loaded by our public marketing pages and by nothing else. A signed-in student is not measured.
• No profiling for our own purposes. We do not build behavioural profiles of students, and we do not use student data to develop or market anything.
• Certificate verification pages are excluded from measurement, because their address itself identifies a specific certificate.
• Consent and authority sit with the school. Accounts for children are created by the school under its own relationship with families. We support your school in meeting its obligations, including parental-consent requirements where they apply.

5. Artificial intelligence — exactly what is and is not sent

AI Studio is an optional feature on our Premium tier that drafts question papers, rubrics, lesson plans and worksheets. When a teacher uses it, we send our AI provider a short description of the topic to write about:

• Sent: curriculum and curriculum code, subject, grade, chapter, difficulty level, language, and the number of items requested.
• Never sent: student names or identifiers, student work, marks, attendance, guardian details, staff records, safeguarding reports, or any other record from your database.

The generated draft is returned and stored in your school's own question bank. We do not use your data to train AI models, and our providers are contractually not permitted to train on data we send them. Schools on the Standard tier do not have AI Studio, so for them no data reaches an AI provider at all.

6. Measurement on our marketing pages

Our public marketing pages use a privacy-preserving, cookie-free analytics service to count visits and see which pages are read. It sets no cookies, does not fingerprint you and does not follow you across other websites — which is why this site shows you no cookie banner. The signed-in Infoleen platform does not load it. Neither does the certificate verification page.

7. Who else processes data, and why

We use a small number of sub-processors. They act on our instructions, under contract, and we do not permit them to use your data for their own purposes.

If we add or change a sub-processor we will update this table. Schools with a signed data processing agreement are notified of changes as that agreement provides.

8. Where data is held, and transfers

The platform runs on Google Cloud infrastructure. Region matters and requirements differ by country and by school, so we confirm the specific region and any residency commitment for your deployment in writing during procurement, rather than asking you to rely on a general statement here. Where data crosses a border, we rely on the transfer mechanisms available to us under the applicable law and our providers' contractual terms.

9. How long we keep it

• School data is kept for as long as your school is a customer, and then in line with the deletion arrangements in your agreement. Your school controls retention within the platform, including archiving leavers.
• Enquiries from the contact form are kept for TO BE CONFIRMED — suggested: 24 months from last contact, so we can pick up a conversation that pauses over an academic year, and then deleted.
• Sign-in and security records are kept for a limited period for security investigation and then aged out.
• Backups are retained on a rolling basis by our hosting provider and overwritten in the ordinary course.

10. Your rights

Depending on where you are, you have rights to access your personal data, correct it, have it erased, obtain a copy, object to certain processing, and complain to a regulator. We honour these rights and do not charge for exercising them.

For data inside the platform, contact your school first. Your school decides what is held and can act immediately; we act on its instructions and will support it in responding to you. For data we hold as controller — an enquiry you sent us, or correspondence — write to contact@infoleen.in and we will respond within thirty days, usually much sooner.

Under the DPDP Act 2023 you may also nominate another person to exercise your rights on your behalf, and you may complain to the Data Protection Board of India. We would ask you to raise it with us first, because we would rather fix it than be told about it.

11. Security

Access control is enforced server-side in three layers, tenant isolation is enforced at the database, traffic is encrypted in transit, data is encrypted at rest, and blocking an account revokes its live sessions. Our security page sets this out in detail, including what we deliberately chose not to do and why.

If we become aware of a personal data breach affecting your school we will notify you and the relevant authority as required, telling you what happened, what was affected and what we did about it.

12. Changes to this policy

If we change this policy we will update the date at the top. Where a change is significant — a new sub-processor, a new category of data, a new purpose — we will tell customer schools directly rather than relying on you noticing a date.

13. Contact us

Questions, requests and complaints all go to the same place, and a person reads them.

• Email: contact@infoleen.in
• Grievance officer (India, DPDP Act 2023): TO BE CONFIRMED — name and direct email
• Postal: TO BE CONFIRMED — registered address