Privacy Policy

1. About vaeloai.in

vaeloai.in ("we", "our", or "vaeloai.in") is a school management SaaS platform operated by vaeloai.in, under the laws of India. This Privacy Policy describes how we collect, use, store, and protect personal data in compliance with India's Digital Personal Data Protection (DPDP) Act, 2023.

We obtain explicit consent before processing personal data for account creation, login, and member onboarding. Consent events are written to an immutable AuditLog with timestamps for DPDP accountability.

2. Data We Collect

• School Staff: Name, email, phone number, designation, and role.
• Students: Name, email, grade, guardian contact details, fee records, attendance, and academic scores.
• Parents / Guardians: Name, email, phone, and relationship to the student.
• Usage Data: IP address, browser type, pages visited, and session timestamps (for security and audit purposes).
• Uploaded files: Logos, homework attachments, and documents you choose to upload.
• AI prompts: Text you submit to vaeloai.in features (subject to the Indian K-12 educational guardrails).

3. Legal Basis for Processing (DPDP Act, 2023)

• Consent: Collected during school onboarding and student enrolment.
• Legitimate uses: Academic records, fee management, attendance tracking, and safety communications including in-app absence/late alerts.
• Optional WhatsApp: Only after a separate opt-in in Settings. You can withdraw WhatsApp consent without deleting academic records the school must keep.
• Contractual obligation: Data processed to fulfil the SaaS subscription agreement with the school.

4. Minor Data Protection

vaeloai.in processes data relating to students who may be minors (under 18 years of age). We adhere strictly to the provisions of Section 9 of the DPDP Act, 2023:

• We do not process children's data without verifiable parental or guardian consent.
• We do not use children's data for targeted advertising or profiling.
• School administrators are the primary Data Fiduciaries for student records and bear responsibility for obtaining lawful consent.

5. Data Storage Location & Cross-Border Transfers

Primary application data is hosted on Neon PostgreSQL servers located in AWS us-east-2 (US East, Ohio, USA). Application hosting may run on Vercel edge/server infrastructure. File uploads may be stored in Cloudflare R2 (or AWS S3-compatible storage) and/or in the Neon database when object storage is not configured.

By using vaeloai.in, the school (Data Fiduciary) instructs us to transfer and process personal data outside India as reasonably necessary to provide the service. We apply contractual and technical safeguards with sub-processors, including encryption in transit (TLS) and access controls. Where required under applicable law, schools should obtain any additional consents or notices for cross-border processing.

6. Sub-processors (Third-Party Disclosures)

We use the following sub-processors to operate vaeloai.in:

• Neon — PostgreSQL database hosting (us-east-2).
• Vercel — application hosting and edge delivery.
• Google Gemini — generative AI for educational assistant and optional drafting features. Prompts may be sent to Google under their API terms; we do not sell school data for advertising.
• Cloudflare R2 / AWS S3 — object storage for uploaded files (when configured).
• Razorpay — school SaaS billing and optional parent fee collection via Route / linked accounts (100% of the invoice amount is transferred to the school; Razorpay MDR applies to the school account).
• WhatsApp (Meta Cloud API or Gupshup) — optional school-to-parent templates, only after purpose-specific opt-in. Support chats opened by you via wa.me are user-initiated.

Attendance alerts are delivered in-app by default as a school operations notice. Optional WhatsApp copies use templates and consent. Devices may queue attendance and timesheet marks in IndexedDB while offline, then sync to the school tenant that owns the session. This notice is not a DPDP certification claim.

7. Security Measures

• TLS encryption in transit; provider-managed encryption at rest where available.
• bcrypt-hashed passwords (never stored in plaintext for new credentials).
• Role-based access control (RBAC) and per-school tenant isolation.
• Audit logs for sensitive mutations.

8. Data Retention

Academic and financial records may be retained for up to 7 years (or longer if required by applicable education/tax rules), unless a school requests earlier erasure within legally permissible limits. Account deletion requests are handled as described on our Account Deletion page.

9. Right to Erasure

• Contact your school administrator (primary Data Fiduciary).
• Platform requests: privacy@vaeloai.in or use /account-deletion.
• We aim to acknowledge verified requests within 30 days.

10. Data Sharing

We do not sell, rent, or trade personal data. We share data only with the sub-processors listed above, and with government authorities when required by law.

11. Cookies

We use strictly necessary cookies for session authentication. We do not use third-party advertising cookies. See our Cookie Policy.

12. Contact & Grievance Officer