Privacy Policy

At Papaa Escola, the trust you place in us to care for your child extends to the information we hold about your family. This policy explains how we handle that information through the Parent Portal.

This policy works alongside our Terms of Use.

Papaa Escola is an educational institution, operated by Papaa Escola Education Trust. We provide the Parent Portal as one of our own services. Throughout this policy, "we", "us", "our" and "the school" mean Papaa Escola — the people responsible for your child's education and for the information we hold about your family.

Most of the information in the portal is recorded by the school when your child is admitted and as part of everyday school life. Some you add yourself, and a little is recorded automatically to keep the portal secure. The sections below describe each kind of information in detail.

When your child joins us, we record the details needed to enrol and place them, which may include:

• Your child's name, date of birth, gender and photograph.
• Admission number and roll number, and any government education identifier the school records.
• Background details such as nationality, religion, mother tongue and previous school.
• Sibling details, where provided.

Throughout your child's time with us, we keep the student record up to date — including their class and section, status, and the academic and daily information described in the sections that follow. This helps teachers and the school support your child.

We hold contact and family details for parents and guardians, which may include:

• Names, phone numbers and email addresses.
• Residential and correspondence addresses.
• Occupation, qualification and other family details recorded at admission.
• A government identity number (such as Aadhaar), where the school records it — stored encrypted.

We record your child's academic information, such as marks, grades, report cards, progress notes and exam results. This information appears in the portal once it is reviewed and published by the school.

We record your child's daily attendance — whether they were present, absent, late or on leave — and, where the school tracks it, check-in and check-out times and any remarks added by the teacher.

We keep records relating to your child's fees, including fee dues and installments, payments recorded against your child's account, the payment method and reference, receipts, and any payment screenshot you upload as proof.

Where you use the portal to communicate with the school, we keep those records — for example, messages exchanged with teachers and any grievance you raise, along with the school's response. This helps us follow up and keep a clear history of your concerns.

We store the homework and assignments teachers post for your child's class — including titles, descriptions, due dates and any attachments — so they are available to you in the portal.

We keep the notices and announcements the school shares with you, and we record when one has been read so we know that important information has reached your family.

When you book a parent-teacher meeting, we record the booking — the slot you chose, your name and contact number for the meeting, and any notes or follow-up points the teacher adds afterwards.

We keep a record of the notifications we send you — such as updates about attendance, fees, homework, notices and meetings — and whether they have been read, so we can keep you reliably informed.

For your child's safety, we may record health information such as blood group, allergies, medical conditions and vaccination status. We treat this information as sensitive and store it encrypted.

We keep emergency contact details — names, phone numbers and relationship to your child — so that we can reach a responsible adult quickly if the need arises.

We may hold photographs of your child — such as a profile photo, and photos or videos of school activities and events shared in the gallery. Photographs and videos of children are used with the consent the school obtains, and are shown to the families of the school.

If you use our mobile app and allow notifications, we record a notification token for your device, along with its platform (Android, iOS or web) and app version, so we can deliver alerts. To keep accounts secure, we also record technical details such as your IP address and device or browser information in our sign-in and security records.

Signing in needs a little information to keep your child's records safe. For the Parent Portal, your registered phone number is matched in a secured (hashed) form together with your child's date of birth — there is no parent password to store.

Staff accounts are protected separately, with passwords stored only in a hashed form and additional safeguards such as multi-factor authentication. Sign-in sessions use secure, browser-protected cookies, and we keep short-lived records to detect and stop suspicious activity.

The portal uses only the cookies it needs to work — chiefly to keep you securely signed in and to protect your session. We do not use advertising or cross-site tracking cookies. Because these cookies are essential, turning them off may stop the portal from working.

We protect your family's information with a layered set of safeguards:

• Encrypted connections — Traffic to the portal is encrypted using HTTPS/TLS.
• Encrypted sensitive data — Government IDs, phone numbers and medical details are encrypted where they are stored (AES-256).
• Protected sign-in — Staff passwords are stored only in hashed form, and staff accounts use multi-factor authentication.
• Controlled access — Staff see only what their role requires, and each school's information is kept separate from every other school's.
• Abuse protection — Sign-in attempts are rate-limited and monitored to defend against guessing attacks.
• Activity records — Sensitive actions are recorded in security and audit logs so they can be reviewed.

No system can be perfectly secure, but we take these protections seriously and keep improving them.

We never sell your information. Your family's information is shared only as needed to run the school:

• Within the school — Authorised staff access information according to their role.
• With you — You see your own child's information through the portal.
• With trusted providers — A small number of technology providers help us operate the portal securely — see the next section.
• When the law requires — We may share information where we are legally required to, or to protect the safety of children and others.

To run the Parent Portal securely and reliably, we rely on a small number of trusted technology providers. They act only on our instructions and only to help us operate the portal — they are not allowed to use your information for their own purposes.

Our database is hosted in India. Some providers — such as those that deliver email and notifications, or help us fix technical problems — may process limited information outside India to provide their service. Where a school chooses to enable staff sign-in with a Google account, the staff member's Google email is used only for that sign-in.

We keep your child's records for as long as we need them for educational and legal reasons. A few things are worth knowing about how we manage this:

• Records aren't removed casually — When a student record is removed, it is first marked as removed and can be restored within a short window before it becomes inactive.
• Old details are cleared automatically — Some years after a student leaves, sensitive details — such as government ID, phone numbers, email, medical information and address — are automatically removed from inactive records.
• Old messages — The content of older, removed messages is cleared once that period passes.
• Security records — Identifiers such as IP address are removed from older security records.
• Backups — We keep routine, secure backups of our database to guard against accidental loss.

You can take an active role in your family's information:

• Review and correct — If you notice something incorrect in your child's records, contact the school office and we will review and correct it.
• Ask about your information — You can ask us what information we hold about your child and how it is used.
• Manage notifications — You can choose which notifications you receive in the app and in your device settings.

Protecting children's information is central to what we do. Children do not sign up or sign in to the Parent Portal themselves — their information is recorded by the school and accessed by their parents or guardians. We obtain the consents we need, for example before using photographs of your child, and we treat children's information with particular care.

We may update this Privacy Policy from time to time — for example, to reflect new features or legal requirements. When we make important changes, we will update the "Last updated" date below and, where appropriate, let you know through the portal.

For anything about your child's records — including to review or correct information — your school office is the best first point of contact.

For privacy questions, you can write to us at privacy@papaaescola.in. For general help with the portal, contact support@papaaescola.in.