Privacy Policy

SHARADA.online is a school management platform built for Indian educational institutions. We provide tools for managing students, staff, fees, attendance, examinations, and communications.

When this policy says "we", "us", or "Sharada", it refers to the team operating SHARADA.online.

When it says "you" or "your school", it means the educational institution and its authorised staff who have registered and use the platform.

Your institution is the Data Fiduciary under the DPDP Act — you decide what data to enter about students and staff. We are the Data Processor — we store and process that data only on your behalf and under your instruction.

We collect only the information needed to run the school management platform. Nothing more.

Information your school enters:

• Student details — name, date of birth, class, section, roll number, parent or guardian name and phone number, photo (optional)
• Staff details — name, designation, employee ID, contact number, salary information, photo (optional)
• Attendance records, fee payments, exam grades, library transactions
• Messages and announcements sent through the platform

Information collected automatically:

• Login details — email address, which device and browser you used to log in, login time
• Usage information — which pages you visited and when, so we can improve the product
• Approximate location of web visits (city-level only, from your device's IP address) — used only for platform analytics, not linked to individual users

Information you give us directly:

• Your school's name, type (e.g. CBSE / ICSE), and contact details when you register
• Support requests you raise through the help widget

Specifically, we use the information to:

• Provide the platform features — attendance, fees, exams, payroll, communication, and more
• Send automated notifications and reminders (fee reminders, attendance alerts) on your behalf via WhatsApp and email
• Allow authorised staff in your school to access the records they are permitted to see
• Respond to support requests you raise with us
• Monitor the health and performance of the platform (e.g. detect if something is broken)
• Comply with Indian law and regulations, including the DPDP Act, 2023

Within your school: Only the staff members you have invited and assigned a role can access your school's data. Each role sees only what it needs — a teacher cannot see payroll, a clerk cannot see exam grades.

Sharada support team: We can only view your data if you explicitly raise a support ticket and ask for our help. We do not browse customer data without a reason.

Third parties: We do not sell, rent, or share your data with advertisers or marketing companies. We use trusted technology providers (e.g. Supabase for database hosting, Resend for email) — these providers only process your data to deliver the service and are bound by data processing agreements.

Legal requirements: We may disclose data if required by a court order or Indian law. We will notify you where legally permitted to do so.

We use multiple layers of protection:

• Encryption in transit — all communication between your browser and our servers uses TLS (HTTPS). Your data is never sent in plain text.
• Encryption at rest — all data stored on our servers is encrypted using AES-256, the same standard used by banks.
• Private file storage — photos and uploaded files are stored in private, access-controlled storage. They cannot be accessed without a valid, time-limited link that expires within 1 hour.
• School data isolation — your school's data is separated from all other schools at the database level. A technical misconfiguration cannot cause one school's data to leak to another.
• DDoS and bot protection — we use Cloudflare, a global security provider, to block malicious traffic before it reaches our servers.
• CAPTCHA — login and sign-up forms use CAPTCHA to prevent automated attacks.
• Auto-logout — inactive sessions are automatically ended after 20 minutes to protect shared devices.
• Role-based access — each staff member sees only what their role permits. Access controls are enforced on the server, not just on screen.

Where your data is stored: SHARADA.online uses Supabase as its database provider. Your school data — students, staff, fees, attendance, and all records you enter — is stored on servers located in India (Mumbai, AWS ap-south-1 region). Your data does not leave India for storage. Other services used to deliver the platform (email via Resend, traffic protection via Cloudflare, application hosting via Netlify) process data transiently to fulfil each request but do not persistently store your personal data. All these providers are bound by data processing agreements and handle your data solely to deliver the platform service.

Sharada stores information about students, including minors. This data is entered by your school for operational purposes (attendance, fees, exams) and is handled with extra care:

• Student records are never used for advertising or profiling
• Student data is never shared with any third party for any non-operational purpose
• Only authorised school staff can access student records
• Parent or guardian contact details are used only for school-initiated communications (e.g. fee reminders, attendance alerts)

Under the DPDP Act, the school — as the institution in direct relationship with the child's family — is responsible for obtaining appropriate consent from parents or guardians before enrolling student data in a digital system. Sharada provides the platform; your school's registration and admission process is where that consent is obtained.

As the institution responsible for the data you enter into Sharada, and as individual users of the platform, you have the following rights:

• Right to access — you can ask us what data we hold about your school or its users
• Right to correction — you can update any data directly within the platform, or ask us to correct records that cannot be edited from the interface
• Right to erasure — if your institution leaves Sharada or you wish to delete specific records, email us and we will permanently delete the data within 30 days
• Right to grievance redressal — if you believe we have mishandled your data, you can raise a complaint with us (see Section 11) or with India's Data Protection Board once it is constituted
• Right to withdraw consent — you may close your account at any time; we will delete your data on request as described above

To exercise any of these rights, contact our Grievance Officer at [email protected] with your school name and a brief description of your request. We will acknowledge within 24 hours and resolve within 30 days. See Section 11 for full contact details.

We retain your data for as long as your school's account is active. If your subscription lapses, we retain data for an additional 90 days so you can export or retrieve records before permanent deletion.

If you request account deletion, we permanently delete all school data within 30 days, except where we are legally required to retain records (e.g. financial transaction logs may be retained for up to 7 years under the Income Tax Act).

Anonymised usage statistics (e.g. total page visits in a month) may be retained indefinitely, as they cannot be linked back to individuals or your school.

Sharada uses minimal cookies — only what is necessary for your session to work (keeping you logged in, remembering your preferences). We do not use advertising cookies or third-party tracking cookies.

We collect basic analytics about platform usage (which pages are visited, from which city, on which device type). This helps us improve the product. This data is aggregated and not linked to individual names or email addresses. We do not use Google Analytics or Facebook Pixel.

If your browser has a "Do Not Track" signal enabled, our analytics system will not record your visit.

If we make significant changes to this Privacy Policy — such as changes to what data we collect or how we use it — we will notify the primary administrator of your school's account by email before the changes take effect.

Minor changes (such as clarifications of language) will be reflected by updating the "Last updated" date at the top of this page.

Continued use of Sharada after the effective date of any change means you accept the revised policy.

In accordance with India's Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to address any concerns about how your personal data is handled. If you wish to exercise your rights, raise a complaint, or report a suspected data issue, please contact:

If you are not satisfied with our response, you have the right to escalate your complaint to India's Data Protection Board once it is constituted under the DPDP Act, 2023.

In the event of a confirmed personal data breach that is likely to cause harm to you or your students, we will notify you within 72 hours of becoming aware of it, and report to the Data Protection Board as required by law.