Legal

Privacy Policy

⚠ DRAFT — pending legal review

This document is a template prepared for counsel and must be reviewed and finalised by a qualified Indian lawyer before publication. It is not legal advice and should not be relied upon in its current form.

Effective date: 4 October 2026
Provider: AskAI India Private Limited (CIN available on request), Bangalore, Karnataka, India ("AskCampus", "we", "us").
Data Protection / Grievance Officer: our Data Protection & Grievance Officer (hello@askcampus.in)

Contents

  1. Our roles: controller vs processor
  2. Categories of personal data
  3. Purposes & legal basis
  4. Children's data
  5. Sharing & sub-processors
  6. Data residency
  7. Retention
  8. Security safeguards
  9. Your rights
  10. Cookies & tracking
  11. Breach notification
  12. DPO & grievance officer
  13. Changes
  14. Contact

This Privacy Policy explains how AskCampus handles personal data in connection with its software-as-a-service platform for Indian educational institutions. It is designed to support institutions in meeting their obligations under India's Digital Personal Data Protection Act, 2023 (DPDP Act). For a focused summary of how the platform supports DPDP compliance, see our DPDP compliance notice.

1. Our roles: controller vs processor

Under the DPDP Act, the entity that determines the purpose and means of processing personal data is the Data Fiduciary (controller), and an entity processing on its behalf is a Data Processor.

  • For student, parent/guardian, and institution-operations data: the Institution is the Data Fiduciary and decides why and how the data is processed. AskCampus acts as the Data Processor, processing such data only on the Institution's documented instructions and to provide the Service.
  • For AskCampus's own account, billing, and website data: AskCampus is the Data Fiduciary — for example, the contact details of the Institution's administrators we use to manage the account, billing records, and information collected through this website.

Where AskCampus acts as Processor, the Institution remains responsible for the lawfulness of the processing and for providing notices and obtaining consents from data principals.

2. Categories of personal data

Depending on the modules an Institution uses, the platform may process:

  • Student personal data — name, photograph, date of birth, gender, class/section, roll number, identifiers, and contact details;
  • Parent / guardian data — names, relationship, phone numbers, email addresses, and communication preferences;
  • Attendance data — daily attendance, leave, and related records;
  • Academic records — marks, grades, report cards, assignments, and assessment data;
  • Fees & payment data — fee structures, invoices, transaction references, and payment status (full card details are handled by the payment gateway, not stored by us);
  • Account & usage data — administrator login details, audit logs, and technical metadata.
[[COUNSEL REVIEW: health records / any biometric attendance data — confirm whether the deployed configuration collects health information (e.g., medical/infirmary records, dietary or disability data) or biometric data (e.g., fingerprint/face-based attendance). If collected, classify and treat as sensitive, define the lawful basis and additional safeguards, and decide whether biometric attendance for minors is offered at all.]]

3. Purposes & legal basis

Personal data is processed to provide and operate the Service — for example, to manage admissions, record attendance, publish academic results, communicate with parents, and process fee payments. As a Processor, AskCampus processes data only for these purposes and as instructed by the Institution.

Under the DPDP Act, processing is carried out on the basis of the data principal's consent or a recognised legitimate use. The Institution, as Data Fiduciary, is responsible for identifying and recording the appropriate basis and for issuing the required notices to data principals.

4. Children's data

The platform processes the personal data of students who are children (under 18 years of age). The DPDP Act requires verifiable consent of a parent or lawful guardian before processing a child's personal data, and prohibits processing that is likely to cause harm to a child, as well as tracking, behavioural monitoring, and targeted advertising directed at children (DPDP Act, Section 9).

Consistent with this, AskCampus:

  • does not use children's data for behavioural tracking, profiling, or targeted advertising;
  • relies on the Institution to obtain verifiable parental or guardian consent before children's data is entered into the platform; and
  • provides administrative controls designed to support the Institution in managing consent and access.
[[COUNSEL REVIEW: parental-consent verification mechanism — define how verifiable parental/guardian consent is captured, recorded, and re-confirmed; who bears responsibility (Institution vs AskCampus); how age is determined; and how consent withdrawal is handled. Confirm alignment with DPDP Act Section 9 and any rules notified thereunder.]]

5. Sharing & sub-processors

We do not sell personal data. We share personal data only with sub-processors engaged to provide the Service, under contractual obligations consistent with the DPDP Act. These may include:

  • Cloud hosting — Amazon Web Services (AWS), Mumbai region (ap-south-1);
  • Payments — Razorpay and/or other designated payment gateways;
  • SMS / WhatsApp messaging — licensed SMS and WhatsApp Business providers;
  • Email delivery — a reputable transactional email provider.

A current list of sub-processors is available on request from our our Data Protection & Grievance Officer (hello@askcampus.in).

6. Data residency

Customer Data is hosted on infrastructure located in India (AWS Mumbai, ap-south-1). The platform is designed so that Customer Data is stored and processed within India and is not transferred outside India in the ordinary course of providing the Service. Any change to this position will be addressed in line with the DPDP Act and applicable government notifications.

7. Retention

Personal data is retained for as long as needed to provide the Service to the Institution and to meet legal, accounting, and audit obligations. On termination, Customer Data is handled as described in our Terms of Service.

[[COUNSEL REVIEW: retention periods — define specific retention periods per data category (e.g., academic records, attendance, fee/payment records, audit logs), the deletion/anonymisation timeline after account termination, and any statutory minimum-retention requirements applicable to Indian educational records. Align with the Terms of Service exit clause.]]

8. Security safeguards

AskCampus is built to protect personal data with reasonable security safeguards designed to include:

  • encryption of data in transit and at rest;
  • role-based access controls and the principle of least privilege;
  • multi-tenant isolation so that each Institution's data is logically separated;
  • audit logging and monitoring; and
  • regular backups and access reviews.

For more detail, see our Security page. No system can be guaranteed to be perfectly secure, and we continuously work to improve our safeguards.

9. Your rights as a data principal

Under the DPDP Act, data principals have rights including:

  • Access — to a summary of the personal data being processed and the processing activities;
  • Correction & updating — to have inaccurate or incomplete data corrected or completed;
  • Erasure — to have personal data erased where it is no longer needed and retention is not legally required;
  • Grievance redressal — to raise a grievance with the Data Fiduciary; and
  • Nomination — to nominate another individual to exercise rights in the event of death or incapacity.

Because AskCampus usually acts as Processor, requests relating to student, parent, or institution data should ordinarily be directed to the relevant Institution (the Data Fiduciary). Where we are the Data Fiduciary (account and billing data), you may contact our grievance officer below. We will assist Institutions in responding to verified data-principal requests.

10. Cookies & tracking

This website and the application use cookies and similar technologies that are necessary for functionality (such as authentication and session management) and, where applicable, to understand usage. We do not use cookies for behavioural advertising directed at children.

[[COUNSEL REVIEW: confirm the actual cookies / analytics used on the marketing site and in-app, whether any third-party analytics or advertising pixels are present, and what consent banner (if any) is required.]]

11. Breach notification

If a personal-data breach occurs, AskCampus will, in its capacity as Processor, notify the affected Institution(s) without undue delay so that the Institution can meet its obligations to notify the Data Protection Board of India and affected data principals as required under the DPDP Act. Where AskCampus is the Data Fiduciary, we will make the required notifications directly.

12. DPO & grievance officer

You can contact our Data Protection / Grievance Officer at our Data Protection & Grievance Officer (hello@askcampus.in). For grievances relating to the platform, you may also reach our Grievance Officer (hello@askcampus.in). General support questions can go to sales@askcampus.in.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date and, for material changes, provide reasonable notice.

14. Contact

Questions about this Privacy Policy can be sent to our Data Protection / Grievance Officer at our Data Protection & Grievance Officer (hello@askcampus.in), or by post to Bangalore, Karnataka, India.