Privacy Policy

Last updated: 25 October 2026 · Applies to the School Sphere web application and the School Sphere Student, Teacher and Staff mobile apps

In short. School Sphere is school software. Your school decides what information it keeps about students, parents and staff and why; School Sphere stores and processes it on the school's behalf, and only for running the school's services. We do not show advertising, sell personal data, or track people across other apps or websites.

1. Who this policy covers

School Sphere is used by schools. An account is created by the school for its students, parents or guardians, teachers and other staff; people cannot sign up on their own. You can only see information the school has linked to your account: a parent sees their own children, a teacher sees their own classes, and staff see only the areas their school's roles and permissions allow.

For the information held about the people in a school, the school is responsible for deciding what is collected and how it is used, and School Sphere acts as the school's processor, handling it on the school's instructions. For anything about your own records, please contact your school first.

2. What we collect and why

Information	Why it is used
Account details: name, email address, role, the school and branch you belong to, and your chosen interface language	To sign you in, show the right information and show the app in your language.
School records: class and section, timetable, attendance, homework and submissions, exam marks and results, online exam answers, fees and receipts, library loans, transport route, certificates; for teachers and staff also staff records and leave	To provide the school's day-to-day services in the apps and website.
Student profile details entered by the school: date of birth, address, guardian contacts, emergency contact and health notes the school chooses to record	School administration, safety and contacting families. Health notes are shown only to staff the school authorises.
Messages, notices and leave requests you send or receive, and delivery status of SMS, email, WhatsApp and push messages	To deliver them to the right teacher, parent or student and to show whether they were delivered.
Attendance by QR pass, card or biometric device: scan time and result, which device or session recorded it	To mark attendance accurately and let the school review exceptions.
Face attendance (only if your school switches it on): a face photo and a numeric template used for matching, together with the consent record	To recognise students or staff for attendance. It needs the consent of the person, or of a parent or guardian for a child, and can be withdrawn; the template is then removed.
Online exam proctoring (only for exams that use it): events such as leaving the exam page or full-screen, and, for webcam exams, camera photos at set intervals	To help teachers review exam integrity. Students are shown exactly what is recorded and agree before a proctored exam starts. A flag is a prompt for a person to look, not a finding.
Visitor records: name, phone number, ID-proof type and number, purpose of visit, who is being visited, arrival and departure times and a visitor pass	Campus safety. The school may check names against its own visitor watchlist.
Payments: fee invoices, the result of an online payment, a payment reference and receipt number	To record fee payments. Card, UPI and bank details are entered only on the payment provider's own page and are never received or stored by School Sphere.
Online classes: your camera and microphone while you are in a live class, if you turn them on	To take part in the class. Your school may record classes; recordings are kept by the school.
Bus location (drivers only, if the school uses driver phone tracking): the phone's position while a trip is on	So parents and the school office can see where the bus is. Sharing stops when the driver ends the trip or closes the app, and only the latest position is kept.
Device and notification token	To send school notifications to your phone. It is removed when you sign out.
Technical logs and crash reports: IP address, time, and a report with technical details if the app crashes	To keep the service secure and fix faults. Crash reports do not include names, emails, phone numbers or passwords.
Public certificate checks: when someone scans or opens a certificate's verification link, a one-way fingerprint of their network address and the time	To limit abuse of the public check. The page shows only who the certificate was issued to, its type and number, and whether it is still valid.

We do not use your contacts or photo library, and we do not use your data to build advertising profiles.

3. Phone permissions

The mobile apps ask for a permission only when a feature needs it, and you can change it at any time in your phone's settings.

Camera: to join a live class with video, or (Teacher and Staff apps) to scan QR codes for attendance, visitor passes and certificates. Pictures from QR scanning are read on the phone and are not saved or uploaded.
Microphone: only in live classes and voice questions to the AI assistant.
Location: only for bus drivers while a trip is running (foreground only).
Notifications: school announcements, messages and reminders.
Storage on your phone: a language choice and, for teachers, attendance registers saved while there is no connection, which are sent when you are back online. Signing out removes them.

4. Children's data

Many students are under 18. The school collects and uses a child's data for education and school administration and, where the law requires, with the verifiable consent of a parent or guardian, for example for face attendance. Students and parents can ask the school to see, correct or delete the child's data (see section 7). We do not send advertising to children and do not track children's behaviour for advertising.

We do not sell personal data. We use service providers that process data only to provide their service:

Hosting and storage: cloud servers, a managed database and file storage (Microsoft Azure).
Payments: the payment provider(s) your school has chosen, such as Razorpay, Cashfree, PayU or Stripe, on their own secure pages.
Messaging: the SMS, email and WhatsApp providers your school has chosen.
Push notifications: Expo, Google (Firebase Cloud Messaging) and Apple.
Live classes: a LiveKit media server.
Crash reporting: Sentry.
AI assistant (where a school has enabled it): questions are answered using only what your account is allowed to see.

We may also disclose information when required by law or to protect safety. Within a school, information is shown only to people whose role allows it.

6. How long data is kept

School records are kept for as long as the school needs them and as the law requires. Some records are removed automatically on a schedule, which the school can change; by default visitor ID-proof details and visitor scan records are removed after 90 days, public certificate-check records after 180 days, and proctoring photos and events after the retention period set for the exam. Face templates are removed when consent is withdrawn. When a school ends its service, its data is deleted or returned as agreed with the school.

7. Your choices and rights

You can ask to access, correct or delete your information, withdraw a consent you gave (for example for face attendance), or close an account. Because the school is responsible for its records, please send requests to your school; the school can act on them directly and we will help the school do so. Under India's Digital Personal Data Protection Act, 2023 you also have the right to grievance redressal and to nominate someone to act for you. If you cannot reach your school, or are not satisfied, contact us (section 11).

You can turn off notifications, the camera, the microphone and location in your phone's settings, and sign out at any time.

8. Security

Data is sent over encrypted connections (HTTPS). Sign-in tokens are kept in the phone's secure storage (Keychain or Keystore). Payment-gateway keys and messaging-provider secrets saved by schools are encrypted. Access is limited by role and permission, sign-in and public look-ups are rate-limited, and changes to attendance are recorded. No system is perfectly secure; if we learn of a breach affecting personal data we will tell the affected school without undue delay.

9. Where data is stored

Data is stored on cloud servers in the region chosen for the deployment. Service providers listed above may process limited data (for example a push token or a crash report) in their own locations, under their own security terms.

10. Changes to this policy

We may update this policy as the product changes. The date at the top shows the latest version. If a change is significant we will tell schools so they can inform their students and parents.

11. Contact

For questions about this policy or to raise a privacy concern with School Sphere:

For anything about a student's or staff member's records, contact the school directly.