Privacy, in plain words

Who we are, and two different roles

EduWeave is a school platform run by [Legal entity name], [Registered address]. We play two different roles, and the rules for each are different.

For everything a school puts into EduWeave, the school decides why and how the data is used. The school is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. We are its Data Processor and act only on the school's instructions.

For the enquiries sent through this website, we decide. We are the Data Fiduciary for those.

What we collect

• On this website. The name, email, school, role and message you type into Talk to us, and the name, email, school, role, demo day and time you pick in Book a demo. Nothing else is asked.
• For the sample school. The email and role you give to get a link in. We email you one link, which works once and expires in 30 minutes. Only if you tick the second box do we tell our team you asked, so that we can contact you. What anyone types inside the sample school is made-up and is erased every night.
• For a school's accounts. What the school and its families enter: students, parents, staff, attendance, homework, marks, fees, notices, messages and questions to teachers.
• For fees. Fee records, and the status of a payment. Card, UPI and bank details go to the payment gateway, not to us.
• For school transport. A school using bus routes enters stops, vehicles and drivers, and may track a bus run. This is for the safety of the children on it.
• To keep the service safe. Sign-in records, the actions people take, and the time and address a request came from.

Why we use it

Only for the job it was given for.

• Enquiries. To reply, and to book and run a demo.
• Schools. To run the school's service for the school: show each person what their role allows, send the notices and pushes the school's rules call for, and produce reports and receipts.
• Security. To keep accounts safe, find misuse and fix faults.

We do not sell personal data. We do not show advertising in the product. We do not use a child's data to build an advertising profile.

Children's data

A child is anyone under 18. The Act asks for a parent's consent before a child's data is processed, and does not allow tracking, behavioural monitoring or targeted advertising aimed at children. It makes a narrow exception for a school: tracking and monitoring that is only for the school's educational activities, or for the safety of the children enrolled. School transport has a matching exception for tracking a child's location in the interest of safety during the journey.

EduWeave is built inside that line. What follows is how.

• No private channel. No adult can talk to a child in private. Every teacher-student and teacher-parent surface carries parent visibility and school oversight, and a school cannot switch that off.
• Parents read the questions. A student's questions to a teacher are read by the student, the teachers and both parents. They are not read by the office.
• Younger children. Classes 1 to 5 get a read-only view. No submissions, no exams, no questions to teachers and no AI.
• Children are not labelled. No child is banded or ranked as a label. A note written about a child says who released it.
• No advertising. No ads, and no tracking for ads, anywhere in the product.

AI

AI only advises. A person reviews every AI output before anything follows from it. A note that rests on thin evidence is left out. A note that follows a recent concern, or falling marks, waits for the teacher before it goes to a family.

Which AI features a school has depends on its plan. Where a feature runs, the text for that task goes to an AI model provider that EduWeave uses. The provider is listed under the sub-processors below.

Who else handles it

We use outside services to run EduWeave. Each handles data only to do its own job for us, under a written contract. We name the kinds here.

The school's own people see data according to their role. Nobody at another school sees it.

• Cloud hosting and database. Stores the school's records.
• File storage. Stores uploaded documents and images.
• Email delivery. Sends sign-in, notice and enquiry emails. The provider is Resend.
• Payment gateway. Takes fee payments. The provider is Razorpay. We check each payment's signature before an instalment is marked paid.
• Maps. Draws bus routes and finds places. Google Maps, or OpenStreetMap services where the school has no map key.
• AI model provider. Runs the AI features a school's plan includes.

We share data when the law or a court requires it, and with the school it belongs to. Data may be processed outside India. The Act allows this except to countries the Government of India restricts, and we will name where in the notice we give each school before the rules take full effect.

How long we keep it

• A school's data. For as long as the school's account needs it. When the agreement ends, the school can export its data. After that we erase it, except what a law makes us keep.
• Logs. Records of who did what are kept for at least one year, because the rules require it for detecting and investigating a breach.
• Enquiries and sample school links. For as long as it takes to reply and follow up. The link itself expires after 30 minutes. Ask us at any time to erase yours.

How we protect it

• Each school is kept apart. A request is tied to one school. Authorization comes from who is signed in, never from a header alone.
• Roles decide what you see. Five roles, four portals. A teacher sees their own classes. A parent sees their own children.
• Sign-in. Four sign-in pages, one for each role. A parent has one account across the schools their children attend.
• In transit. Everything travels over an encrypted connection.
• A record of actions. Important actions are logged.
• Payments. Verified by signature before they count.

If a breach affects a school's data, we tell the school without delay so that it can tell the families and the Data Protection Board. The law asks for full particulars to the Board within 72 hours, and we work to that.

Your rights, and how to use them

You can ask to see the data held about you, to correct it, to erase it, and to withdraw consent. You can name someone to act for you if you cannot. For a child, a parent or guardian makes the request.

• For school data. Ask the school first. It is the Data Fiduciary and decides. We help it respond.
• For website enquiries, or if the school cannot help. Write to contact.us@eduweave.io. We will tell you what we did.
• If you are not satisfied. Write to our grievance officer, [Grievance officer name], at contact.us@eduweave.io. We reply as soon as we can, and in any case within 90 days. If it is still not settled, you can complain to the Data Protection Board of India.

Cookies

This website sets no advertising or analytics cookies, and loads no tracker. Signing in to a portal sets the cookies that keep you signed in, and nothing else.

The law this follows

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified in November 2025. Most of the duties on Data Fiduciaries begin in May 2027. We built to them now. Until then the Information Technology Act, 2000 and its rules on sensitive personal data still apply, and we follow them too.

Changes and contact

If we change this page in a way that matters, we say so at the top of this page and tell each school. The date above is the date of the last change.

Questions: contact.us@eduweave.io.