Privacy Policy.

1. Information We Collect

We collect different categories of information, depending on how you use the Platform. Broadly, the data can be divided as follows:

• Institutional Data (Data Provided by Institutions): Institutions may upload or enter information about their students, staff, academic records, attendance, fee payments, and other operational data into the Platform. This includes personal details such as names, dates of birth, contact information (email, phone, address), identification numbers, school records, attendance logs, and financial records.
• Account and Profile Information: When an individual user creates an account, we collect personal identifiers such as name, email address, and login credentials (passwords are stored in encrypted form). We may also collect profile details like job title, department, role within the Institution, and profile photo if provided.
• Communications and Support: We store information you provide when contacting support (support@arzavo.com) or providing feedback, including the content of emails or tickets and any attachments.
• Usage and Technical Data (Automatically Collected): When you access or use the Platform, we automatically log technical data about your device and connection, including IP address, device type, operating system, browser type, access times, pages/features used, and error logs.
• Third-Party Authentication Data: If you choose to log in using third-party services (e.g. Google or Microsoft single sign-on), we collect the information that those services provide with your consent (typically name, email, and unique ID).
• Payment Information: We do not directly collect full credit card information. Payment transactions (for paid plans) are processed through Razorpay (India) or other PCI-compliant gateways. We may record transactional data such as the amount charged, date of payment, and invoice details.
• Communications Data: If enabled by the Institution, we may send notifications (email, SMS, WhatsApp messages, push notifications) to you on behalf of the Institution.

2. How We Use Information

We use the collected data for the following purposes:

• Providing the Service: To perform the core functions of Arzavo, rendering the software features subscribed to by your Institution.
• Account Management: To send you account-related notifications (e.g. password resets, important updates, or invoices).
• Customer Support: To assist you and improve our support process when you reach out for help.
• Payment Processing: To bill for subscriptions, process refunds, and maintain accounting records.
• Security and Fraud Prevention: To monitor use patterns and log data to detect and prevent security incidents or unauthorized access.
• Product Improvement: To analyze usage data (in aggregate form) to understand feature adoption and improve Platform usability.
• Legal and Compliance: To comply with legal obligations (such as tax and accounting laws) or to enforce our Terms of Service.

We never sell your personal data or use it for unrelated marketing purposes.

3. Data Sharing and Disclosure

We engage trusted third parties to perform services on our behalf:

• Cloud Infrastructure: Amazon Web Services (AWS) hosts our servers in the Mumbai region under strict data protection compliance.
• Content Delivery and Security: We use Cloudflare to accelerate delivery and protect against security attacks.
• Payment Gateway: Razorpay (India) processes subscription payments securely.
• Email, SMS and Push Notification: We use certified email and messaging providers (e.g. Twilio) to deliver communications.
• Analytics and Monitoring: Google Analytics and error tracking tools collect limited metadata to help us optimize the platform.

Each such provider is contractually obligated to protect data and use it only to perform its function. We do not share data with third parties for their own marketing purposes.

4. Data Retention and Deletion

We retain personal data as long as the Institution’s account is active and as needed to provide the service:

• Account Data Deletion: Upon deletion requests, we purge personal records. Certain administrative records (invoices, basic customer info, payment confirmations) are kept for up to 8 years for statutory compliance with tax and company law.
• User-Initiated Deletion: Individual users may request deletion of their personal accounts. We remove personal profile info within 30 days.
• Children’s Data: If we are notified of accidentally collecting children\'s data without parental consent, we will promptly delete it.

5. Data Security

We implement industry-standard technical measures (TLS/HTTPS in transit, encrypted storage, and access controls) to protect data confidentiality. While we strive to protect data, no system is 100% secure, and we continually assess risks and improve safeguards. If a breach occurs, we follow legal requirements to notify affected parties.

6. Your Rights

Under the DPDP Act and related laws, you have certain rights regarding your personal data:

• Access and Correction: Request confirmation of what data we hold and request corrections.
• Erasure: Request deletion of your personal data, subject to tax and company law retention requirements.
• Grievance Redressal: Raise concerns directly to our Grievance Officer (contact details below).
• Consent Withdrawal: Withdraw consent for marketing or communication activities at any time.

Since the Institution is the Data Fiduciary, requests regarding student information should be directed to the Institution's administrator.

7. Children’s Privacy

If any personal data collected pertains to children (individuals under 18), the Institution must ensure parental consent has been obtained. Arzavo does not knowingly collect personal data directly from children without parental consent. Parents/guardians can request information or deletion of a child’s data through the Institution.

8. Cookies and Tracking

Our Platform uses cookies and similar technologies to store preferences, sessions, and track usage statistics (Google Analytics). You can control cookies through browser settings, though disabling them may limit some site functionalities.

9. Governing Law and Disputes

This Privacy Policy is governed by the laws of India. Any disputes related to this Policy or Arzavo’s data practices will be subject to the exclusive jurisdiction of courts in Ghaziabad, Uttar Pradesh. We reserve the right to modify this Policy at any time.