Privacy Policy

EDU OS (operated by Easeprime) · Last updated: 9 May 2026 · Effective: 9 May 2026

In short: EDU OS is a school-management platform. Your school is the data controller; we are the data processor. We collect only what schools, staff, parents, and students need to use the app — no advertising, no third-party tracking, no resale of data.

1. Who we are

“EDU OS” (the “app”) is operated by Easeprime (“we”, “us”, “our”), with offices in India. Contact: thebaaponline@gmail.com.

EDU OS is a multi-tenant Software-as-a-Service product used by educational institutions. When your school subscribes, the school is the Data Fiduciary (controller) under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). We act as the Data Processor on the school’s behalf.

2. What information we collect

2.1 Information you provide

Account details: name, email, phone number, password (stored as a bcrypt hash), profile photo (optional).
Student information (provided by your school’s admin or guardian): full name, admission number, date of birth, gender, class, section, guardian name, guardian contact, emergency contact.
Academic records (entered by teachers and admins): attendance, exam marks, fee structures, fee payments, comments, report cards.
Communications: announcements, messages, and notification preferences.

2.2 Information collected automatically

Device & app diagnostics: crash reports, app version, OS version, device model, IP address (only at the moment of an API request — not stored long-term).
Push-notification tokens issued by Firebase Cloud Messaging or Apple Push Notification Service — used solely to deliver notifications.

2.3 Payment information

Fee payments are processed by Razorpay Software Pvt. Ltd. Card numbers, UPI IDs, bank credentials, and CVVs are never seen, stored, or transmitted by EDU OS. We receive only a payment-success token and the transaction amount, and store the Razorpay payment ID for reconciliation. Razorpay’s privacy policy applies: razorpay.com/privacy.

3. How we use your data

We process your data only to:

Authenticate users and maintain sessions.
Display academic, attendance, and fee information to authorised users (admins, teachers, parents, students of the same school).
Send transactional notifications (fee due, attendance alert, exam result published, school announcement).
Process fee payments via Razorpay.
Diagnose crashes and improve reliability (via Sentry).
Comply with legal obligations and respond to lawful requests from authorities.

We do not use your data for advertising, do not sell or rent it, and do not allow third parties to use it for their own purposes.

4. Lawful basis for processing

Under the DPDP Act and applicable laws, we rely on the following bases:

Consent: for processing personal data of users above 18.
Legitimate use (Section 7 DPDP): for processing necessary to provide the contracted school-management service.
Verifiable parental consent: for processing personal data of children under 18, obtained by your school’s admin during onboarding.

5. Children’s data

EDU OS contains data about students, many of whom are under 18. We do not collect children’s data directly from children — it is provided by the school administration with parental consent. We do not display advertising, do not track children for marketing, and do not profile children. Parents may, at any time, request access to or deletion of their child’s data through the school administration or by emailing us.

6. Data we share

We share data only with:

Recipient	Purpose	Location
Supabase (PostgreSQL hosting)	Primary database	Mumbai (ap-south-1), India
Railway	API hosting	USA
Vercel	Web frontend hosting	USA
Razorpay	Payment processing	India
Firebase Cloud Messaging (Google)	Push notifications	USA / multi-region
Apple Push Notification Service	iOS push notifications	USA
Resend	Transactional email	USA
Sentry	Crash reporting (anonymised stack traces)	USA / EU

All providers are bound by data-processing agreements that prohibit secondary use of your data.

7. Cross-border transfers

Some of the providers above operate outside India. Where data is transferred outside India, we rely on contractual safeguards equivalent to Indian standards. The Indian government may, under the DPDP Act, restrict transfers to certain jurisdictions; if required, we will adapt promptly.

8. Data retention

Active accounts: retained for the duration of your school’s subscription.
Cancelled subscriptions: data is exported to the school admin on request, then deleted within 30 days unless the school requests longer retention for legal or audit reasons.
Audit logs (PIN resets, payment events): retained for 7 years to comply with financial-record-keeping rules.
Crash reports: 90 days, automatically purged.

9. Security

We implement industry-standard safeguards:

HTTPS / TLS 1.2+ for all data in transit.
Passwords and PINs hashed with bcrypt (10 rounds); never stored in plain text.
JWT bearer tokens for authentication; tokens are short-lived (4 hours by default).
Database access locked to our application servers via private networking.
Rate-limiting on login endpoints to prevent brute-force attacks.
Razorpay payments verified via HMAC-SHA256 signature checks.

10. Your rights

Under the DPDP Act and other applicable laws, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data (subject to legal-retention obligations).
Withdraw consent at any time.
Nominate a representative to act on your behalf.
File a complaint with the Data Protection Board of India.

To exercise any right, email thebaaponline@gmail.com with the subject “Data Request”. We will respond within 30 days.

11. Account deletion

You can request deletion of your EDU OS account by:

Asking your school administrator to remove you (preferred — keeps academic continuity intact for the school), or
Emailing thebaaponline@gmail.com with the subject “Delete my account”.

Within 30 days, we will delete your personal identifiers (name, email, phone, profile photo) from our systems. Aggregated and anonymised records (e.g., historic class attendance counts) may be retained.

12. Permissions used by the app

Permission	Why
Internet	Connect to our API.
Notifications	Deliver fee, attendance, and announcement alerts.
Camera (optional)	Scan QR codes (e.g., student-code login QR).
Photo Library (optional)	Set or update a profile picture.

All optional permissions are requested only when the user explicitly chooses the relevant feature.

13. Cookies and similar technologies

The mobile app does not use cookies. The web dashboard uses essential first-party cookies for session management only (no advertising or analytics cookies).

14. Changes to this policy

We may update this policy. Material changes will be notified in-app and via email at least 7 days before they take effect. The “Last updated” date at the top reflects the most recent revision.

15. Grievance Officer

In compliance with the DPDP Act and the Information Technology Rules, 2011:

Name: Vikas Anand
Email: thebaaponline@gmail.com
Response time: within 24 hours of acknowledgement; resolution within 15 days.

16. Contact us

Questions about this policy? Email thebaaponline@gmail.com.