Privacy Policy

1. Who this policy covers

InstituteSathi is a platform. Each coaching institute that uses it ("the institute") runs its own space on the platform, with its own students, teachers and staff.

• For students, teachers and staff of an institute, the institute decides why and how your data is used. It is the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act). We, [Registered business name], handle your data on the institute's behalf, as its service provider ("Data Processor").
• For institute owners and admins who sign up, and for visitors to our website, we are the Data Fiduciary.

Your institute may also have its own rules (for example, fee terms shown while you register). Those apply in addition to this policy.

2. What we collect

Account details

Name, email address, phone number, role (student, teacher, telecaller, admin) and a password. Passwords are stored only as a one-way hash.

Admission and identity details

When a student registers for a course through an institute's registration link, the institute can collect: date of birth, address, two ID proofs (photo or PDF), a live photo (selfie) for face verification, a signature image and acceptance of the course terms. These are used by the institute to verify who is enrolling.

Learning activity

Batches and courses, attendance, assignments and submitted files, exam answers and scores, study material and recordings you open, and certificates issued to you.

Fee and payment records

Amounts, dates, instalment schedules, receipt numbers, payment method and the Razorpay order and payment reference numbers. See Payments below.

Enquiries

Name, phone number, email and notes about people who enquire about a course, entered by an institute's admin or telecallers.

Messages

Notifications, chat messages inside the dashboard, and emails the institute sends through the platform (such as fee reminders and password-reset links).

Technical data

Basic server logs such as IP address, browser type and the time of requests, kept to keep the service secure and working.

3. Why we use it

• To create and run your account and show you the right dashboard.
• To let the institute verify admissions, manage batches, take attendance, run exams and issue certificates.
• To collect fees, record payments, issue receipts and remind you before a fee falls due.
• To send you service messages (password reset, fee reminders, notices from your institute).
• To keep the platform secure, prevent fraud and fix problems.
• To meet legal, accounting and tax requirements.

We use your data for these purposes and not for advertising. We do not sell personal data. Where the law requires your consent, the institute or we ask for it when the data is collected, and you can withdraw it (see Your rights).

4. Who we share it with

Your institute. Its admin, and the teachers and telecallers it chooses, can see the data of its own students. Other institutes on the platform cannot.

We use a small number of service providers to run the platform. They process data only to provide their service to us:

• Razorpay – online fee payments (see below).
• Cloudinary – storage of uploaded files such as ID proofs, selfies, signatures, assignments and certificate templates. Identity documents are kept as private files that have no public link.
• MongoDB Atlas and our hosting provider – where the application and its database run.
• Google (Gmail and YouTube) – emails go out from the institute's own Gmail account; if an institute chooses YouTube for class recordings, those videos are stored on its own channel.

We may also disclose data when a court, regulator or law-enforcement authority legally requires it, or to protect people's safety and our rights.

Some of these providers keep data on servers outside India. We choose providers that use industry-standard security, and we share only what each service needs.

5. Payments

Fees are paid to the institute through the institute's own Razorpay account. The money goes to the institute, not to us. Your card, UPI or bank details are entered on Razorpay's secure checkout. We never see or store them. We keep only the amount, date, status and Razorpay reference numbers, so the payment can be shown in your history and on your receipt.

Razorpay handles your payment details under its own privacy policy.

6. Cookies and local storage

We use one essential cookie that keeps you logged in. It is not readable by scripts on the page and is not used for tracking. We also save your light/dark theme choice in your browser. We do not use advertising or cross-site tracking cookies.

7. How long we keep it

• Account and learning data: while the account is in use, and afterwards for as long as the institute needs its records or the law requires.
• Payment and receipt records: kept for the period required by accounting and tax law. For this reason they cannot be deleted on request, but they are never used for any other purpose.
• Identity documents: kept with the admission record for as long as the institute needs them. The institute can remove them when no longer needed.
• Enquiries: until the institute deletes them or the enquiry is converted into an admission.

When data is no longer needed and no law requires us to keep it, it is deleted or made anonymous.

8. How we protect it

• Connections use HTTPS.
• Passwords are hashed; payment keys and email passwords are stored encrypted.
• Identity documents are stored privately and opened only by the institute's admin through short-lived secure links.
• Each institute's data is separated from every other institute's.
• Payments are verified on our server against Razorpay before they are recorded.

No system is perfectly secure, but we work to keep your data safe and fix weaknesses quickly.

9. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data held about you and how it is used;
• ask us or your institute to correct inaccurate data or complete missing data;
• ask for your data to be erased, except where the law requires us to keep it (for example payment records);
• withdraw consent you gave, which may mean we can no longer provide some features;
• get your complaint heard and resolved (see Grievance Officer below);
• nominate another person to exercise these rights if you die or cannot do so.

To use these rights, write to [privacy email] from the email address on your account. If you are a student, you can also ask your institute directly. We aim to reply within 30 days. If we are not able to resolve your complaint, you can approach the Data Protection Board of India.

10. Children and minors

Many students are under 18. The institute must get a parent's or legal guardian's consent before enrolling a minor and before it collects that child's personal data. We do not show advertising to students, we do not track them for advertising, and we do not use their data in ways that could harm them.

If you are a parent or guardian and want to see, correct or delete your child's data, contact the institute or write to us at the privacy address above.

11. If something goes wrong

If a personal-data breach affects you, we will tell the institute and, where the law requires, the Data Protection Board and the people affected, explaining what happened and what you can do.

12. Grievance Officer

Write to the Grievance Officer with your name, the email on your account and the details of your complaint. We acknowledge complaints promptly and aim to resolve them within 30 days.

13. Changes to this policy

We may update this policy when the platform or the law changes. The "Last updated" date at the top shows the latest version. For significant changes we will tell account holders through the dashboard or by email.