Privacy Policy.

At Klasso (operated by Klasso Technologies Private Limited (incorporation pending in India); hereinafter "Klasso", "we", "us", or "our", developer of Klasso and the klasso-app Google Cloud project), we build software for K-12 schools, parents, teachers, and students. With that comes a profound responsibility to protect sensitive personal data. This Privacy Policy outlines how we collect, use, store, share, and protect your data across our web platform (https://myklasso.in), web administration consoles, and mobile applications, structured strictly around the requirements of the Digital Personal Data Protection (DPDP) Act 2023 and the Google API Services User Data Policy.

Under the DPDP Act 2023, our partner schools act as Data Fiduciaries (the primary controllers of their student and staff data), and Klasso acts as a Data Processor operating strictly under their documented instructions. For direct parent account creation, verification, and support requests, Klasso acts as a Data Fiduciary.

Section 01

The Data We Collect

We collect and process personal data solely to the extent necessary to deliver the Klasso school management platform (klasso-app). Categories of data collected include:

• From Schools & Administrators: Administrative credentials, employee codes, staff directories, and academic operational structures.
• From Parents & Guardians: Full name, verified mobile phone number, email address, relationship to student, residential address, and communication logs.
• From Students (via School Fiduciaries): Full name, date of birth, gender, admission/roll number, grade/class, section, academic marks, exam grades, attendance logs, and timetable schedules.
• Financial & Fee Records: Invoices, payment transaction references, payment mode, amount, and fee receipts. All digital payments are processed through Razorpay (RBI-authorized PCI-DSS Level 1 payment aggregator). Klasso servers never store or collect raw credit/debit card numbers or CVVs.
• Transport & GPS Data: For schools using our transport module, real-time GPS vehicle coordinates, route numbers, stop timestamps, and driver contact verification.
• Technical & Device Data: Device model, operating system version, browser user agent, IP address, and Firebase Cloud Messaging (FCM) push notification tokens necessary for urgent school alerts.

Section 02

Google User Data & API Limited Use Disclosure

Klasso (klasso-app) allows users to authenticate using their Google accounts via Sign in with Google. Our collection, access, use, storage, and sharing of information received from Google APIs is strictly governed by this section:

• Google Scopes Requested: Klasso requests only basic authentication scopes: openid, .../auth/userinfo.email, and .../auth/userinfo.profile.
• Types of Google User Data Accessed: We access only your Google account identifier (subject ID), verified email address, full display name, and avatar/profile picture URL. We do NOT request access to Google Drive, Google Contacts, Google Calendar, Gmail, or any other sensitive/restricted Google scopes.
• How We Use Google User Data: Google user data is used exclusively to authenticate your identity, create or link your authorized user profile in the Klasso school portal, and display your name and profile picture on your dashboard.
• How We Store Google User Data: Google user data (name and email) is stored in our primary database with AES-256 encryption at rest and TLS 1.3 encryption in transit. Authentication tokens are securely signed and managed via JWT session tokens.
• Sharing of Google User Data: We do NOT sell, rent, trade, or transfer Google user data to third parties, advertising networks, data brokers, or commercial aggregators. Data is shared only with our cloud hosting provider (Supabase on AWS Mumbai) strictly to run the service.
• Google API Services User Data Policy Compliance: Klasso's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• No AI/ML Model Training: Klasso strictly does not use Google user data to develop, train, or improve generalized artificial intelligence (AI) or machine learning (ML) models.
• No Human Access: No human employees or contractors are permitted to read Google user data unless the user provides explicit written consent for troubleshooting, it is necessary for security incident response, or required by applicable law.

Section 03

Purpose of Data Processing

We enforce strict purpose limitation under the DPDP Act 2023. Personal data is used exclusively to:

• Authenticate and manage user accounts across school tenants with multi-role permissions (Admin, Teacher, Parent, Student).
• Deliver essential school operations (such as marking attendance, calculating CBSE/ICSE grades, and generating digital report cards).
• Process fee payments and generate automated GST-compliant electronic receipts.
• Dispatch critical school notices, emergency weather alerts, unexcused absence alerts, and bus ETA notifications via SMS, WhatsApp, and push notifications.
• Maintain cryptographic tenant isolation, prevent unauthorized access, and conduct security audits.

Section 04

Storage, Residency & Security Architecture

All primary databases, file attachments, and automated backups are hosted entirely within the Mumbai, India (AWS ap-south-1) region to guarantee 100% sovereign data residency in compliance with Indian law. We employ defense-in-depth security:

• PostgreSQL Row-Level Security (RLS): Cryptographic isolation at the database layer ensuring data from one school is completely inaccessible to another school.
• Encryption: Enforced TLS 1.3 for all data in transit, and AES-256 encryption for all data at rest and database snapshots.
• Zero PII in Logs: All personally identifiable information (names, mobile numbers, student IDs) is automatically stripped before system diagnostic logs are created.

Section 05

Authorized Subprocessors

Klasso engages vetted third-party infrastructure providers under strict Data Processing Agreements:

• Supabase Inc. / Amazon Web Services: Cloud database and authentication hosting located in Mumbai, India (ap-south-1).
• Google LLC (Firebase): Cloud messaging for mobile push notifications and Google OAuth sign-in.
• Razorpay Software Private Limited: RBI-licensed payment aggregator (PCI-DSS Level 1 compliant) for school fee collection in India.
• MSG91 (Walkover Technologies): TRAI DLT-registered transactional SMS and mobile OTP verification in India.

Section 06

Data Retention & Account / Google Data Deletion

We retain personal data and Google user data only for as long as necessary to fulfill the educational purposes of the school or to comply with statutory educational board record-keeping mandates. Users possess full control over their data retention:

• In-App Deletion: Users may request account and data deletion directly within the Klasso mobile app or web portal by navigating to Profile → Account Settings → Request Deletion.
• Email Deletion Request: Alternatively, users may request immediate deletion of their account, profile, and all associated Google user data by emailing our Grievance Officer at contactklasso@gmail.com with the subject line "Account Deletion Request".
• Deletion SLA: Active authentication sessions and OAuth tokens are revoked immediately. Personal identifiers and Google profile records are soft-deleted within 24 hours, and permanently purged from production databases and backup archives within 30 calendar days.

Section 07

Children's Privacy (Section 9 DPDP Act)

Klasso is engineered for K-12 education, where students are minors under 18 years of age. We strictly comply with Section 9 of the DPDP Act 2023 and COPPA standards:

• Student personal data is processed solely with verifiable parental/guardian consent obtained through the school.
• We strictly prohibit any tracking, behavioral monitoring, or profiling of student activity.
• Zero targeted or commercial advertisements are served to children or parents.

Section 08

Data Principal Rights & Zero Lock-In

Under the DPDP Act 2023, parents, teachers, and schools have the right to request access, correction, updating, or erasure of their personal data. Furthermore, schools maintain 100% data sovereignty:

Section 09

Contact & Grievance Redressal Officer

In accordance with the DPDP Act 2023, Klasso has designated a Data Grievance Redressal Officer. For any privacy requests, questions about data processing, or account deletion assistance, please contact:

• Designation: Data Grievance Redressal Officer
• Entity: Klasso Technologies Private Limited
• Email: contactklasso@gmail.com
• Offices: New Delhi & Kochi, India
• Response SLA: Acknowledgment within 24 business hours; resolution within 30 calendar days.