Data Protection & Security

Schools trust EduNest with sensitive student, parent, staff, attendance, academic, fee, and operational records. Many of these records relate to children, so EduNest is designed around careful data handling, school-level isolation, role-based access, and clear controls for export and deletion.

Your Data Belongs to Your School

Everything a school enters into EduNest belongs to that school. This includes student records, attendance, marks, fee records, parent contact details, homework, timetables, and staff records. EduNest does not sell this data, use it for advertising, or share it except with providers needed to operate the platform.

In data-protection terms, the school is the Data Fiduciary and EduNest is the Data Processor. EduNest processes school data only to run the service and only on the school's instructions.

How We Protect Children's Data

• Children's data is used only to provide EduNest to the school.
• Children's data is not used for advertising.
• EduNest does not track, profile, or monitor children for advertising or unrelated commercial purposes.
• EduNest does not sell children's data or any personal data.
• The school is responsible for obtaining verifiable parental consent where required by law.

This approach is intended to align with India's Digital Personal Data Protection Act, 2023. As the rules under the Act continue to come into force, EduNest will update its practices where required.

How Your Data Is Secured

Where Your Data Lives

EduNest is designed to host school data in India, currently using Supabase infrastructure in the Mumbai / ap-south-1 region. Some service providers may process limited operational data, such as email or messaging logs, outside India where needed to provide their services. Where they do, we take steps to keep the data protected.

Our Service Providers

EduNest uses a small number of providers to operate the service:

• Supabase for database and hosting;
• Razorpay for payment processing;
• Resend for operational emails;
• WhatsApp or messaging providers where alerts are enabled by the school.

These providers are used only to operate EduNest and provide the configured service.

Getting Your Data Out, or Deleting It

School data is not locked in. A registered school administrator can request a full CSV export by emailing hello@edunest.online from the registered school administrator email address.

A registered school administrator can also request deletion of the school's data by emailing the same address. EduNest verifies export and deletion requests before processing them because school data is sensitive. Deletion is permanent, subject to any records legally required to be retained.

If Something Goes Wrong

No system is perfectly secure. If EduNest becomes aware of a data breach affecting a school's data, we will notify the affected school without undue delay and work with the school to address the issue, consistent with applicable law.

Questions or Concerns

For data protection questions, security questions, grievances, export requests, or deletion requests, contact hello@edunest.online.