Privacy Policy

This Privacy Policy explains how Gade Sivasankar Reddy, an individual operating the ANVI EDUERP platform under the name ANVI EDUMART ("ANVI EDUERP", "ANVI", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data when schools and their authorised users access our websites, web applications, mobile applications, and related support services (together, the "Services").

1. Scope

This Policy applies to:

• schools and other educational institutions that subscribe to or evaluate the Services ("Schools");
• school administrators, management staff, teachers, other staff, parents, lawful guardians, and students who use an ANVI account;
• users of the Anvi EduTech Student mobile app, also labelled ANVI EDU Student on the device, which provides student and parent interfaces;
• visitors who use our website, request information, or contact support; and
• personal data processed through ANVI's school administration, academics, attendance, homework, timetable, examinations, reports, circulars, fees, payments, and related modules.

This Policy does not replace a School's own privacy notice or the agreement between ANVI and that School. If a School gives you a separate privacy notice, read it together with this Policy.

2. Our role and the School's role

For personal data that a School or its authorised users enter into the Services, the School generally decides why and how the data is processed. The School is therefore the Data Fiduciary or data controller, as applicable, and ANVI acts as its Data Processor or service provider. We process this "School Data" on the School's documented instructions, under the Terms and any applicable School Agreement, and as required by law.

ANVI may act as a Data Fiduciary or data controller for information that we collect for our own business purposes, including website enquiries, product demonstrations, school onboarding, contracts, billing, security, fraud prevention, and support administration.

Questions about a student's school record should usually be directed to the relevant School first. We will assist the School with valid requests as required by our agreement and applicable law.

3. Personal data we process

The data processed depends on the modules a School enables and how a user accesses the Services.

3.1 Account and identity data

This may include:

• name, email address, phone number, profile image, user identifier, role, account status, and sign-in timestamps;
• School membership, assigned permissions, department, staff role, and teacher assignments; and
• authentication records and security tokens. Authentication is provided through Clerk. ANVI does not store plaintext passwords in its application database.

3.2 School and student records

This may include:

• School name, address, contact details, academic years, classes, sections, subjects, rooms, and timetables;
• student name, admission number, class, section, enrolment status, guardian name, and linked parent or guardian accounts;
• attendance records, leave status, homework, worksheets, instructions, attachments, circulars, and school communications;
• examination schedules, marks, results, publication status, academic progression, promotion, retention, transfer, withdrawal, and graduation records; and
• fee requests, amounts, due dates, payment status, payment-link identifiers, transaction identifiers, and failure information.

Schools may add other information through text fields or attachments. Schools and users must not upload personal data that is unnecessary for the stated educational or administrative purpose.

3.3 Staff attendance and location data

If a School enables location-based staff attendance, the Services may collect the staff member's latitude, longitude, location accuracy, distance from the School, and check-in or check-out time. We use this data only to provide the attendance function, maintain related records, prevent misuse, and meet legal or contractual requirements.

The app should request device location permission before collection. A user can deny or withdraw device permission, but the location-based attendance function may then be unavailable. The School remains responsible for choosing an appropriate attendance policy and lawful basis for staff location processing.

3.4 Files, images, and other content

Where enabled, users may submit profile images, homework attachments, documents, or other content needed for School functions. The app may request access to the camera, photo library, or files only when the user chooses a related function.

3.5 Device, log, and usage data

Our systems and service providers may automatically process IP address, browser type, device type, operating system, app version, timestamps, requested pages or functions, authentication events, error records, and similar technical logs. We use these records to operate, secure, troubleshoot, and improve the Services.

3.6 Website, sales, and support data

When a person requests a demonstration, contacts us, or asks for support, we may collect their name, School, job title, email address, phone number, message, and related correspondence.

4. How we obtain personal data

We receive personal data:

• from Schools and their authorised administrators;
• directly from users who sign in, submit content, make a request, or use an enabled device function;
• from parents or lawful guardians acting for a child;
• automatically from devices and systems when the Services are used; and
• from service providers that support identity, hosting, payments, communications, security, and support.

A School may create an account for a student, parent, or staff member and provide their details to ANVI. The School is responsible for having the authority, notice, and consent required for that disclosure.

5. Why we process personal data

Depending on our role and applicable law, we process personal data to:

• create and secure accounts, authenticate users, and enforce role-based access;
• deliver the modules selected by the School;
• maintain academic, administrative, attendance, fee, and payment records;
• connect students with their authorised parents, guardians, teachers, and School staff;
• send transactional messages, service notices, circulars, and support responses;
• process or reconcile fee-payment events through the School's payment provider;
• diagnose faults, monitor availability, prevent fraud or misuse, and protect users and systems;
• comply with contracts, legal duties, lawful requests, audits, and dispute-resolution requirements;
• improve existing Services using aggregated or de-identified information where practical; and
• send product information to business contacts who request it or where permitted by law. Recipients may opt out of marketing messages.

We do not sell School Data. We do not use student data for targeted advertising. We do not track or behaviourally monitor children for advertising.

6. Children and student data

The Services are designed for educational use and therefore process data about children. Under Indian law, a child generally means a person under 18 for the purposes of the Digital Personal Data Protection Act, 2023.

Where the School is the Data Fiduciary, the School must provide required notices and obtain verifiable consent from a parent or lawful guardian when the law requires it. Where ANVI acts as the Data Fiduciary, ANVI will obtain or document the required consent before processing. Schools must not direct a child to create or use an account unless the School has completed the required authorisation process.

We process children's data only for School administration, education, safety, communication, account access, and related support. We do not knowingly undertake processing that is likely to harm a child's well-being.

For the Anvi EduTech Student mobile app (also labelled ANVI EDU Student on the device), authorised School management provisions student and parent accounts; the app does not offer public self-registration. Parents and lawful guardians use their own linked accounts to monitor their child's School information. An account being created by a School, or a parent using the app, does not by itself establish that all required notices, consent, or other authorisation have been obtained.

Before entering a child's personal data into the Services or enabling the child's access, the School must give the parent or lawful guardian a clear notice describing the data, educational purposes, ANVI's involvement, relevant service providers and international processing, and how to request access, correction, withdrawal, or deletion. The School must obtain and retain the consent or other lawful authorisation required for that processing, using a method that meets applicable verification requirements. A general admission form is sufficient only if it actually covers the proposed processing and satisfies those requirements.

The School must keep an appropriate record of the notice supplied, its version and date, the parent or guardian's identity and relationship as verified by the School, and the authorisation or consent and any withdrawal. Evidence may be held securely in the School's existing records; identity-document copies should not be uploaded to ANVI merely to demonstrate compliance. ANVI may request proportionate evidence or confirmation to address an authorisation concern. If required authorisation is absent or disputed, the School must withhold or suspend the affected access and coordinate with ANVI on restriction or deletion, subject to lawful record-retention requirements.

These School duties do not remove ANVI's own responsibilities for processing on documented instructions, security, service-provider oversight, assistance with rights requests, or any processing for which ANVI determines the purposes and means.

A parent or lawful guardian seeking access, correction, or erasure of a child's School Data should contact the School. The School may ask us to complete the request on its behalf. If the School does not resolve the request, the parent or guardian may contact ANVI at anviedumart@gmail.com; we will coordinate with the School after verifying the requester's identity and authority.

7. Payments

ANVI may generate or display payment links using Razorpay or another payment provider selected for the School. The payment provider processes card, bank, UPI, or other payment credentials under its own terms and privacy policy. ANVI does not store full card numbers, CVV values, UPI PINs, or online-banking passwords.

We may receive and store transaction references, payment-link identifiers, amount, status, timestamps, and failure details to show payment status and reconcile School records. The School remains responsible for its fee policy, invoices, refunds, cancellations, and payment disputes unless a separate written agreement says otherwise.

8. When we share personal data

We may disclose personal data only as needed for the purposes in this Policy:

• to the relevant School and users whom the School has authorised under role and relationship controls;
• to parents or lawful guardians linked to the relevant student;
• to service providers that support identity and authentication, including Clerk;
• to hosting and database providers, including Convex;
• to payment providers, including Razorpay, when a payment function is used;
• to communications, monitoring, security, professional-advice, and support providers under appropriate obligations;
• during a merger, acquisition, financing, reorganisation, or sale of all or part of the business, subject to confidentiality and applicable law; and
• to courts, regulators, law-enforcement agencies, or other parties when the law requires it or when disclosure is reasonably necessary to protect rights, safety, systems, or users.

We require service providers to process personal data only for agreed services and to apply appropriate safeguards. A current list of material service providers is available on request at anviedumart@gmail.com.

9. International processing

Some of our current service providers, including Clerk, Convex, and Razorpay, may process or store personal data outside India. Other providers used to operate the Services may do the same. When personal data is transferred outside India, ANVI and the relevant School will apply contractual, technical, and organisational safeguards and comply with restrictions notified under applicable law.

10. Retention and deletion

We retain School Data throughout the School's use of the Services. This includes historical academic records kept across academic years, class promotions, transfers, and graduation where the School requires those records for continuing educational or administrative purposes.

When a School ends the Services, we will provide a reasonable opportunity to return or export its School Data. We will then delete the School Data within a reasonable period unless the School gives lawful written instructions requiring continued retention or applicable law requires it. If the School requests earlier deletion, we will complete it within a reasonable period. Some records may remain temporarily where required by law, for disputes, payment reconciliation, security logs, or reasonable backup-deletion cycles.

We retain account, transaction, security, and support records only as long as needed for their stated purpose or legal requirements. We may retain aggregated or de-identified data that no longer identifies an individual.

Any applicable School Agreement may specify additional retention, export, and deletion requirements for that School.

11. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the data and risk. These may include encrypted network connections, access controls, role and School boundaries, authentication, logging, limited staff access, secure development practices, backups, and incident-response procedures.

No online service can guarantee absolute security. Users must protect their credentials, use supported devices, sign out of shared devices, and report suspected unauthorised access promptly.

12. Personal data breaches

If we become aware of a personal data breach affecting School Data, we will notify the relevant School as required by our agreement and applicable law and will assist with investigation and response. Where ANVI acts as the Data Fiduciary, we will notify affected individuals and authorities when required by law.

13. Your choices and rights

Subject to applicable law and our role, an individual may have the right to:

• obtain information about personal data and how it is processed;
• access a summary or copy of personal data;
• correct, complete, or update inaccurate personal data;
• request erasure of personal data that no longer needs to be retained;
• withdraw consent where processing relies on consent;
• nominate another person to exercise rights in specified circumstances;
• object to or restrict certain processing where applicable; and
• submit a grievance and escalate it to the competent authority after using the available grievance process.

For School Data, submit the request to the School that provided or controls the record. ANVI may need to refer the request to that School and may ask for information needed to verify identity and authority. For data ANVI controls directly, email anviedumart@gmail.com.

Withdrawing consent does not affect processing already completed lawfully. Some data may need to be retained for School records, legal compliance, safety, security, payments, or disputes.

14. Cookies and local storage

Our websites and apps may use cookies, secure local storage, and similar technologies needed for sign-in, session continuity, preferences, security, and basic operation. If ANVI later introduces non-essential analytics or advertising technologies, it should update this Policy and provide any consent controls required by law before using them.

15. Third-party services and links

The Services may contain links to a School website, payment provider, file, or other third-party service. That third party controls its own service and privacy practices. Review its terms and privacy policy before submitting personal data.

16. Changes to this Policy

We may update this Policy to reflect changes in the Services, law, or our practices. We will post the updated version with a new "Last updated" date. If a change materially affects how we use personal data, we will provide additional notice through the Services, by email, or through the relevant School where required.

17. Contact and grievance redressal

Questions about School Data should first be sent to the relevant School's authorised contact.

For ANVI-controlled data or unresolved privacy questions:

• Privacy contact: anviedumart@gmail.com
• Grievance contact: anviedumart@gmail.com
• Individual operator: Gade Sivasankar Reddy
• Operating name: ANVI EDUMART
• Contact address: SHOP NO-11, WHITE PETALS APARTMENTS, ROAD NO-1, DURGA NAGAR, KISTAREDDYPET, HYDERABAD-502319, TELANGANA, INDIA
• Website: https://www.anviedumart.com/
• Primary grievance contact: Gade Sivasankar Reddy
• Secondary grievance contact: G. Ramakrishna Reddy
• Response period: Within a reasonable period and no later than 90 days after receiving the grievance

If a person is dissatisfied with our response or does not receive a response within the stated period, they may complain to the Data Protection Board of India after first using this grievance process, as required by applicable law.

18. Applicable law

This Policy is intended to operate under applicable Indian privacy, information-technology, education, consumer, and other laws, including the Digital Personal Data Protection Act, 2023 and related rules as their provisions come into force.