Privacy Policy

Nodus Edu, operated by Nodus Technologies Private Limited

This Privacy Policy explains how Nodus Technologies Private Limited ("Nodus", "we", "us"), the operator of the Nodus Edu platform and the website nodusedu.com, handles personal data. We take the privacy of children and families especially seriously, and this policy sets out what data we handle, why, where it is stored, and the rights available to you.

1. Who controls the data, and our two roles

Nodus Edu is a platform that schools use to manage their own operations. Our responsibility depends on whose data it is:

• Data that belongs to a school (its students, their guardians, its staff, marks, attendance, fees, and related records): the school is the Data Fiduciary. The school decides what data is collected and how it is used. Nodus acts as a Data Processor, handling that data only on the school's instructions and under a written agreement with the school. If you are a parent, student, or staff member of a school, your first point of contact for your data is your school.
• Data of our own account holders and website visitors (for example, a school representative who contacts us or signs up, or a visitor to nodusedu.com): here Nodus is the Data Fiduciary and this policy governs directly.

2. What data we handle

On behalf of a school (as Processor)

• Student records: name, admission or student identifier, class and section, date of birth, address, and guardian names and occupations as provided by the school.
• Guardian contact details (email and mobile number) where the school records them, together with a record of the consent the school has obtained for digital communication.
• Academic records: marks, assessments, report cards, and related analysis.
• Attendance, leave, pastoral notes, timetables, announcements, and fee records including bills, payments, and receipts.
• Login credentials issued by the school (for staff, a sign-in email; for parents and students, a name and access code).

As Data Fiduciary (our own users and visitors)

• Contact information you provide when you enquire, request a demonstration, or correspond with us (name, email, phone, school name).
• Basic technical information necessary to deliver and secure the website, such as your approximate region and browser type.

We do not sell personal data. We do not display advertising, and we do not use children's data for any purpose other than delivering the service to the school.

3. Why we handle it

• To provide the Nodus Edu service to the school that engaged us.
• To operate specific features the school has enabled, such as issuing report cards, recording attendance and fees, and, only where a guardian's consent has been recorded by the school, sending a report or fee receipt to that guardian by email or messaging.
• To secure the platform, prevent misuse, and meet our legal obligations.
• For our own users, to respond to enquiries and provide information about the service.

4. Consent, and children's data

Much of the data on the platform concerns children. We treat it with particular care.

• The lawful basis for handling student and guardian data rests with the school, which obtains the necessary consent from parents and guardians as part of its own admission and enrolment process.
• Nodus does not send any communication to a guardian unless the school has recorded that guardian's consent for digital communication in the platform. Where no consent is recorded, the option to contact that guardian is not available.
• Nodus does not use children's data for profiling for advertising, tracking, or any purpose that could cause harm to a child. We do not permit behavioural advertising on the platform.

5. Where your data is stored

6. How your data is protected, and kept separate

• Tenant isolation. Each school's data is isolated within the database itself, not merely hidden by the interface. Access controls are enforced at the database level so that one school cannot access another school's data. We have tested this separation for both reading and writing, for signed-in and anonymous access, in both directions.
• Role-based access. Within a school, each person sees only what their role permits. Students do not see other students' data; teachers see only what they are entitled to; parents see only their own child.
• Fee payments. Where online fee payment is used, funds are paid to the school's own bank account through a payment provider. Nodus does not receive, hold, or transmit school fee money. We record the payment; we never handle the funds.
• Security measures. We apply access controls, encryption in transit, and audit logging of sensitive actions. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

7. Who else may process the data (sub-processors)

We use a small number of trusted providers to deliver the service. They act only on our instructions and are not permitted to use the data for their own purposes.

Provider	Purpose	Location
Supabase	Database and application hosting for school data	India (Mumbai) for schools in India; a dedicated region stated in the agreement for schools elsewhere
Cloudflare	Website and content delivery, security	Global network

Online fee payment is not currently offered. If a school chooses to enable it in future, the school's payment provider will be added to this list before it is used.

8. How long we keep data

For school data, we retain it for as long as the school remains our customer and as instructed by the school. On the end of a school's engagement, we return or delete the school's data in line with our agreement with that school and applicable law. For our own users, we keep enquiry data only as long as needed to respond and for a reasonable period thereafter.

9. Your rights

Under the Digital Personal Data Protection Act, 2023, individuals have rights including access to their data, correction, and, in certain circumstances, erasure, and the right to grievance redressal.

• If you are a parent, student, or staff member of a school, please raise data requests with your school first, as the school controls that data. We will support the school in fulfilling your request.
• If you are one of our own users or a website visitor, you may contact us directly using the details below.

10. Grievance officer and contact

11. Changes to this policy

We may update this policy as the service and the law evolve. We will post the updated version here and revise the "last updated" date. Where changes are significant, we will take reasonable steps to inform schools using the platform.