Privacy Policy

1. Overview & Role Demarcation

SchoolEasy (“we”, “our”, or “us”) provides an integrated educational management platform designed for schools, academies, colleges, and multi-branch educational networks. SchoolEasy is operated by Sajan Rajbanshi, an individual based in Nepal.

In providing our services, we operate under a clear role-based privacy demarcation:

2. Categories of Processed Data

To facilitate school administration, communication, and educational progress, the Platform processes the following information as inputted by the Institution or Users:

• Identity & Profile Records: Full name, institutional numeric username, email address, contact telephone, date of birth, gender, and school-assigned roll numbers.
• Signup Records: When someone creates a school: their name, email address and telephone number; the school’s name and country; and, for an email signup, the password they choose and a six-digit verification code, both stored only as one-way hashes. These are used to create the school and its first administrator account, to confirm the email address belongs to that person, to prevent abuse, and so SchoolEasy’s team can contact them about the school’s account. A signup waiting for its code is deleted within a day.
• Enquiries to SchoolEasy: When someone sends an enquiry from our contact page: their name, work email, telephone number and role; the school’s name and approximate student numbers; their message; and the IP address it came from. These are used to answer the enquiry, to follow up with them about SchoolEasy, and to prevent abuse.
• Academic & Operational Records: Enrolled branch, class, and batch; daily student and educator attendance logs; examination marks, grades, and report card summaries; educator timetables and room assignments.
• Financial & Fee Registers: Tuition installments, fee receipt numbers, payment methods, transaction references, and payment timestamps (representing school operational billing, not commercial consumer payments).
• Leave Applications & Health-Adjacent Documents: Leave requests, dates, category (including medical leave), stated reasons, and optional supporting documentation (such as doctor notes) submitted to school administrators.
• Institutional Communications: Campus notices, syllabus outlines, uploaded educational materials, and institutional feedback submissions.
• Plan & Billing Records: For schools on a paid plan: the plan, number of student seats, AI credit packs, invoices and payment status, and the customer and subscription references our payment provider assigns. Card and bank details are entered on Dodo Payments’ checkout and are never received or stored by SchoolEasy.
• Technical Session Diagnostics: Essential session authentication tokens, IP addresses for security rate limiting, and technical user-agent metadata logged during system operation.

3. Administrative Oversight & Credential Control

The Platform is designed with centralized institutional administration to meet the daily realities of school environments:

4. Storage Architecture & Security Safeguards

All data is housed within secure, enterprise-grade cloud datacenters configured with strict technical and organizational safeguards:

• Encryption in Transit: All communications between user browsers, mobile applications, and our server infrastructure are encrypted using modern Transport Layer Security (TLS 1.2+ / HTTPS).
• Private Object Storage: Uploaded attachments, school notices, teaching syllabus files, and leave medical documents are stored in enterprise-grade private cloud object storage (Backblaze B2) protected by backend authentication, preventing unauthenticated public web access.
• Multi-Tenant Boundary Isolation: Every database query and storage asset is strictly partitioned by each institution’s unique organizational identifier, ensuring that no institution can view, query, or modify the records of another institution.
• Role-Based Access Control (RBAC): Student, parent, educator, and administrator accounts operate under least-privilege permission matrices. Students and guardians access exclusively self-scoped progress routes.

5. Service Providers & Technical Subprocessors

We engage reputable tier-1 cloud and technology providers to assist in delivering platform functionality. Each provider is bound by strict confidentiality and security commitments:

Dodo Payments handles payment details as the seller of record, under its own privacy policy. School fees that parents pay a school online are paid into the school’s own payment account (such as Khalti, eSewa or Razorpay); neither SchoolEasy nor Dodo Payments holds that money.

6. Data Retention & Disposal

Institutional records are maintained for the active duration of the school’s subscription, or in accordance with statutory academic record-keeping standards required of educational institutions.

Upon termination of institutional service, the school is provided complete data export facilities. Following the conclusion of the thirty-day data retrieval grace period, institutional datastores and associated storage blobs are systematically removed from active production systems.

Signup records become the school’s administrator account and organization profile, and are kept as part of them. A signup that is never completed is deleted within a day. SchoolEasy no longer collects registration certificates or citizenship documents; those received under the former verification process have been deleted.

7. Rights of Guardians, Students & Staff

Because educational records are governed primarily by the subscribing institution:

• Parents and Guardians can review their children’s attendance, progress, and fee records at any time through their authenticated parent portal. Requests for corrections should be directed to the school administration.
• Educators and Staff can inspect their schedules, personal profile details, and attendance history through their staff dashboard.
• Institutional Corrections: Administrators maintain complete capability to update, correct, or archive student records within their school portal.