Privacy at Edvation

Edvation helps K-12 schools and related institutions that serve them manage learning, teaching, assessments, administration, and communication. Our privacy policy explains how we at Edvation handle personal data across its website, apps, AI agents, ERP, LMS, and support services.

Who Controls School Data

The school’s administration decides why and how it uses student, parent, teacher, and school-administration data in the Edvation application and web application. The school is responsible for ensuring it has the authority to provide that data and to instruct Edvation on how to handle it.

Edvation processes school data to provide the service, maintain the platform, provide support, protect security, and meet legal obligations. You can find the data Edvation collects listed below.

If students using Edvation are under 18 years of age, the school accepts Edvation’s customer agreement and policies on the students’ behalf. The school will be solely responsible for informing students, parents, and guardians about how Edvation is being used and for obtaining verifiable consent from parents or guardians wherever applicable.

Data We May Collect

Edvation may collect and process:

• Account details, such as name, email, phone number, role, and login information.
• School records, such as class, section, timetable, attendance, homework, marks, reports, and authorised parent or guardian information.
• Learning data which is collected from uploaded materials as textbooks, notes, assignments, questions, voice recordings, AI prompts, AI responses, and feedback. Any voice recordings as made by the user will only be used for functioning of the AI Agent “Voice Tutor” and will be retained in Edvation server for a period of _ days.
• Technical data such as IP address, device type, device model, operating system, unique device identifiers, browser, pages visited, timestamp of every page visit, mobile network information, usage logs, error logs, and security events.
• Support messages and contractual, billing, or payment information, where applicable.

We collect only the data needed for the stated educational, administrative, support, security, or legal purpose.

How We Use Data

Edvation uses data to:

• Provide, support, and maintain necessary Edvation services.
• Set up school accounts, users, permissions, classes, and learning tools.
• Deliver AI features requested by authorised users such as school administration, teachers, students, parents, coaching institute administration and any edtech platform administration.
• Manage and control user login and authentication.
• Generate textbook-based learning support, practice, feedback, and school-data answers.
• Keep the service secure and prevent fraud, investigate any cyber incidents, and meet legal obligations to our stakeholders.
• Communicate service notices, updates, and support responses.
• Improve Edvation services using aggregated or de-identified data, where permitted by law and contract.

Children’s Data

Edvation is designed for K-12 schools. We handle children’s personal data only for authorised educational and school-operational purposes.

Schools are responsible for providing required notices and obtaining verifiable parent or guardian consent where applicable. Edvation will support schools with the information and controls needed to meet these obligations.

It is to be noted that students under 18 years use Edvation through their school’s authorized access. The school, and where required a parent or the legal guardian of the student accepts Edvation’s usage terms, security terms and policies on the student’s behalf. Students are expected to use Edvation only as permitted by their school, and are expected to keep their login credentials safe and immediately report to their school administration in case they notice anything unusual in their account or any unauthorized login.

Edvation (referred to as ‘we’, ‘us’, or the ‘Data Fiduciary’ under Digital Personal Data Protection (DPDP) Act 2023 Section 9(2)) does not use children’s personal data for any activity that may harm the well-being of the children.

Edvation does not use children’s personal data for behavioural advertising or sell it. Neither does Edvation track user data for behavioural advertising, nor practise targeted advertising. Any monitoring of data is done solely on behalf of the school administration, for educational purposes or child safety, within the exemption of the Digital Personal Data Protection (DPDP) Act 2023 Section 9(3) for educational institutions.

AI and Learning Data

Edvation AI agents use the information needed to respond to an authorised request. For example, a textbook-based AI tutor may use the data from the selected textbook chapter to answer a student’s question.

Edvation will not use student data, identifiable or not, parent, teacher, school, textbook, assignment, or prompt data to train general AI models for other customers or for our internal AI training purposes without the school’s explicit written authorisation. Edvation does not use other customers’ data to train general AI models without the school’s explicit written authorisation.

AI output can be inaccurate or incomplete, or out of date, even if they are based on school textbooks. Edvation bases all AI answers on school assigned textbooks, and any answer that might be error or factually incorrect or out of date is solely the responsibility of the textbook publisher and school administration.

Teachers and schools remain responsible for academic decisions, assessment decisions, the appropriate use of AI output, and verifying AI output for accuracy.

Human Monitoring and Control of Education Resources

Edvation works with AI agents whose generated content depend on the school assigned textbook which is deemed as education resource and by no means is a replacement on judgement of teachers, principal, students and any other stakeholders involved in the school curriculum. Teachers, parents, students and the school principal are encouraged to check AI answers for factual accuracy. Schools can anytime report AI generated answers and content so that we can investigate and improve our service.

When We Share Data

Edvation does not sell the personal data of any user, including the students, parents, teachers, principal and the school administration.

Edvation may share data only when necessary to provide the service or meet legal obligations, including with:

• The school and users authorised by the school.
• Service providers that support hosting our app and web app servers, security, communications, payments, analytics, and customer support.
• Professional advisers, auditors, insurers, or authorities where required by law.
• A successor organisation if Edvation is involved in a merger, acquisition, or transfer of assets, subject to appropriate safeguards.

Service providers may access data only to provide services to Edvation and must follow contractual confidentiality, privacy, and security obligations.

Cookies and Similar Technologies

Edvation uses Cookies and similar technologies to keep users signed in, remember user preferences, and enable platform functionality. This includes when using the Edvation mobile application and website. Edvation may also use Cookies to analyze platform performance, analyze traffic performance, and improve performance as permitted by law. Edvation does not use Cookies for advertisement or targeted advertising. Users can manage Cookie preferences through browser settings. Please note that some features may not work if Cookies are disabled in browser settings.

Retention and Deletion

Edvation retains personal data only for as long as needed to provide the service, follow school instructions, meet contractual obligations, comply with law, resolve disputes, or protect the platform.

When a school account ends or is terminated upon request by the school administration, Edvation will delete or return school data according to the customer agreement and the published retention schedule.

Your Rights and Choices

Subject to applicable law and identity verification, users or authorised school contacts may request to access, correct, delete, or export personal data, or withdraw consent where processing relies on consent.

For student data, a parent, guardian, or authorised school contact may need to make the request. Some data may need to be retained where required by law enforcement authorities or a valid contract requires it.

Security and International Transfers

Edvation uses administrative, technical, and organisational safeguards designed to protect personal data, including encryption, firewalls, and access controls. If data is processed outside India, Edvation will use safeguards required by applicable law and contract, and will obtain written permission from the school authority in such a case. However, no method of data transmission over the internet or electronic storage is completely secure, and Edvation cannot guarantee absolute security.

Changes to This Privacy Policy

Edvation may update this privacy policy from time to time as our risks, services and legal requirements as mandated by law enforcement and governmental mandates may change. We will notify our users and school administration through the platform or by email before such changes take place. The updated policy will be published in this Privacy Policy page with its update date.

Security at Edvation

Edvation is designed for schools, teachers, students, parents, and administrators. Protecting school and student data is part of how we build and operate the platform.

Edvation practises are designed to align with the Digital Personal Data Protection (DPDP) Act 2023, the Digital Personal Data Protection (DPDP) Rules 2025, and the Information Technology (IT) Act 2000, and we update as per these mentioned laws as legal obligations take effect.

This public policy describes our approach without disclosing information that could weaken the security of Edvation or its customers.

Our Security Principles

We work to protect the confidentiality, integrity, and availability of Edvation and the data entrusted to us.

We apply these principles:

• Give access only to people who need it for an authorised task.
• Protect data during transmission and storage.
• Build and test the product with security in mind.
• Monitor systems and respond to security events.
• Review controls as the product, risks, and legal requirements change.

Access Controls

Edvation uses role-based controls so users see the information relevant to their school role. Administrative access is restricted and reviewed. Each user of Edvation can access the data their school role requires except in case of super admin access, which lies with the school administration. Schools are responsible for assigning the correct roles and promptly removing access when a user leaves. In addition to this, staff access is the least privileged, authorised, logged, and reviewed on a schedule, with multi-factor authentication, single sign-on, and daily audit logs available to the school.

Every user needs to keep their login details, including their User ID and password, confidential. Users should not share their login details with anyone unless authorised by the school administration or by the parent or a legal guardian of an authorised student. If a user suspects that their account is being accessed by any third-party without their consent and authorisation, they should contact their respective school administration or Edvation team immediately to revoke access and take appropriate legal steps.

Data Protection

Edvation uses safeguards designed to protect data in transit and at rest, including encryption, firewalls, and access controls.

Secure development and testing

Security is considered when Edvation designs, develops, tests, and releases product changes. We maintain processes for code review, dependency review, vulnerability management, and security testing.

AI Security

AI features are designed to use only the data needed for the requested task. Access to textbooks, assignments, prompts, school data, and AI outputs is governed by the relevant school role and permission settings.

Edvation will not use customer data to train general AI models for other customers or for our internal AI training purposes without an explicit written authorisation from the school.

Before using any AI provider or integration, Edvation reviews its security certifications, security audit reports, its data protection terms, where and how it processes data, how long it retains the data and whether it uses the data to train any AI models. We assess AI providers and integrations for privacy and security requirements before use with appropriate security measures, and to notify us promptly in case of any security incident. We also check that each AI provider has terms and conditions that permit the use of data for students under the age of 18.

Monitoring and Incident Response

Edvation monitors the service for security events and maintains an incident-response process to investigate, contain, remediate, and document notified incidents.

If a personal-data breach occurs, Edvation will notify affected schools, individuals, and authorities as required by applicable law and contract within a time period of 24 hours.

Business Continuity and Vendors

Edvation maintains backup and recovery procedures designed to restore services after an unexpected disruption. We assess service providers that process Edvation data and require appropriate confidentiality, privacy, and security commitments. Edvation also assesses every service provider that processes customer data before engaging it, considering their security practices, data server location, and data protection terms.

Acceptable Use

To keep Edvation safe for every school and student, the users must not:

• Use Edvation in any way that may damage the platform or impact the other user’s access.
• Use Edvation in any way that may breach the privacy and security laws as stated, applicable laws and regulations, or in any way that may harm a school, an educational institution and any person, or any organisation.
• Engage in any data mining, data harvesting, data extracting, or any similar activity using Edvation.
• Attempt to access any data, account, or area which Edvation or their school does not permit.

Edvation may restrict or suspend or permanently limit or restrict the usage access to any account that breaks any of these rules, and will immediately inform the school administration as and where appropriate.

Report a Security Concern

To report a suspected vulnerability or security issue, contact:

Please include a clear description of the issue along with a screenshot or an image in only PNG or JPEG format via an official email from your end, and enough detail for us to investigate. Do not include unnecessary student or personal data in your report. Please do not send executable files, PDF files and compressed archives or zip files unless we request them.

Good Faith Research and Autonomous Reporting

If you have found any software bug/vulnerability that might be causing a disruption or a series of disruptions in our processes or might threaten our security, please report it back to us. Please note that we will consider only reports made in good faith. Good faith is defined below:

Good faith research consists of:

• Access only the minimum data required to report the issue, and do not view, store or save, copy, change/modify, or delete student data or personal data beyond that.
• Do not disrupt our services.
• Do not directly contact our employees/staffs and customers and social engineer them or cause a cyber attack on them.
• Report the issue to us promptly as soon as you have discovered it, and keep it completely confidential and do not share it with any of our stakeholders or our competitors under any circumstances.
• Do not demand payment of any kind in exchange for reporting the issue.

Changes to This Trust & Security Policy

Edvation may update this security policy as the product including its features, risks, and legal requirements change. We will notify school administration before any updates through the platform or by an email, and the updated policy will be published with the date of revision.