Privacy Policy

1. Who We Are

NextGen School Alert is an enterprise school management platform developed, operated, and maintained by A2Z Online Services Pvt Ltd ("we", "us", "our"). We provide multi-school enterprise ERP systems, administrative automation, communication gateways, and dedicated web portals across India.

Corporate Address:
A2Z Online Services Pvt Ltd
Hajipur, Bihar – 844101, India
Email: [email protected] | [email protected]
Support Helpline: +91 7079090740

2. What This Policy Covers

This Privacy Policy applies to personal data processed across:

• The public website accessible via schoolalarm.online, including demo requests, contact inquiries, and trial registrations.
• The NextGen School Alert ERP suite, administrative dashboards (app.schoolalarm.online), and super administrator consoles.
• Dedicated web and mobile portals utilized by teachers, non-teaching staff, parents, and students.
• Our ongoing customer relations with educational institutions: deployment, onboarding, database migration, billing, and technical support.

Third-Party Portals: Our platform interfaces with external service providers (such as SMS/WhatsApp gateways and payment processors). Those entities operate under their independent privacy policies, and we advise users to review their disclosures prior to transactions.

3. Our Dual Role Under the DPDP Act

Under the Digital Personal Data Protection Act, 2023, data governance is categorized between the entity that decides the purpose of data processing (Data Fiduciary) and the entity handling technical execution (Data Processor):

4. Information We Collect

A. Information You Submit

When booking a demonstration, requesting trial access, or registering an institution, we collect:

• Full name, official designation, contact telephone/mobile number, and email address.
• School name, administrative branch details, city, state, affiliated education board, and student strength.
• Specific operational modules required (e.g., fee collection, auto-bell system, GPS fleet management).

B. Automatically Collected Technical Data

When interacting with our cloud infrastructure, our servers and network shields (via Cloudflare and Supabase) automatically record telemetry necessary for performance and intrusion detection. This includes IP addresses, browser types, operating systems, session timestamps, and referral headers.

C. Mobile Application Logs

When staff or parents access portal apps, diagnostic data (such as app version, device architecture, crash traces, and push notification tokens) is captured solely to verify session authenticity and dispatch alerts.

5. Cookies and Web Storage

We implement strictly necessary session identifiers and security cookies to maintain administrative authentication states, prevent Cross-Site Request Forgery (CSRF), and ensure smooth page transitions. We do not deploy third-party advertising cookies or cross-site tracking pixels.

6. How and Why We Process Data

We process personal data strictly in adherence to lawful consent mechanisms and legitimate operational mandates:

7. How We Handle School Data

The school retains uncompromised ownership of all student, parent, and institutional data. We pledge the following commitments within every institutional Service Agreement:

8. Children's Data Protection

Under India's DPDP Act, any individual under the age of 18 is classified as a child. Given that student management is a cornerstone of our software:

• The educational institution is responsible for securing verifiable parental consent prior to digital enrollment.
• We enforce a total prohibition on behavioral tracking, targeted commercial messaging, and minor profiling.
• System access to sensitive student medical, academic, or disciplinary notes is restricted strictly to designated teachers and administrators via role-based credentials.

9. Service Providers & Sub-processors

To deliver a scalable, enterprise-grade cloud experience, we work with enterprise-grade infrastructure providers bound by contractual non-disclosure and security mandates:

• Cloud Database & Storage: Supabase Cloud Infrastructure (Enterprise PostgreSql with Row Level Security).
• Edge Security & Routing: Cloudflare Inc. (SSL termination, DDoS protection, edge routing, and Web Application Firewall).
• Communication Infrastructure: Telecom Regulatory Authority of India (TRAI)-compliant SMS and WhatsApp Business Gateway API partners.
• Payment Gateways: Reserve Bank of India (RBI)-authorized payment aggregators for processing parent fee payments directly into institutional accounts.

10. Where Your Data is Stored

All primary school databases, secondary failovers, and operational logs remain within enterprise-grade data facilities physically located in the India region. We do not store, duplicate, or maintain student records outside Indian territory.

11. Data Retention & Archival

• General Inquiries: Contact information provided during demo requests is archived for reference and deleted upon request.
• School Records: Managed throughout the duration of the institutional contract. When a school offboards, data exports are provided, and production databases are purged within statutory timelines.
• Financial & Audit Logs: Access logs, transaction receipts, and fiscal audit records are retained as mandated by applicable regulatory guidelines.

12. Security Safeguards

NextGen School Alert deploys layered defense mechanisms to prevent data interception, compromise, or corruption:

• End-to-end transport encryption utilizing modern TLS 1.3 cryptographic suites across all endpoints.
• Row Level Security (RLS) enforcement on all active database tables, ensuring users access only their assigned institutional partitions.
• Role-based access permissions restricting sensitive actions (such as student exit gate passes) behind Multi-Factor Authentication (OTP verification).

13. Security Incident Protocol

In the unlikely event of a confirmed security incident affecting institutional records, NextGen School Alert maintains a rapid-response protocol: notifying affected institutions within 24 hours of confirmation, furnishing technical details to support regulatory notifications to the Data Protection Board of India, and taking immediate remediation measures.

14. Your Statutory Rights

Under the DPDP Act, eligible data principals retain statutory rights regarding their personal information:

• Right to Access: Review summaries of personal data maintained within system logs.
• Right to Correction & Updating: Rectify inaccurate, outdated, or incomplete records.
• Right to Erasure: Request deletion of personal records when the processing purpose is fulfilled, subject to administrative and educational statutory retention rules.
• Right to Grievance Redressal: Submit formal grievances to our assigned protection officers.

Note for Parents and Students: Because student records are controlled by your educational institution, correction or deletion requests should be directed to your school administration. We execute such requests upon institutional instruction.

15. Marketing & Communications Policy

We do not dispatch unsolicited commercial messages. Transactional updates, fee notifications, and emergency school alerts triggered by schools are administrative operational broadcasts and cannot be opted out of, as they are essential to school operations.

16. Data Protection & Grievance Officer

In compliance with the DPDP Act, 2023, we have designated an official point of contact for data inquiries, operational concerns, and statutory grievances:

17. Updates to This Privacy Policy

We reserve the right to revise this Privacy Policy periodically to reflect technological advancements, system upgrades, or statutory clarifications issued under the DPDP Rules. Revisions take effect upon publication on this URL.

18. Contact Us

For inquiries regarding this Privacy Policy or institutional data agreements, reach our enterprise support team at [email protected].