1 Who is responsible for your data
- Academy Data (student, parent, coach and staff records, attendance, fee records, exams, homework and so on) is controlled by the Academy that uses Artora Academy OS. The Academy is the data controller (the "Data Fiduciary" under the DPDP Act). ARTORA acts as its data processor and handles that data only on the Academy's instructions and under our Terms and Conditions.
- Business contact data (for example details of the person who contacts us to buy a subscription, Academy Admin contact details for billing and support) and website and service usage data are controlled by ARTORA, and this policy describes how we use them.
2 Data we handle
Data an Academy enters on its own behalf, which may include:
- identity and contact details of students, parents, coaches and staff: name, phone number, email, address, date of birth or age, photograph and custom fields the Academy chooses to add;
- academic and activity records: enrolments, batches, timetable, attendance, homework, exam marks and remarks, certificates and events;
- fee records: fee plans, installments, GST, adjustments, receipts and payment entries the Academy records (we do not receive card, bank or UPI credentials, because payments are not made through the Service);
- staff and payroll records the Academy maintains;
- messages, announcements and files uploaded by Users.
Data generated when the Service is used: sign-in records, session information, audit logs of important actions, IP address, browser and device type, mobile push-notification tokens, and error and performance logs.
Data we collect for our own business: the contact details and messages you send when you enquire about, buy or renew a subscription, and billing details such as the Academy's legal name, address and GST number.
We do not intentionally collect sensitive categories of data (such as health, religious or biometric data). Academies should not enter such data unless they have a lawful reason and appropriate consent.
3 How data is used
- to provide the Service to the Academy: running the console and mobile app, sending notifications, reminders and messages the Academy triggers, generating reports and exports;
- to set up and onboard Academies, manage subscriptions, invoicing and renewals;
- to provide support when the Academy asks for help (our team may view the relevant records only to resolve the request);
- to keep the Service secure: authentication, detecting misuse, investigating incidents, and keeping audit logs;
- to maintain and improve the Service, using aggregated or technical information wherever possible;
- to meet legal obligations, enforce our terms, and respond to lawful requests from authorities.
4 What we do not do
- We do not sell or rent personal data.
- We do not use Academy Data for advertising or build marketing profiles of students or parents.
- We do not contact an Academy's students or parents for our own purposes. Messages they receive through the Service are sent by or on behalf of their Academy.
- We do not collect or process fee payments, and we do not store card, bank or UPI credentials.
6 Where data is stored
Data is stored on servers operated by our hosting providers. Some service providers (for example push-notification services) may process data outside India. Where data is transferred, we do so as permitted under applicable law and take reasonable steps to make sure it remains protected.
7 How long data is kept
- Academy Data is kept for as long as the Academy's account is active, or until the Academy deletes it. Academies decide how long to keep their own records, subject to their legal obligations.
- When a subscription expires, data is retained while the account is suspended so the Academy can renew. When an account is closed, or remains expired and unpaid for an extended period after notice, Academy Data may be permanently deleted. Copies in backups are overwritten over time in the normal backup cycle.
- Business, billing and tax records are kept for as long as the law requires (for example under GST and income-tax law).
- Security and audit logs are kept for a limited period needed for security and investigation purposes.
8 Security, and its limits
We take reasonable security practices and procedures, including:
- logical separation of each Academy's data from every other Academy;
- role-based permissions controlled by the Academy Admin;
- passwords stored only as one-way hashes, never in plain text;
- encrypted connections (HTTPS) between your device and the Service;
- session controls, including signing out other sessions when a password is changed;
- audit logs of important actions, and periodic backups;
- access by our staff limited to what is needed for support and operations.
9 If something goes wrong
If we become aware of a personal data breach or data loss affecting the Service, we will:
- act promptly to investigate and contain it and to restore normal service;
- try to recover affected data from our latest available backup where possible;
- inform affected Academies without undue delay, with the information reasonably available, so they can meet their own obligations to the people concerned;
- report to the Data Protection Board of India, CERT-In or other authorities where the law requires us to.
We will make reasonable efforts to rectify the problem, but we cannot guarantee full recovery of data or a particular outcome. Our responsibility is further described in the Terms and Conditions.
10 Your rights
Subject to applicable law, you may have the right to access a summary of your personal data, to correct, complete or update it, to have it erased, to withdraw consent, to nominate another person to exercise your rights in case of death or incapacity, and to raise a grievance.
- Students, parents, coaches and staff: because your Academy controls your records, please send your request to your Academy. If you contact us directly, we will forward your request to the Academy and assist it where we can.
- Business contacts and website visitors: contact our Grievance Officer using the details below.
We may need to verify your identity before acting on a request. Some data may have to be kept even after an erasure request where the law requires it (for example tax and financial records).
11 Children's data
Many students are under 18. The Academy is responsible for obtaining verifiable consent from a parent or lawful guardian before entering a child's data or giving a child a login. We process children's data only to provide the Service to the Academy, and we do not use it for tracking, behavioural monitoring or targeted advertising.
12 Academy responsibilities
Each Academy using Artora Academy OS agrees to:
- collect only the personal data it needs, for a lawful purpose, and tell the people concerned how it uses their data;
- obtain any consents required, including parental consent for children;
- keep its records accurate, grant access only to people who need it, and remove access when staff leave;
- respond to requests from its students, parents and staff about their data;
- notify us promptly if it suspects any unauthorised use of its account.
14 Changes to this policy
We may update this policy as the Service or the law changes. The "Last updated" date shows the latest version. For significant changes we will inform Academy Admins in advance.
15 Grievance Officer and contact
In accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, the contact for privacy questions and grievances is:
- Grievance Officer: to be published before launch
- Email: via our contact page
- Company: ARTORA
- Address:
We aim to acknowledge grievances within 48 hours and to resolve them within the time limits set by applicable law. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is available to you under the law.
This Privacy Policy forms part of the Terms and Conditions. Where an Academy has signed a separate data processing agreement with us, that agreement also applies.