Legal
Privacy policy
Last updated 26 September 2026
This Privacy Policy explains how MyPathsala (“MyPathsala”, “we”, “us”, “our”) collects, uses, shares and protects personal data when schools, their staff, students and parents use our school management platform, mobile apps and website (together, the “Service”). It follows the principles of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”). For the student, parent and staff records a school enters, that school is the Data Fiduciary and MyPathsala acts as a Data Processor on its behalf. Please read this policy together with our Terms of Service.
1. Who this policy covers
This policy applies to school owners, principals, teachers and office staff who use MyPathsala; to parents and guardians who use the parent app; to students whose information a school processes through the Service; and to visitors of our website. Where a school controls your records, please also refer to that school’s own privacy notice.
2. Information we collect
We collect: (a) account and school details, such as names, email addresses, phone numbers, school name, address and login credentials; (b) records a school enters, such as student profiles, guardian contacts, admissions, attendance, marks and report cards, fee records, homework, timetables and staff records; (c) payment information, processed by our payment partners (we do not store full card numbers); (d) communications, such as support messages and the notices and alerts a school sends; and (e) technical and usage data, such as device, browser, IP address and logs, used to keep the Service secure and improve it.
3. How we use your information
We use personal data to provide and operate the Service; to send the app notifications, SMS, WhatsApp messages and emails a school sets up; to process subscription and fee payments; to provide support; to secure the platform and prevent misuse; to comply with legal obligations; and to improve our product using aggregated, de-identified information. We do not use students’ records for advertising, and we never sell personal data.
4. Legal basis and consent
We process personal data with the consent that schools, parents and staff provide, to perform our contract with the school, to comply with applicable law, and for the legitimate operation of the Service. Schools are responsible for obtaining the consents required from parents, guardians and staff for the data they enter and the messages they send through the Service.
5. Student records and the school’s role
Student, parent and staff records belong to and are controlled by the school. We access them only to provide and support the Service, keep each school’s data separate from every other school’s, and act on the school’s instructions to export or delete them. As a Data Processor, we process this data only on the school’s documented instructions.
6. Children’s data
Most students are children under the DPDP Act. Schools are responsible for obtaining verifiable consent from a parent or lawful guardian before processing a child’s personal data, as the Act requires. We do not track children for advertising, do not build behavioural profiles of children, and do not collect data directly from children through this website.
7. Sharing and disclosure
We share data only with the sub-processors needed to run the Service, for example cloud hosting, payment gateways (such as Razorpay), and SMS, WhatsApp and email providers, each bound by contractual confidentiality and data-protection obligations. We may disclose data where required by law or valid legal process, and in connection with a merger, acquisition or asset sale, subject to this policy. We never sell personal data.
8. Cookies and analytics
Our website uses strictly necessary storage to work and, only if you accept, analytics to understand how it is used. You can change your choice at any time through Cookie settings at the bottom of any page. See our cookie policy for details.
9. Data security
We protect data with encryption in transit and at rest, separation between schools, role-based access controls, audit logs of changes, regular backups and monitoring. While no method of transmission or storage is completely secure, we work continuously to safeguard information and will notify affected schools and authorities of a reportable breach as required by law.
10. Data retention
We keep personal data for as long as the school’s account is active and as needed to provide the Service. When a school closes its account, it may export its data during a notice period, after which we delete or de-identify it within a reasonable time, unless longer retention is required by law or for the establishment or defence of legal claims.
11. Where your data is stored
We store and process data primarily on cloud infrastructure in India. Where any processing happens outside India, we apply safeguards consistent with applicable law so that your data receives a comparable level of protection.
12. Your rights
Subject to applicable law, you may access a summary of your personal data, correct or update it, request its erasure, withdraw consent, and nominate another person to exercise your rights in the event of death or incapacity. You also have the right to grievance redressal (see below). Parents, students and staff should contact their school first, as the school controls their records; we will help the school act on your request.
13. Changes to this policy
We may update this policy from time to time. We will post the revised version here with a new “last updated” date and, for material changes, give additional notice through the Service or by email. Continued use of the Service after the changes take effect means you accept the updated policy.
14. Grievance officer and contact
For questions, requests or complaints about this policy or your personal data, contact our Grievance Officer at contact@mypathsala.com. We will acknowledge your request promptly and resolve it within the timelines required by the DPDP Act and other applicable law.