Privacy Policy

ShalaLink ("we", "us", or "our") operates the ShalaLink school management platform, including the ShalaLink mobile application (available on Google Play Store) and the website at shalalink.com (collectively, the "Service").

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights over that data. By using the Service, you agree to the practices described in this Policy.

Our Service is designed for schools, school staff (principals, administrators, teachers, management staff), and parents/guardians. Students' data is managed by their school and accessed only by authorised staff and the relevant parent/guardian. We do not knowingly collect personal data directly from children.

2.1 Account & Profile Data

• Phone number — used for OTP-based authentication (Firebase Auth).
• Full name and profile photo — provided during profile setup.
• Role — Principal, Admin, Teacher, Management, or Parent, assigned by your school.
• School association — which school(s) your account is linked to.

2.2 Student Data (managed by the school)

Schools input and manage the following data about students through the platform. This data is owned by the school and accessed only by authorised school staff and the student's parent/guardian:

• Student name, class, section, roll number, and date of birth.
• Attendance records (daily check-in/check-out).
• Academic marks and report cards.
• Fee records and payment history.
• Leave requests submitted by parents.
• Early pickup requests.
• Timetable and lesson plan information.
• Student documents uploaded by the school (e.g., ID, certificates).
• Achievements and academic milestones.

2.3 Communication Data

• Announcements posted by school staff.
• 1-to-1 chat messages between staff members or between staff and parents.
• Push notification content (attendance alerts, fee reminders, announcements).

2.4 Device & Technical Data

• FCM token (Firebase Cloud Messaging) — your device's push notification identifier, stored to send you relevant alerts.
• Crash and error data — collected anonymously via Sentry to help us fix bugs. This may include device type, OS version, and app version.
• Session data — login session information used to enforce single-device login security (Session Guard).

2.5 Website Waitlist (shalalink.com only)

• If you submit your details via the waitlist form on our website, we collect your name, phone number, and school details to contact you about the platform.

We use the data we collect to:

• Authenticate your identity and manage your account via phone OTP.
• Provide and operate the school management features you are authorised to access.
• Send push notifications for attendance, fees, announcements, and other school events.
• Enable 1-to-1 messaging between staff and parents.
• Generate PDF reports (fee receipts, mark sheets, etc.).
• Detect and prevent concurrent unauthorised logins (Session Guard).
• Diagnose crashes and improve the app's reliability (Sentry error tracking).
• Maintain an audit log of sensitive actions (data edits/deletions) for school governance.
• Respond to enquiries submitted via the website waitlist.

We do not use your data for advertising, sell it to third parties, or use it for any purpose beyond operating the Service.

We share data only with the service providers necessary to operate the platform. All providers are bound by their own privacy commitments:

We may also disclose data if required by law, court order, or to protect the safety and rights of users and the public.

All data is stored in Google Firebase (Firestore and Firebase Storage), hosted on Google's secure cloud infrastructure. Data is encrypted in transit (TLS) and at rest.

Access to school data is strictly controlled by Firestore security rules that enforce role-based access — each user can only read and write data for their own school and within their authorised role. Sensitive admin operations are protected by server-side Cloud Functions.

We maintain an internal activity audit log for every significant data change (creates, updates, deletes) within each school, accessible only to authorised ShalaLink personnel for support and governance purposes.

While we take all reasonable precautions, no system is completely secure. Please protect your phone number and OTP codes and do not share them with anyone.

ShalaLink manages data about school students, who may be minors. This data is entered and controlled by the school (the data controller), not by ShalaLink directly. We act as a data processor on behalf of the school.

Key protections in place:

• Student data is accessible only to authorised school staff (Principal, Admin, Teacher, Management) and the student's own parent/guardian.
• Parents can view their child's attendance, marks, fees, timetable, and communicate with teachers — but cannot access data of other students.
• We do not allow children to create accounts directly. All accounts are created by school administrators or via an invitation system.
• Student data is never used for advertising or shared with any third party beyond those listed in Section 4.

Schools are responsible for obtaining appropriate consents from parents/guardians as required by applicable laws before adding student data to the platform.

We retain your data for as long as your account or your school's account is active on the ShalaLink platform. When a school's subscription ends or an account is deleted:

• User account data is deleted within 30 days of the account deletion request.
• School data (students, attendance, fees, etc.) is retained for 90 days after subscription end to allow data export, after which it is permanently deleted.
• Audit logs are retained for 1 year for governance and legal compliance purposes.
• Crash/error data in Sentry is automatically purged according to Sentry's retention policy.

Under applicable data protection laws (including India's Digital Personal Data Protection Act, 2023), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data. You can update your own name and profile photo directly in the app.
• Erasure — request deletion of your personal data, subject to legal retention requirements.
• Grievance redressal — raise a complaint about how your data is handled.

For student data, rights are exercised through the school (as data controller). The school's Principal or Administrator can manage and delete student data within the platform.

To exercise any of these rights, contact us at support@shalalink.com. We will respond within 30 days.

The ShalaLink mobile app requests the following device permissions:

Optional permissions (camera, storage) are requested only when you perform an action that requires them. You can deny them without losing core functionality.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify users via the app or email (if provided). The "Last updated" date at the top of this page reflects the most recent version.

Continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

For any privacy-related questions, requests, or complaints, please contact us:

For complaints under India's Digital Personal Data Protection Act, 2023, you may also approach the Data Protection Board of India once constituted.