Privacy Policy

1. Introduction

NOVARA ("we", "us", "our") operates a multi-tenant school management platform (the "Service"). This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the rights and choices you have over your personal information.

It applies to the NOVARA website, the school management platform (including the web dashboard and, where available, mobile applications), and related services. By using the Service, you agree to the practices described in this policy. Where this policy refers to "you", it covers Schools, administrators, teachers, staff, students and their legal guardians as applicable.

2. Who we are and how to reach us

The Service is operated by the NOVARA platform team, with its principal place of business in Bengaluru, Karnataka, India. If you have any questions about this policy or your personal information, you can reach us at:

• ·Email: support@novara.app — for privacy questions and data requests we respond within 48 hours.
• ·Phone / WhatsApp: +91 63049 28433

3. Information we collect

We collect information in three ways: what you give us, what we generate as you use the Service, and what is provided by third parties with your consent.

• ·School information: school name, type, city, state, affiliation and student population, entered at onboarding or updated later.
• ·Administrator information: the admin’s name, email address, phone number and designation, used to create your account and send service communications.
• ·Account and usage data: credentials, login activity, feature usage, device and browser information, and IP address, collected for security, support and service improvement.
• ·Payment information: subscription records and payment references. Full card details are handled only by our PCI-DSS compliant payment gateway and never stored on our systems.
• ·Content you upload: student records, staff records, documents, notices, communication and other data entered into your Tenant during normal use of the Service.

4. Information about students

Schools and their authorised teachers enter Student Data into the Platform for legitimate administrative and academic purposes. We process Student Data only to provide the Service and in accordance with the School’s instructions.

We do not use Student Data for advertising, profiling or any purpose other than operating and securing the Service, and we never sell student information. Parents or guardians with questions about records held by a school should contact the school directly; we cooperate with schools in exercising data rights.

5. How we use your information

• ·To provision your school’s Tenant and generate administrator credentials.
• ·To operate, maintain, secure and improve the Service, including access control and fraud prevention.
• ·To bill subscriptions, manage renewals, issue invoices and process refunds.
• ·To send service, renewal, support and, with consent, product update communications.
• ·To comply with legal obligations and to exercise or defend our legal rights.

6. Legal basis (DPDP Act, 2023)

Where the Digital Personal Data Protection Act, 2023 (India) applies, we process personal data on valid lawful bases, principally: the performance of our contract with your School, your consent where we seek it, compliance with legal obligations, and our legitimate interests in operating a secure, reliable service. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Tenant isolation

Every school is provisioned as an isolated Tenant. Student and school records are scoped server-side so that no school can view another school’s data. Cross-tenant access is structurally prevented rather than merely discouraged.

8. Security measures

• ·Data is encrypted in transit (TLS) and at rest (AES-256).
• ·Passwords are stored only as salted hashes and are never displayed to, or recoverable by, anyone.
• ·Access to infrastructure is restricted, monitored and subject to least-privilege controls.
• ·We maintain audit logs and investigate suspected security incidents promptly.

9. Sharing with third parties

We do not sell, rent or trade your personal information. We share data only with the limited set of processors needed to run the Service, under written data-processing obligations, including:

• ·Cloud infrastructure and hosting providers that store and run the Service.
• ·The payment gateway(s) that process subscription and fee payments.
• ·Email, SMS and notification providers used to deliver service messages.
• ·Professional advisers and regulators where required by law or to protect rights.

10. Retention and deletion

We keep your data while your account is active and for a reasonable period afterwards to comply with law, resolve disputes and enforce agreements. You may request export or deletion of your data at any time; we respond within 30 days and, where deletion is requested, delete the data unless we are required to retain a limited portion by law.

11. Cookies and similar technologies

We use an essential session cookie to keep you signed in. We may use basic, privacy-respecting analytics to understand overall usage. Payment pages are served by our gateway and use its own cookies. You can disable cookies in your browser, though parts of the Service may then not work as intended.

12. Your rights and choices

• ·Access: obtain a copy of the personal information we hold about you.
• ·Correction: ask us to correct inaccurate or incomplete information.
• ·Erasure: request deletion of personal information where no legal basis requires retention.
• ·Portability: request your data in a structured, machine-readable format where feasible.
• ·Withdrawal of consent: withdraw any consent you have given, without affecting prior processing.

13. Data breach notifications

If we become aware of a security breach affecting your personal information, we will notify you and any relevant authorities in line with the requirements of the DPDP Act, 2023 and its rules, and will take reasonable steps to mitigate the impact.

14. Children’s privacy

The School is the data fiduciary in respect of Student Data. We rely on the School to obtain any consents required from parents or guardians for records maintained on the Platform. If we become aware that a child’s information has been provided to us other than through a school acting with appropriate authority, we will take steps to remove it.

15. Changes to this policy

We may update this policy as the Service and the law evolve. Updated versions will be posted on the Platform, and for material changes we will notify you by email or in-app notice before the new policy takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

16. Contact and complaints

If you have a concern about how we handle personal information, contact us first and we will work to resolve it promptly.