Legal
Privacy Policy
Centres trust us with information about their students, many of them children, and their families. This page explains what we hold, why we hold it, and how we look after it.
The short version
- A centre's records belong to the centre. We hold them only to run the service for it.
- We never sell personal data and never use it for advertising.
- Each centre's data is kept apart from every other centre's.
- Card and bank details are handled by Razorpay. We never see or store them.
- A closed account is archived, not deleted, and can be restored. Ask us to erase it for good.
1. Who we are
Acadiom ("we", "us") provides Acadiom Tutor, online software that coaching and tuition centres use to run batches, attendance, exams, fees and payroll, with portals for their staff, students and parents. This policy covers that service and this website.
2. Who decides what happens to the data
The centre is in charge of its records. It decides what to record about its students, parents and staff, and we process that data on its behalf and on its instructions. If you are a student, parent or member of staff, the centre is your first point of contact for your data.
We are in charge of our own customer records. These are the details of the centre's owner and its subscription, billing and support history, and enquiries sent through this website.
3. What we hold
- Account details: the names, email addresses, phone numbers and roles of the centre's owner and staff.
- Centre records, entered by the centre: students and enquiries, parents and guardians, batches and timetables, attendance, exams and marks, fees and receipts, staff payroll, notices, uploaded documents and certificates.
- Billing details: plan, invoices and payment status for your Acadiom subscription. Payments are made through Razorpay, and we never receive card or bank account numbers.
- Student fee payment metadata: when students or parents pay fees online, order identifiers, transaction references, payer name, contact number, and email address are passed to the institution's payment gateway (Razorpay) to generate checkout sessions and verify payment status. We never collect, see, or store payment instrument secrets, card numbers, CVVs, net-banking credentials, or UPI PINs.
- Security and usage records: sign-ins, IP address, browser and device, and an audit log of important changes, used to keep accounts safe and to fix problems.
- Website enquiries: what you send us through the contact form or by email.
4. Children
Many students are under 18. Their records are created by their centre, not collected by us from the child. The centre is responsible for having a lawful basis for those records, including a parent's or guardian's consent where the law requires it, for example under India's Digital Personal Data Protection Act 2023. Parents can see their own child's information through the parent portal. A centre can correct a student's record, or erase the student's personal data, at a parent's request.
5. How we use it
- To run the service: show each person what their role allows, send the messages the centre asks us to send (receipts, reminders, notices), and produce reports and certificates.
- To bill the centre for its subscription.
- To keep the service secure, prevent misuse and investigate problems.
- To answer support requests and website enquiries.
We do not sell personal data, use it for advertising, or use a centre's records for any purpose of our own.
6. Keeping centres apart
Every request is tied to one centre. A centre's data is held either in its own database or in a shared database where every record is labelled with its centre and every query is limited to it. Staff only see what their role allows, and staff restricted to one branch only see that branch. We test these boundaries automatically on every change to the software.
7. Who helps us
We use a small number of service providers, each only for its own job:
- Cloud hosting and storage: to run the service and store its data, files and backups.
- Razorpay: to process subscription payments for Acadiom, and to process student fee payments directly on behalf of institutions using their own merchant accounts. Razorpay acts as an independent data fiduciary/controller for payment instrument processing.
- Email delivery: to send account emails and the messages a centre sends.
- Error monitoring (Sentry): to detect and fix faults. We configure it not to collect passwords or form contents.
We will share personal data with others only if the centre tells us to, or if the law requires it. Ask us for the current list of providers and where they process data.
8. How long we keep it
- While the centre subscribes: as long as the centre keeps it. The centre can delete records, and can erase a student's personal data, at any time.
- If a centre stops paying or closes its account: 7 days' grace, then 30 days read-only (still exportable), then the account is archived. We do not permanently delete an archived account on our own, so it can be restored if the centre returns.
- Erasure on request: the centre's owner can ask us to erase the centre's data completely. We will, apart from records the law requires us to keep, such as invoices.
- Backups: encrypted copies expire on their own schedule, daily copies after 90 days and weekly copies after a year, so erased data can remain in a backup until it expires.
9. Security
Data is encrypted in transit, and backups are encrypted before they are stored. Access is controlled by roles and permissions. Important changes, such as marks, fees, roles and settings, are recorded in an audit log. Data exports are encrypted, and the password is sent in a separate email. If a breach affects a centre's data, we will tell the centre without undue delay, and the regulator where the law requires it.
11. Your rights
Depending on where you live, you may have the right to see the personal data held about you, to correct it, to have it erased, to object to how it is used, or to withdraw consent. If you are a student, parent or member of staff, ask your centre first, because it holds and controls your records. We will help the centre respond. For data we hold for ourselves, write to privacy@acadiom.com.
12. Changes to this policy
We will update this page when our practices change and change the date at the top. For a significant change, we will email each centre's owner before it takes effect.
13. Contact
Privacy questions and requests: privacy@acadiom.com
Data protection officer: dpo@acadiom.com
Security issues: security@acadiom.com
Everything else: contact us · Terms of Service