Privacy Policy

EDUSHA (“we”, “us”, “our”) operates an education management platform at edusha.in. This Privacy Policy describes how we collect, use, store, and protect your personal information in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011(“SPDI Rules”).

By using our platform you consent to the collection and use of information as described herein.

We collect the following personal and sensitive personal data:

• Identity data: Full name, email address, phone number
• Academic data: Grade, batch enrolment, attendance records
• Financial data (teachers only): UPI ID, bank account number, pay-per-class rate
• Payment data (students/parents): Razorpay order and payment IDs (we do not store card numbers or CVVs)
• Usage data: Session join logs, resource access, queries submitted
• Profile data: LinkedIn URL (teachers, optional), qualification, bio

Financial data such as UPI IDs and bank account numbers constitutes sensitive personal data or information (SPDI) under the SPDI Rules and is handled with heightened care.

We collect your data solely to:

• Create and manage your account on the platform
• Facilitate class scheduling, attendance tracking, and resource sharing
• Process fee payments via Razorpay
• Calculate and disburse teacher remuneration
• Send session reminders and administrative notices
• Comply with legal obligations

We do not use your data for advertising, and we do not sell it to third parties.

Your data is shared only with the following processors, each bound by their own privacy commitments:

• Clerk (clerk.com) — Authentication and identity management
• Razorpay (razorpay.com) — Payment processing (PCI-DSS compliant)
• Supabase (supabase.com) — File/document storage
• Render / Railway — Cloud hosting infrastructure

We may disclose data to law-enforcement or regulatory authorities if required by law. No other disclosure occurs without your explicit consent.

• Account and profile data is retained for the duration of your active account.
• Payment records are retained for 8 years as required by Indian tax regulations.
• Attendance and session logs are retained for 3 years.
• Upon account deletion all data except legally mandated payment records is permanently erased.

You have the right to:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Erasure — Request deletion of your account and associated data
• Withdrawal of consent — Withdraw consent at any time; this may affect your ability to use the platform

To exercise any of these rights, contact our Grievance Officer (see Section 9).

We implement reasonable security practices as required under Section 43A of the IT Act, including:

• TLS/HTTPS encryption for all data in transit
• Role-based access control — users can only access data relevant to their role
• Audit logging for sensitive administrative actions
• Third-party authentication (Clerk) with no local password storage
• Payment tokenisation via Razorpay — card data never touches our servers
• HTTP security headers (HSTS, CSP, X-Frame-Options, etc.)

We use session cookies set by Clerk for authentication purposes only. We do not use tracking or advertising cookies.

In accordance with Rule 6 of the SPDI Rules, the details of our Grievance Officer are:

We may update this policy periodically. Continued use of the platform after changes constitutes acceptance. Material changes will be notified via email.