Privacy Policy

Manabi Labs ("ManabiApp," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our school management software platform and related services (the "Services").

This policy is written to follow India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. This policy explains how we handle personal data. Where consent is required, we ask for it separately.

1. Data Fiduciary Information

For the purposes of the DPDP Act, Manabi Labs acts as the Data Fiduciary for the personal data processed through our Services. For the admission-form fee, Manabi Labs receives the payment itself and handles the related payment confirmation data in its own right.

2. Personal Data We Collect

We collect the following categories of personal data to provide our school management services:

2.1 School Administrator Data

• Name, email address, and phone number
• School name, address, and registration details
• Billing and payment information
• Login credentials

2.2 Student Data

• Student name, date of birth, and gender
• Admission number and class/section details
• Parent/guardian contact information
• Attendance records
• Academic marks and report cards
• Fee payment history
• Photographs (for ID cards, with explicit parental consent)

2.3 Parent/Guardian Data

• Name, email address, and phone number
• Relationship to student
• Communication preferences
• Payment transaction records

2.4 Staff/Teacher Data

• Name, email, phone number, and qualifications
• Employment details and assigned classes
• Login credentials

2.5 Technical Data

• IP address and device information
• Browser type and operating system
• Usage logs and access timestamps
• Essential cookies and similar browser storage (see section 11)

2.6 Admission Applicant Data

• Parent and child details required by UDISE+, entered by the parent on the digital admission form (admission pipeline, available on every plan)
• The application number, issued after the admission-form fee payment is confirmed
• Payment confirmation details for the admission-form fee, such as transaction reference, amount and status

We do not collect Aadhaar or any other government ID numbers online, and no ID documents are uploaded. Parents show their documents in person at the school, where the admin office checks them. Card, bank and UPI details are handled by Razorpay and are not stored by Manabi Labs.

3. Processing Children's Data

When processing the personal data of students under 18 years:

• We obtain verifiable parental consent through the school enrollment process before processing any child's data
• We do not engage in behavioral tracking or profiling of children for advertising purposes
• We do not serve targeted advertisements to children
• We only track and monitor children's activities for legitimate educational purposes (attendance, academic performance) and safety

4. Purpose of Data Processing

We process your personal data for the following specified purposes:

5. Consent and Legal Basis

Under the DPDP Act, we process your personal data based on:

• Consent: When you sign up for our Services or when a school enrolls student data with parental consent
• Contractual necessity: To fulfill our service agreement with subscribing schools
• Legal obligation: When required to comply with educational regulations (RTE Act, CBSE requirements)

Your consent is free, specific, informed, and unambiguous. You may withdraw consent at any time by contacting us, though this may affect your ability to use certain features of our Services.

6. Data Sharing and Third Parties

We do not sell your personal data. We may share data with:

• Payment processor (Razorpay) for admission-form fees that parents pay online through the admission pipeline (available on every plan) - it acts as an independent Data Fiduciary
• Cloud infrastructure providers (AWS, Google Cloud) who host our services under strict data processing agreements
• Communication service providers (an SMS provider for sign-in codes; an email provider for account and service emails)
• Government authorities when required by law or to comply with educational regulations

All third-party processors are bound by data processing agreements requiring them to follow the DPDP Act.

7. Data Retention

We retain personal data only as long as necessary for the purposes collected:

Upon request or when retention period expires, data is securely deleted or anonymized.

8. Data Security

We use industry-standard safeguards, including encryption in transit, access controls and backups, to protect personal data. These include:

• Access control: Role-based access, multi-factor authentication for administrators
• Activity log: a record of who changed what, kept for one year

9. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Data Protection Board of India within 72 hours
• Notify affected Data Principals (you) without undue delay
• Take immediate steps to contain the breach and prevent recurrence
• Document the breach and remediation actions taken

10. Your Rights (Data Principal Rights)

Under the DPDP Act, you have the following rights:

• Right to access: Request a summary of your personal data and processing activities
• Right to correction: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data (subject to legal retention requirements)
• Right to withdraw consent: Withdraw consent at any time for future processing
• Right to grievance redressal: Lodge complaints with us or the Data Protection Board
• Right to nominate: Nominate a person to exercise your rights in case of death or incapacity

To exercise these rights, contact us at privacy@manabiapp.com. We will respond within 7 days.

11. Cookies and Similar Technologies

We do not use advertising, analytics or tracking cookies.

• Essential: when you sign in to ManabiApp, we use essential cookies or similar browser storage to keep you signed in and your account secure.
• Spam check on the demo form: our demo request page uses Cloudflare Turnstile to check that a person, not a bot, is sending the form. It reads technical information from your browser for that check only.
• Our marketing website does not set cookies of its own. Our hosting provider, Cloudflare, may set strictly necessary security cookies to protect the site from abuse.

You can block or delete cookies in your browser settings. If you block essential cookies, signing in may not work.

12. Cross-Border Data Transfer

Your data is primarily stored and processed in India. If any data is transferred to servers outside India (for cloud services), we ensure such transfers comply with DPDP Act requirements and are made only to jurisdictions not restricted by the Central Government. We do not transfer data to restricted countries.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 7 days before changes take effect. Where consent is required, we ask for it separately.

14. Grievance Redressal

If you have concerns about our data practices:

1. Contact us first: Email privacy@manabiapp.com - we will respond within 7 days
2. Escalate if needed: If unsatisfied, you may file a complaint with the Data Protection Board of India