Privacy Policy

1. Who We Are

Pehchaan is a school digitization platform operated by Pehchaan Tech Labs. We provide school management tools (Pehchaan Cloud and Pehchaan Box) and parent communication via WhatsApp.

Contact: privacy@pehchaan.io · Website: pehchaan.io

2. Data We Collect

• • Student academic data: name, class, section, attendance records, exam marks, homework, fee records, progress reports
• • Parent/guardian data: name, phone number (for WhatsApp communication)
• • Teacher data: name, phone number, role, PIN (hashed)
• • School data: school name, address, UPI ID, configuration
• • WhatsApp messages: inbound and outbound message text, timestamps, intent classification

We do NOT collect: browsing habits, behavioural patterns, psychological profiles, biometric data, location data of students, or any data for advertising purposes.

3. How We Use Data

• • Providing academic records to schools and parents/guardians
• • Sending automated WhatsApp notifications (attendance, fees, bus tracking, progress reports)
• • Processing fee payment claims (UPI reference matching)
• • Generating AI-powered progress reports (Holistic Progress Cards aligned with NEP 2020)

We do NOT use data for advertising, behavioural monitoring, psychological profiling, selling to third parties, or any purpose beyond educational assessment and school operations.

4. Children's Data Protection (DPDP Act 2023 Compliance)

• • All students are treated as children (under 18) under the DPDP Act 2023
• • We process student data ONLY for educational assessment and school management purposes
• • Schools act as the primary Data Fiduciary — they collect and manage student data
• • Pehchaan acts as a Data Processor providing tools to schools
• • Schools obtain parental consent during admission — the parent providing their phone number constitutes consent for receiving academic updates
• • Student names are anonymized before any AI processing (replaced with "STUDENT")
• • AI chat logs on Pehchaan Box NEVER leave the device or sync to cloud
• • Only structured academic data (marks, attendance, ratings) syncs from Box to Cloud
• • We do NOT perform behavioural monitoring, tracking, or targeted advertising directed at children
• • We do NOT build psychological profiles or "curiosity scores"

5. WhatsApp Data Handling

• • When a parent messages our WhatsApp number, we process the message to identify their child and respond with academic data
• • Message text is automatically deleted after 90 days from our servers
• • Message metadata (phone number, timestamp, intent type) is retained for analytics
• • Payment claims (UPI references, amounts) are retained for 7 years per Indian tax law
• • We use Meta's WhatsApp Cloud API — messages are processed on Meta's servers and our Vercel-hosted server
• • Parents can stop receiving WhatsApp messages at any time by messaging "STOP"

6. Data Sharing

• • We share student data ONLY with: the student's school administration, and the student's parent/guardian
• • We do NOT sell, rent, or trade personal data to any third party
• • We do NOT share data with advertisers
• • AI processing uses Sarvam AI (language translation) and Google Gemma (on-device only for Pehchaan Box) — student names are anonymized before any AI call
• • Fee payments go directly from parent to school's bank account via UPI — Pehchaan never handles money

7. Data Storage and Security

• • Cloud data: stored on Supabase (PostgreSQL) with Row Level Security — each school can only access their own data
• • Box data: stored locally on the school's Pehchaan Box device (SQLite, encrypted)
• • All API communication uses HTTPS
• • WhatsApp webhook endpoints are protected with Meta signature verification
• • Teacher PINs are bcrypt hashed
• • Student QR tokens can be regenerated (invalidating old tokens) for lost ID cards

8. Data Retention

• • Active student data: retained while the student is enrolled at the school
• • WhatsApp message text: automatically deleted after 90 days
• • WhatsApp metadata: retained for analytics
• • Financial records (fee payments, receipts): 7 years per Indian tax law
• • AI chat logs (Box only): stored locally on device, never synced, deleted when school requests
• • Admissions enquiries: deleted 180 days after the enquiry is closed, unless the child is admitted (section 10)

9. Your Rights (Data Principal Rights under DPDP Act 2023)

• • Access: Parents can view all data about their child via the QR-based parent portal — no login required
• • Correction: Contact the school to correct any inaccurate student data
• • Erasure: Request deletion of data by contacting the school or emailing privacy@pehchaan.io
• • Withdrawal of consent: Parents can stop WhatsApp messages by messaging "STOP" or contacting the school
• • Grievance: File a complaint with us at privacy@pehchaan.io — we will respond within 30 days
• • Data Protection Board: If unsatisfied with our response, you may file a complaint with the Data Protection Board of India

10. Admissions Enquiries

When a school uses Pehchaan for admissions, its public admissions page (pehchaan.io/admissions/…) lets a parent or guardian send an admission enquiry to that school.

• • What is collected: the parent or guardian's name and mobile number, the child's name, the class and academic year asked about, and an optional message. We also record which link brought the visitor to the page (the campaign tags in the link, for example the school's Instagram post, and the website that linked to it) and the exact consent notice the parent agreed to, with its version and the time.
• • Purpose: so the school can respond to the enquiry. The school may contact the family about it by phone or WhatsApp. WhatsApp updates about the admission are sent only if the parent ticks the separate, optional box.
• • Who is responsible: the school is the Data Fiduciary for enquiries made to it. Pehchaan Tech Labs is its Data Processor — it provides the software and stores the enquiry for the school. Only that school's staff can see it, and Pehchaan staff when needed to support the school.
• • Retention: if the child is not admitted, the enquiry is deleted 180 days after it is closed. If the child is admitted, the details become part of the school's student records.
• • Enquiries with no activity for 180 days are closed automatically.
• • Applications that are not completed are closed automatically.
• • Records of payments made to the school (receipt number, amount and dates) are kept as the school's accounting records.
• • The attribution cookie: admissions pages set one first-party cookie, adm_ft, for 30 days, to remember the first link that brought you to an admissions page. It holds only those campaign tags, the linking website and the page address; it is not shared and not used for advertising. Advertising click identifiers in links are never stored. Admissions pages run no analytics, advertising pixels or third-party scripts.
• • Your rights: you can ask the school to correct or delete your enquiry, or withdraw your consent, at any time — tell the school, or email privacy@pehchaan.io and we will pass your request to the school. You can also complain to the Data Protection Board of India.

If the school sends you an application link, the application form also collects your child's date of birth and gender, the parent and guardian names and your relation to the child, a second phone number, your address (locality, city and PIN code), your child's previous school and class, and whether you need school transport. These details are stored and kept under the same retention rule as the enquiry. The link is private to your family: it expires after 30 days and works only once.

11. Cookies and Tracking

• • pehchaan.io uses essential cookies for authentication, and one attribution cookie on public admissions pages (section 10)
• • We do NOT use advertising cookies, tracking pixels, or analytics that identify individual users
• • The parent portal (QR access) uses no cookies — it's token-based, no tracking

12. Changes to This Policy

We will update this policy as needed and post the revised version at pehchaan.io/privacy. Material changes will be communicated via WhatsApp to connected parents.

13. Contact

Email: privacy@pehchaan.io

Website: pehchaan.io

Address: Hyderabad, Telangana, India