Privacy Policy

01Who is responsible for your data

StriveBit ERP is used by many independent schools, each running on its own account (“tenant”). Under the DPDP Act:

• Your school is the Data Fiduciary for student, parent, and staff records it enters into or manages through the platform — it decides what data is collected, who can see it, and how long it's kept for its own operational purposes. Requests to correct or delete education records should generally go to your school first.
• StriveBit is a Data Processor acting on the school's instructions — we provide the infrastructure that stores, secures, and displays that data, and we don't use it for our own purposes (e.g. advertising, or selling it) beyond operating and improving the service itself.
• For account and platform-level data we collect directly (e.g. login security, audit logs, support requests you send us directly), StriveBit acts as Data Fiduciary in its own right.

02Information we collect

Depending on your role and the modules your school has enabled, the platform handles:

• Account information: name, email address, phone number, role, school/tenant code, password (stored as a salted hash, never in plain text), and account status.
• Student and family information: student and parent/guardian names, relationship details, date of birth, gender, contact details, addresses, admission and class details, and student photographs where your school has added them.
• Academic and school records: class and subject assignments, attendance, marks, examination results, notices, and other records entered by the school.
• Fee and payment information: fee amounts, payment status, order/receipt identifiers, and transaction dates. Card, bank, or UPI credentials are collected and processed directly by our payment partner, Cashfree Payments — StriveBit never receives or stores them.
• Notifications: in-app notices and, if enabled, an Expo push token and device platform used to deliver push notifications.
• Security and technical information: authentication tokens stored securely on your device, IP address, and request/audit-log information needed to operate and secure the service.
• Support communications: information you send your school or StriveBit when requesting help.

We do not use this information for behavioural advertising and do not sell personal data.

03Device permissions (mobile app)

• Notifications: to send attendance, fee, and notice updates. You can disable these in device settings.
• Camera and photo library: to select or capture a profile or student photo where that feature is enabled. Only the image you choose is accessed.

You can withdraw these permissions at any time in device settings; some features may not work without them.

04Why we process information, and on what basis

Information is processed to:

• authenticate users and protect accounts;
• provide role-based access to school records;
• record and display attendance, results, notices, and fee/payment status;
• send in-app, email, and (if enabled) push notifications;
• provide password recovery and support;
• maintain security, investigate incidents, and keep audit records; and
• comply with applicable legal, regulatory, and school-record-keeping obligations.

Under the DPDP Act, our basis for processing is your (or, for a minor, your parent/guardian's) consent, given when your school creates your account and you first sign in — schools obtain this as part of admission or enrolment. You can withdraw consent at any time by asking your school to deactivate your account, subject to the Your Rights section below.

05Who we share information with

Information is shared only as necessary to operate the service:

• Your school — its authorised administrators, teachers, and staff, per the access levels your school configures.
• Cloud hosting and infrastructure providers (Amazon Web Services, region: Mumbai, India) for application hosting, the database, file storage, and transactional email.
• Expo, when push notifications are enabled, to deliver them to your device. Expo's push delivery infrastructure processes data outside India as part of that service.
• Cashfree Payments, an RBI-regulated payment aggregator, when you make a fee payment — to process the transaction and return its status to us.
• Government authorities or law enforcement, only where required by law, to protect rights and safety, or in response to a lawful request.

We do not rent, sell, or share personal data for third-party advertising.

06Cross-border transfer

The DPDP Act permits transferring personal data outside India except to countries the Central Government specifically restricts by notification. Our primary infrastructure (application, database, and file storage) is hosted in India (AWS, Mumbai region). Some service providers we rely on (see “Who we share information with” above) may process data on servers located outside India as part of delivering their service. Where this happens, we require those providers to maintain security standards consistent with this policy.

07Storage, security, and retention

Information is transmitted over encrypted (HTTPS/TLS) connections and passwords are stored hashed, never in plain text. The mobile app stores sign-in tokens in the device's secure storage; signing out removes them locally. We follow the “reasonable security practices and procedures” standard set out in the SPDI Rules, including access controls and audit logging. No system is completely secure, and we cannot guarantee absolute security.

Records are retained for as long as your school's account with StriveBit is active. Once a school's account is closed, its data is retained for a further 3 years from the date of closure — to allow the school to reactivate, resolve disputes, and meet audit and legal record-keeping needs — after which it is deleted, unless a longer period is required by law for specific records (for example, payment records under applicable tax law).

08Your rights

Under the DPDP Act, as a Data Principal you generally have the right to:

• Access a summary of the personal data we/your school hold about you and how it's processed;
• Correct or complete inaccurate or incomplete data;
• Erase data that's no longer needed for the purpose it was collected for;
• Withdraw consent at any time, as easily as it was given;
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity; and
• Grievance redressal — raise a complaint with us first (see Grievance Officer below), and with the Data Protection Board of India if unresolved.

Because your school controls the education records in the platform, requests to access, correct, or delete student and academic records should go to your school administrator first. Requests about your account/login data can be sent directly to us (see Contact us below). Some information may need to be retained despite a request where the law requires it (e.g. financial records).

09Children's data

The DPDP Act treats anyone under 18 as a child and requires verifiable consent from a parent or lawful guardian before processing a child's personal data. Student accounts and records in StriveBit ERP are created and managed by the school and/or a parent/guardian as part of admission — children do not register accounts or provide data to us directly. We do not use children's data for behavioural advertising or tracking, and do not build profiles of children for marketing purposes, consistent with DPDP Act restrictions.

If you believe a child's data has been handled improperly, contact your school administrator or us (see Contact us below) promptly.

10Data breach notification

If a personal data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, and will work with your school to inform you without undue delay.

11Grievance Officer

In accordance with the IT Act and SPDI Rules, complaints or grievances relating to this policy or your personal data can be addressed to:

We aim to acknowledge grievances within 24 hours and resolve them within 15 days, consistent with the timelines Indian IT Rules expect.

12Contact us

For privacy questions, or requests about your account/login data specifically, email erp@strivebit.io. Include your school name, the email address on your account, and the nature of your request. For student or academic records, contact your school administrator first. Never send passwords or payment credentials by email.

13Governing law

This policy is governed by the laws of India. Any dispute arising from it is subject to the exclusive jurisdiction of the courts at Bulandshahr, Uttar Pradesh.

14Changes to this policy

We may update this policy as the product, our data practices, or applicable law changes. The updated version will be posted here with a revised effective date; material changes will also be communicated through the app or another appropriate method.