Privacy Policy

This policy explains what Alabaster Edutech LLP (“we”, “us”) collects when you use the NAPA app and website, why we collect it, and what control you have. It is written to meet India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. What we collect

Information you give us

• Your account: mobile number (used to sign in), name, and optionally a profile photo.
• Your child: name, class or section, and the admission number your school uses to match them to their records.
• What you post: posts, comments and images you share in a class community, and messages you send to teachers or other parents.
• Support requests: anything you send us by email or phone.

Information from your school

Your school supplies the records shown in the app — announcements, homework, attendance, fee schedules, report cards and calendar events — and links them to your child.

Information collected automatically

• Device and app data: app version, device model and operating system, and error logs, used to diagnose crashes.
• Usage data: which screens are opened, to understand what parents actually use.

We do not collect your location, contacts, photos library, or microphone except where you explicitly attach something.

2. Children’s data

NAPA is used by parents and guardians, not by children. Accounts are held by adults. Information about a child is added either by the child’s parent or by the school the parent is linked to, and is visible only to that parent, the school, and staff the school authorises.

We do not use a child’s personal data for advertising, profiling, or behavioural tracking of any kind. Under the DPDP Act we treat a child’s data as processed on the basis of verifiable parental consent, given when you add your child and confirm the consent notice during onboarding.

3. Why we use it

• To show you your school’s information for your child, and to sign you in.
• To let you take part in your class community and message your school.
• To process school fee payments you choose to make.
• To send notifications you have asked for — announcements, homework, fee reminders.
• To keep the service secure, prevent abuse, and fix faults.
• To meet legal obligations.

We do not sell your personal data, and we do not use it to serve you advertising.

4. Who we share it with

• Your school, which sees your and your child’s profile and the content you post in its communities.
• Other parents in your class, who see your name, photo and what you post in that class community — and nothing else.
• Razorpay, our payment gateway, to process fee payments. Card and bank details go to Razorpay directly and are never stored by us.
• Service providers who host and operate the service for us (cloud hosting, SMS delivery for OTPs, push notification delivery, error monitoring), under contract and only for those purposes.
• Authorities, where we are legally required to disclose.

5. Where it is stored

Your data is stored on servers in India (AWS Asia Pacific, Mumbai). Some service providers may process limited data outside India; where they do, we require safeguards consistent with the DPDP Act.

6. How long we keep it

We keep your account data for as long as your account is active and your child is linked to a school. If you delete your account, we delete or irreversibly anonymise your personal data within 30 days, except where we must retain records longer by law — for example, payment and tax records, which are retained for eight years as required in India.

Content you posted in a class community may remain visible with your name removed, so that conversations others took part in stay intelligible.

7. Your rights

Under the DPDP Act you may:

• ask for a copy of the personal data we hold about you and your child;
• ask us to correct anything inaccurate;
• ask us to delete your data, and withdraw consent you have given;
• nominate someone to exercise these rights if you are unable to;
• complain to us, and then to the Data Protection Board of India.

You can delete your account in the app under Profile → Privacy & Security, or write to info@napaedu.com. We respond within 30 days.

Some records — attendance, homework, fees — belong to your school. If you want those corrected or removed, we will direct you to the school, which controls them.

8. Security

Traffic is encrypted in transit with TLS. Passwords, where used, are stored hashed, and sign-in is by one-time password to your mobile number. Access to production data is limited to staff who need it. No system is perfectly secure; if a breach affects you, we will notify you and the Data Protection Board as the law requires.

9. Changes

We will update this policy as the service changes and revise the date above. Significant changes will be notified in the app before they take effect.

10. Contact us

Questions, requests or complaints — including to our Grievance Officer — go to info@napaedu.com or +91 97696 96970.