Privacy policy

1. Who is responsible for your data

Your school decides about school records. When a school uses WRAB SCHOOL, the school is the “data fiduciary” for the records it keeps about its students, parents and staff: admission details, attendance, marks, fees, transport and similar. The school decides what is collected and why. WRAB processes those records on the school’s behalf, under our data processing terms, and only as the school instructs.

We are responsible for your account. WRAB is the data fiduciary for the account you sign in with (your name, phone number, email, password and sign-in history) and for the security and operation of the service.

So: questions about what a school records about you or your child go first to the school. Questions about your account or how WRAB SCHOOL works come to us. We will help either way.

2. What we collect

Your account

• Name, mobile number and, if you add one, email address.
• A password, stored only as a secure one-way hash, never in a form we can read. If you turn on two-step verification, the authenticator secret is stored encrypted.
• Sign-in records: when you signed in, from which device and IP address, so we can protect your account.

Records a school keeps (on the school’s behalf)

• Students: name, admission number, date of birth, gender, class, photo, guardians, and the details a school uses for ID cards and statutory returns (such as UDISE+ and APAAR). Identity numbers such as Aadhaar are stored encrypted and shown only masked.
• School life: attendance, leave, homework and submissions, exams, marks and report cards, timetables, events, meetings, concerns raised, announcements and messages.
• Fees: invoices, concessions, payments and receipts, refunds.
• Transport: routes, stops and pick-up points, and the live location of a school vehicle during a trip (from the driver’s phone or a fitted tracker). We do not track the location of parents or students.
• Staff: profile, attendance and leave, salary and statutory deductions, bank details (encrypted).
• Admissions: applications and documents families submit to a school.
• Photos and documents uploaded to the school, which are encrypted when stored.

Technical information

Server logs (IP address, time, the page or action requested, errors) kept to run and secure the service. The app does not use advertising or analytics trackers, and we do not use cookies for advertising.

3. Children's data

Most students are under 18. The DPDP Act requires verifiable consent of a parent or lawful guardian before a child’s personal data is processed, and forbids tracking, behavioural monitoring and targeted advertising directed at children.

• Schools collect children’s data for education and child safety and are responsible for obtaining consent from parents where the law requires it. WRAB SCHOOL records consent decisions (for example, for photos on the school website and for APAAR IDs) and lets parents change them in the app.
• A student login is created only by the school, and a parent linked to the child can see what the school shares with them.
• We never use children’s data for advertising, never build profiles of children for marketing, and never sell it. Live bus location is used only to show families where the school vehicle is and when it will reach their stop.

4. How we use personal data

• To provide WRAB SCHOOL to the school and its community: showing each person what their role allows, sending notifications and messages the school sends, producing receipts, report cards, ID cards and returns.
• To keep it secure: verifying sign-ins, detecting misuse, keeping audit records of important actions (who did what, and when).
• To help the school when it asks us for support, only as far as that request needs.
• To meet legal obligations, such as tax records for our own billing, or a lawful request from an authority.

We do not use school records for any purpose of our own, and we do not sell, rent or trade personal data.

5. AI features

Some helpers (such as translating an announcement or drafting a report-card comment for a teacher to edit) use an AI model. They are off unless the school turns them on, and a person always reviews the result. Only the text needed for the task is sent; names are left out where possible; concerns and safeguarding matters are never sent. A school may choose a model run on WRAB’s own servers or an external provider; external providers are bound not to keep the data or use it for training.

6. Who can see it

• People at the school, by role: teachers see their own classes, accountants see fees, a driver sees only the passenger list for their trip, and parents see only their own children.
• Service providers who help deliver the service under contract and only for that purpose, for example SMS, WhatsApp, email and push-notification delivery, a payment gateway when online fee payment is used, and an AI provider if the school enables one. The current list is in our data processing terms.
• Authorities, when Indian law requires it. Where allowed, we tell the school first.

WRAB staff have no access to a school’s records through the service. If a school asks for our help with its records, we act only on that request, only as far as needed, and what we do is recorded.

7. Where data is stored

All data is stored in India, on servers operated by WRAB, with encrypted backups including a copy at a separate location in India. Each school’s data is kept separate from every other school’s.

8. How long we keep it

• School records are kept for as long as the school uses WRAB SCHOOL and for at least three years afterwards, because schools must keep many records (admissions, results, fees, payroll) for years under education, tax and labour rules. A school can download all of its data at any time and for 90 days after it leaves. After the retention period the data is deleted, or earlier if the school asks and the law allows.
• Your account is kept while you use it. If you ask us to delete it, we do so unless a school still needs the records linked to it for a legal purpose; in that case we keep only what is needed and delete the rest.
• Server logs are kept only as long as needed to run and secure the service; audit records are kept as long as the records they describe.

9. How we protect it

Encryption of files and sensitive fields, encrypted connections, access by role, two-step verification for sensitive actions, audit trails, separation of every school’s data, regular backups and restore tests. No system is perfectly secure; if a breach affects your data, we and the school will tell you and the Data Protection Board of India as the law requires.

10. Your rights

Under the DPDP Act you can:

• Get a copy of your personal data and know how it is used. Signed in, go to Sign-in & security → Download my data.
• Correct or complete it. You can edit your account details yourself; ask the school to correct school records.
• Ask for erasure of data that is no longer needed, and withdraw consent you gave (withdrawal does not affect what was done before).
• Nominate someone to exercise these rights if you die or cannot do so.
• Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

Parents exercise these rights for children under 18. Write to [privacy email] or see grievances & contact. We reply within the time the law requires, and in any case within 30 days.

11. Grievance officer

Our grievance officer is [name], reachable at [email]. Post: [legal entity name], [registered address].

12. Changes to this policy

When we change this policy we update the date and version above. If a change matters to how your data is used, we tell you in the app before it takes effect and, where the law requires, ask for your consent again.