Data Processing Agreement
This agreement explains how Shikshel processes the student, parent and staff data your school entrusts to us, and the commitments we make to protect it.
Last updated: 2 August 2026
1. Roles and definitions
Under India's Digital Personal Data Protection (DPDP) Act, 2023 — and, where applicable, the GDPR:
- Your school is the Data Fiduciary (the GDPR's “Data Controller”). The records belong to your school, and your school decides how they are used.
- Shikshel is the Data Processor. Shikshel is operated by Nadrel Technologies, which is the entity your school contracts with. We process those records only to provide the service to you, on your instructions.
- Data Principals are the people the records describe: students, their parents and guardians, teachers, and other staff.
2. Scope of processing
We process the information your school enters or uploads — student and staff records, admission enquiries, attendance, fees and payment records, marks and report cards, messages sent through the platform, and related documents — for the sole purpose of operating Shikshel for your school.
3. Children's data
Most of the students in your school are under 18, and the DPDP Act treats their personal data as a protected category. Our commitments:
- We do not carry out behavioural monitoring, profiling, or tracking of children, and we serve no advertising of any kind.
- Where the platform records a student's academic progress — marks, attendance, topics practised with the AI tutor — that information exists so teachers can teach. It is visible to the school, the student, and their parents. It is not used for any other purpose, and never leaves your school's tenancy.
- Obtaining verifiable parental consent, where the Act requires it, is your school's responsibility as Data Fiduciary. We will provide whatever information you need in order to meet that obligation.
- Children's data is never used to train AI models. Nor is anyone else's.
4. We will never contact or market to your families
Shikshel and its personnel will not:
- access or view your school's records except where strictly necessary to run the service or to provide support you have asked for;
- contact, market to, or solicit your students, parents, or staff for any purpose of our own;
- sell, rent, or share your data with anyone;
- use your data to train AI models.
Shikshel is a software company. Our business is providing this platform to your school — nothing else. This commitment is binding.
5. Confidentiality
Everyone at Shikshel with potential access to systems holding your data is bound by confidentiality obligations, and works on a least-privilege, need-to-know basis.
6. Security measures
We maintain technical and organisational measures appropriate to the sensitivity of student records: encryption in transit and at rest, database-level isolation between schools using PostgreSQL Row-Level Security, and role-based access within each school. Full detail is on our security page.
7. Sub-processors
We engage a small set of established providers, each contractually bound to protect your data:
- Supabase / AWS (Mumbai, India) — Database, authentication, and file storage
- Vercel — Application hosting and delivery
- Resend — Transactional email delivery
- Cloudflare — DNS and routing for our contact address
We will give notice before any material change to this list. If we add AI features that rely on an external model provider, that provider will be added here before the feature is available to your school.
8. Where your data is held
Your school's records — students, staff, fees, attendance, academics, and uploaded documents — are stored in India, on Supabase infrastructure hosted in the AWS Mumbai (ap-south-1) region.
Some supporting services operate outside India. Application hosting runs on Vercel's global network, and notification emails are delivered through Resend, which means a recipient's name and email address are processed outside the country in the course of sending that message. Your school's records themselves are not stored abroad. Every provider involved is listed in section 7.
9. Your data, your control
- You can export your school's data at any time.
- You can delete individual records, or close your account, at any time.
- On account closure we delete your data within 30 days. We recommend exporting first: schools carry their own statutory duties to retain academic records, transfer certificates and similar documents, and meeting those obligations remains your school's responsibility.
- Where law requires us to retain something for longer, we will retain only that, and only for as long as required.
10. Breach notification
If a personal-data breach affecting your school occurs, we will notify you without undue delay after becoming aware of it, with the information you need to meet your own obligations to the Data Protection Board and to affected families.
11. Contact
For a countersigned copy of this agreement, or any data-protection question, contact contact@shikshel.com.
This page sets out our standard data-processing terms in plain language. Schools requiring a formally executed agreement can request one at the address above.
Shikshel is a product of Nadrel Technologies, the legal entity acting as Data Processor under this agreement.
Questions before you commit?
We are happy to take your management committee or IT team through any of this in detail.