Data Processing Agreement

1. Roles and definitions

Under India's Digital Personal Data Protection (DPDP) Act, 2023 — and, where applicable, the GDPR:

• Your school is the Data Fiduciary (the GDPR's “Data Controller”). The records belong to your school, and your school decides how they are used.
• Shikshel is the Data Processor. Shikshel is operated by Nadrel Technologies, which is the entity your school contracts with. We process those records only to provide the service to you, on your instructions.
• Data Principals are the people the records describe: students, their parents and guardians, teachers, and other staff.

2. Scope of processing

We process the information your school enters or uploads — student and staff records, admission enquiries, attendance, fees and payment records, marks and report cards, messages sent through the platform, and related documents — for the sole purpose of operating Shikshel for your school.

3. Children's data

Most of the students in your school are under 18, and the DPDP Act treats their personal data as a protected category. Our commitments:

• We do not carry out behavioural monitoring, profiling, or tracking of children, and we serve no advertising of any kind.
• Where the platform records a student's academic progress — marks, attendance, topics practised with the AI tutor — that information exists so teachers can teach. It is visible to the school, the student, and their parents. It is not used for any other purpose, and never leaves your school's tenancy.
• Obtaining verifiable parental consent, where the Act requires it, is your school's responsibility as Data Fiduciary. We will provide whatever information you need in order to meet that obligation.
• Children's data is never used to train AI models. Nor is anyone else's.

4. We will never contact or market to your families

Shikshel and its personnel will not:

• access or view your school's records except where strictly necessary to run the service or to provide support you have asked for;
• contact, market to, or solicit your students, parents, or staff for any purpose of our own;
• sell, rent, or share your data with anyone;
• use your data to train AI models.

Shikshel is a software company. Our business is providing this platform to your school — nothing else. This commitment is binding.

5. Confidentiality

Everyone at Shikshel with potential access to systems holding your data is bound by confidentiality obligations, and works on a least-privilege, need-to-know basis.

6. Security measures

We maintain technical and organisational measures appropriate to the sensitivity of student records: encryption in transit and at rest, database-level isolation between schools using PostgreSQL Row-Level Security, and role-based access within each school. Full detail is on our security page.

7. Sub-processors

We engage a small set of established providers, each contractually bound to protect your data:

• Supabase / AWS (Mumbai, India) — Database, authentication, and file storage
• Vercel — Application hosting and delivery
• Resend — Transactional email delivery
• Cloudflare — DNS and routing for our contact address

We will give notice before any material change to this list. If we add AI features that rely on an external model provider, that provider will be added here before the feature is available to your school.

8. Where your data is held

Your school's records — students, staff, fees, attendance, academics, and uploaded documents — are stored in India, on Supabase infrastructure hosted in the AWS Mumbai (ap-south-1) region.

Some supporting services operate outside India. Application hosting runs on Vercel's global network, and notification emails are delivered through Resend, which means a recipient's name and email address are processed outside the country in the course of sending that message. Your school's records themselves are not stored abroad. Every provider involved is listed in section 7.

9. Your data, your control

• You can delete individual records at any time, from within the platform.
• You can ask us to export your school's data, or to close your account, at any time — email the address in section 11 and we will act on it. Self-service export and closure are being built; until they are available we do this for you on request.
• On account closure we delete your data from our live systems within 30 days. We recommend exporting first: schools carry their own statutory duties to retain academic records, transfer certificates and similar documents, and meeting those obligations remains your school's responsibility.
• If a subscription lapses we suspend the account rather than delete it — access is turned off, your data is left untouched, and we will contact you. The 30-day deletion period begins only when an account is actually closed.
• Backups. Encrypted backups are retained on a rolling 7-day basis, so copies of deleted data persist in them for up to that long after erasure. We do not use backups to restore closed accounts.
• Where law requires us to retain something for longer, we will retain only that, and only for as long as required.

10. Breach notification

If a personal-data breach affecting your school occurs, we will notify you without undue delay after becoming aware of it, with the information you need to meet your own obligations to the Data Protection Board and to affected families.

11. Contact

For a countersigned copy of this agreement, or any data-protection question, contact contact@shikshel.com.

This page sets out our standard data-processing terms in plain language. Schools requiring a formally executed agreement can request one at the address above.

Shikshel is a product of Nadrel Technologies, the legal entity acting as Data Processor under this agreement.