Introduction and Scope
CampusTrue (“CampusTrue”, “we”, “us” or “our”) provides a campus management platform to schools, colleges, universities and coaching institutes. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you use our websites, web application, mobile applications and related services (together, the “Platform”).
It applies to everyone who interacts with us: institutions that subscribe, administrators and teachers who log in, students and parents who use the apps, applicants who apply through an admission form, and visitors who only read the marketing website.
This policy is published under the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Where an institution has signed a separate data processing agreement with us, that agreement governs any point on which the two documents differ.
Who Controls the Data
The distinction below decides who you should approach with a request, so it is worth reading before the rest.
- The institution is the Data Fiduciary
- For everything inside a campus account — student records, marks, attendance, fee ledgers, staff files — the subscribing institution decides what is collected and why. It is answerable for that data under the DPDP Act.
- CampusTrue is the Data Processor
- We store and process that data only to run the Platform for the institution, on its documented instructions. We do not decide the purpose of processing and we do not use campus data for our own ends.
- CampusTrue is the Data Fiduciary for its own records
- For our billing records, sales enquiries, support tickets, and analytics about the marketing website, we are the fiduciary and you can bring requests directly to us.
Information We Collect
Information you or your institution give us
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, role, employee or enrolment number, username, hashed password, profile photograph | Institution admin, or the user at first login |
| Contact | Email address, mobile number, postal address, emergency contact | Institution admin, admission form |
| Institution | Institution name, affiliation and board, campus addresses, GSTIN, authorised signatory | Subscribing institution |
| Academic | Class and section, attendance, internal and term marks, transcripts, discipline notes, certificates | Teachers and administrators |
| Financial | Fee heads, invoices, receipts, concessions, transaction references, refund records | Institution finance staff, payment gateway |
| Communications | Notices, circulars, in-app messages, support tickets and their attachments | Platform users |
Swipe the table sideways to see every column.
Information collected automatically
- Device and browser type, operating system version, screen size and app build number
- IP address and the approximate city derived from it — we do not collect GPS location from the web app
- Login timestamps, session duration, and the pages or modules opened
- Diagnostic logs and crash reports, retained to find and fix faults
- For the attendance mobile app only, and only where the institution enables it: coarse location at the moment a staff member marks attendance, so a campus can verify on-site check-in
What we deliberately do not collect
- Card numbers, CVV or UPI PINs — these go straight to our PCI-DSS compliant payment gateway and never reach our servers
- Aadhaar numbers, unless an institution chooses to store them for a statutory scholarship filing and confirms it has the consent to do so
- Biometric templates, except where a campus integrates its own biometric device, in which case only the resulting attendance mark reaches us
- Continuous or background location, microphone or camera access outside an action you start
How We Use Information
We use personal data only for the purposes below, and only for as long as the purpose lasts.
| Purpose | What it covers | Basis |
|---|---|---|
| Providing the Platform | Authenticating logins, showing records, marking attendance, issuing report cards and receipts | Performance of the subscription contract |
| Billing | Raising invoices, collecting subscription fees, tax reporting, and dunning for unpaid invoices | Contract and statutory obligation |
| Service communication | Downtime notices, security advisories, release notes and renewal reminders | Legitimate use in running the service |
| Support | Reproducing a reported fault, restoring data, and answering tickets | Institution's instruction |
| Security and abuse prevention | Rate limiting, fraud checks, audit logging, and investigating suspicious access | Statutory obligation and legitimate use |
| Product improvement | Aggregated, de-identified usage counts that inform what we build next | Legitimate use — never on identifiable student data |
| Marketing | Product emails to people who asked to hear from us | Consent, withdrawable at any time |
Swipe the table sideways to see every column.
Children and Student Data
A large share of the records on the Platform belong to people under eighteen. The DPDP Act treats them as children, and the following applies to their data without exception.
- Children's records are created by the institution under its own lawful basis, with verifiable parental consent collected by the institution at admission
- We do not process a child's data for advertising, behavioural tracking or profiling of any kind
- Parent and guardian access is granted by the institution, which decides which records a linked account can see
- A parent or guardian may ask the institution to correct or erase a child's record; we act on the institution's confirmed instruction and complete it within thirty days
- Student accounts do not receive marketing email from us at any time
Data Security
Security is enforced in layers, so that no single failure exposes a record.
- In transit
- TLS 1.2 or higher on every connection, with HSTS enforced across all CampusTrue domains and apps.
- At rest
- AES-256 encryption on databases, file storage and backups. Passwords are stored only as salted one-way hashes and can never be read back by us.
- Access control
- Role-based permissions inside every institution account, least-privilege access for our own staff, mandatory multi-factor authentication for administrative tools, and a full audit trail of privileged actions.
- Resilience
- Automated daily backups with point-in-time recovery, kept encrypted in a separate region and restore-tested on a schedule.
- Assurance
- Periodic vulnerability scanning, independent penetration testing, dependency patching, and review of code that touches authentication or payments.
No system is perfectly secure. You are responsible for keeping your credentials confidential, for revoking access when a staff member leaves, and for telling us at once if you suspect an account has been compromised.
Data Retention and Deletion
| Record | Retention |
|---|---|
| Active campus data | For as long as the subscription is live, plus the export window after it ends |
| Data after termination | Exportable for 90 days, then permanently deleted from live systems within 30 days of that window closing |
| Encrypted backups | Rolling 90-day cycle; deleted records age out and are not restored |
| Invoices and tax records | 8 years, as required by the Income Tax Act and GST law |
| Security and audit logs | 180 days, then deleted or aggregated beyond identification |
| Support tickets | 24 months from closure |
| Marketing contacts | Until consent is withdrawn, then removed within 7 days |
Swipe the table sideways to see every column.
An institution may ask for earlier deletion in writing at any time. We will confirm the request with an authorised signatory before acting, because deletion cannot be undone.
Your Rights
Subject to verification of your identity, you may exercise the following rights over your personal data.
- Access
- Obtain a summary of the personal data we hold about you and of the processing carried out on it.
- Correction and completion
- Have inaccurate data corrected and incomplete data completed. Most fields can be corrected in the Platform by your institution immediately.
- Erasure
- Have data deleted once the purpose it was collected for has ended, unless we must keep it to meet a legal obligation.
- Portability
- Receive campus data in a structured, machine-readable format — CSV or JSON — through the export tools or on request.
- Withdraw consent
- Withdraw consent where processing rests on it, including unsubscribing from product email. Withdrawal does not undo processing already carried out.
- Nominate
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
- Grievance redressal
- Have a complaint answered by our Grievance Officer, and escalate to the Data Protection Board of India if the answer does not satisfy you.
We answer rights requests within 30 days and free of charge. Requests that are manifestly excessive or repetitive may attract a reasonable fee, which we will tell you about before we act.
Storage Location and Transfers
Campus data is stored in Indian regions of our cloud provider and is not transferred out of India for routine processing. A limited set of operational tools — error monitoring and email delivery among them — may process diagnostic or transactional metadata outside India under contractual safeguards. We do not transfer data to any territory that the Government of India has restricted.
Third-Party Links and Integrations
The Platform links to and integrates with services we do not control, including payment gateways, video conferencing tools, government portals and app stores. Once you follow a link or authorise an integration, that provider's own privacy policy governs what it does with your data. Review it before you connect anything.
Changes to This Policy
We update this policy when the Platform, the law or our sub-processors change. The revision date and version at the top of this page always reflect the current text.
For material changes — a new category of data, a new purpose, or a new class of recipient — we give at least 30 days' notice by email to account administrators and by an in-app notice, so an institution that objects has time to act before the change takes effect.