Privacy policy

1.Who we are

Schoolcanvas is a brand of Infogem Web Solutions Pvt Ltd ("Schoolcanvas", "we", "us"), a company based in Chennai, India. We have built software for schools since 2009.

2.What this policy covers

This policy applies to:

• Our website, schoolcanvas.com, including the demo, contact and DPDP-document request forms.
• The Schoolcanvas school platform: the ERP, the web login at app.schoolcanvas.com and the Schoolcanvas mobile apps used by school staff, parents and students.
• Assist, our AI-powered learning platform for schools.
• Our dealings with schools and their staff as customers: sales, onboarding, billing and support.

Your school may give you its own privacy notice for the data it puts into Schoolcanvas. That notice explains the school's purposes and choices, and it applies alongside this policy. If another Schoolcanvas service has its own privacy notice, that notice applies to that service.

3.Our two roles under the DPDP Act

The DPDP Act separates the organisation that decides why and how personal data is used (the Data Fiduciary) from the organisation that processes it on its behalf (the Data Processor). We play both roles, for different data.

The dividing line is purpose. If we ever used school data for a purpose we chose rather than one the school instructed, we would become a Data Fiduciary for that activity and would need our own lawful basis. Our standing commitment is not to do this (see section 7).

4.Information we collect through this website

Information you give us

When you book a demo, contact us, start a free trial, join the early-access list for Schoolcanvas Learn or enquire about a partnership, we ask for some or all of the following:

• your name, mobile number and e-mail address;
• your school's name, your role at the school and your city;
• the number of students, the school's board, the products you are interested in, and how you would like your demo (online or at your school);
• whether your school already uses Schoolcanvas, and any message you choose to write.

Please give us only the details of your school and yourself. Do not send us student records or other people's personal data through the website forms.

Information collected automatically

Like most websites, our server records basic technical data when you visit, such as your IP address, browser and device type, the pages you view and the date and time. We use this to run, secure and improve the website.

Information from others

If a colleague at your school, a partner or an event organiser passes your details to us so that we can contact you about Schoolcanvas, we use them under this policy and tell you where we got them when we first contact you.

5.Cookies and analytics

Cookies are small files stored by your browser. We use:

• Essential cookies, which the website needs to work and stay secure (for example, to remember a form step or keep you signed in to the site's admin area).
• Analytics, which help us understand how many people visit, which pages they read and how they found us, so we can improve the site. Where these tools are not essential, we ask for your consent first.

You can block or delete cookies in your browser settings. The website will still work, though some features such as forms may not remember your progress.

6.How we use your information, and why

We use personal data only for a lawful purpose and on one of the two bases the DPDP Act allows: your consent, or a legitimate use listed in the Act (for example, where you have voluntarily given us your details for a specific purpose, or where the law requires us to process them).

Consent is always free, specific, informed and unambiguous, and you can withdraw it as easily as you gave it (see section 14). Withdrawing consent does not affect processing that happened before you withdrew it.

7.How we handle school data

For data that a school puts into the Schoolcanvas platform or Assist, the school decides what is collected and why, issues its own privacy notice and obtains any consent needed. The school owns its data. We make these eight standing commitments to every school, and we are prepared to write them into the school's Data Processing Agreement:

1. Your instructions only. We process school data only on the school's documented instructions, never for any purpose of our own.
2. Never used to train AI. School data is never submitted to any external model provider for training.
3. Never sold or shared. We do not sell, rent, license or share school data with any third party for marketing, advertising, benchmarking, research or any other external purpose.
4. No ads, no adtech. We do not run ad networks, ad SDKs or adtech partners anywhere in the platform, and we do not share school data with advertisers.
5. Stored in India. All production data, backups and logs reside on India-region infrastructure.
6. Every school separate. No school can access another school's data.
7. Open about our service providers. We maintain a current list of sub-processors and give advance notice before adding a new one.
8. Your data back, then deleted. When a school leaves, we provide a full structured export and then verifiably delete its data within the agreed time, with a Certificate of Deletion.

If you are a parent, student or staff member, please send questions or requests about your school's data to your school first. If you contact us, we will pass your request to the school and act on its instructions. Read more on our DPDP page.

8.Children's data

Under the DPDP Act, a child is anyone under 18. Our website is meant for school leaders, staff and other adults. We do not knowingly collect children's personal data through the website. If you believe a child has sent us their details, please write to us and we will delete them.

In the school platform, most of the people in a school's records are children. The school, as Data Fiduciary, is responsible for obtaining verifiable consent from a parent or lawful guardian where the law requires it, and Schoolcanvas provides the tools to record it. In addition:

• there is no targeted advertising, no ad network and no adtech anywhere in the platform;
• children's data is never used to train external AI models;
• we design features to avoid processing that is likely to harm a child's well-being.

9.AI features and Assist

Some features in Assist and the platform use artificial intelligence, for example to help teachers create questions and worksheets or to suggest marks for written answers. Teachers review and validate AI-supported marking.

• School data, including student data, is never used to train external or public AI models.
• AI-assisted features use an external AI model provider under terms that do not allow it to use the data for training. The provider is listed in our sub-processor register.
• To produce a result, the relevant data passes through the provider's infrastructure outside India. It is processed in transit only and is not stored outside India. We are reviewing options to keep this processing in India.

10.Who we share data with

We do not sell personal data. We share it only with service providers who help us run Schoolcanvas (our sub-processors), under contracts that require them to protect it and use it only to provide their service to us. The main categories are:

Crash reporting, product usage analytics and backups are handled in-house, on our own infrastructure. Website enquiries are handled by our own sales and support team and the tools they use to manage and answer them.

Our current list of sub-processors is set out in our DPDP document and will be published on our website. When we add or replace a sub-processor, we update the list and tell schools in advance.

We may also disclose personal data where the law requires it, for example to a court, regulator or law-enforcement agency acting under legal authority, or to protect the rights and safety of our users, schools or the public. If our business is ever reorganised or sold, personal data may pass to the new owner, who must continue to protect it under this policy.

11.Where your data is stored

All Schoolcanvas school platform production data, backups and logs are stored on India-region infrastructure. No category of school personal data is stored outside India.

Two services route data outside India in transit only: push notification delivery through Google and Apple, and AI-assisted features. Both are listed in our sub-processor register. We will never transfer personal data to a country that the Government of India restricts.

12.How long we keep data

• Website enquiries and demo requests: for as long as we need them to respond, follow up and keep a record of our conversation with your school, and then we delete them. If you ask us to stop contacting you, we keep only a minimal record so that we respect your choice.
• Customer and billing records: for the length of our contract with the school and afterwards for as long as tax, accounting and other laws require.
• School platform data: for as long as the school instructs us, in line with its own record-keeping duties. When a school leaves, we return the data and then delete it within the agreed time, with a Certificate of Deletion.
• Security and access logs: for the period the DPDP Rules require, so that incidents can be investigated.

13.How we protect data

We use reasonable security safeguards to protect personal data against unauthorised access, loss and misuse. Today these include:

• hosting on a private cloud in a tier-IV data centre in India, with data backed up in four copies;
• role- and permission-based access, so that each user sees only what their role needs;
• strict separation between schools, so that no school can see another school's data;
• teachers' and parents' personal phone numbers hidden from each other in school communication;
• OTP verification for sensitive actions such as student gate passes.

Our quality and delivery processes are certified to ISO 9001:2015 and appraised at CMMI Level 4.

Our DPDP programme, which began on 1 October 2026, adds further safeguards in phases, including masking of contact details, controlled exports, stronger sign-in, a full audit trail and verifiable parental consent. We describe it, with its timeline, on our DPDP page. No system is completely secure, so please keep your login details private and tell us at once if you think your account has been misused.

If something goes wrong

If we confirm a personal data breach affecting school data, we notify the school within 24 hours, with the facts it needs for its report to the Data Protection Board of India, and we support it through the response. For data we hold as a Data Fiduciary, we notify the people affected and the Data Protection Board as the law requires.

14.Your rights

Under the DPDP Act you have the right to:

• Access information: a summary of the personal data we hold about you, how we process it, and who we have shared it with;
• Correct, complete, update or erase your personal data, where it is inaccurate, incomplete or no longer needed and no law requires us to keep it;
• Withdraw consent at any time, as easily as you gave it;
• Raise a grievance with us and receive a response (see section 16);
• Nominate another person to exercise your rights if you die or become unable to do so.

To use these rights for data we hold as a Data Fiduciary (for example, a demo request), write to info@schoolcanvas.com. We may need to verify your identity before acting. We respond within the period set by the DPDP Rules.

School platform data: your school is the Data Fiduciary, so please make your request to your school. The school verifies your identity and instructs us, and we carry out the request. If you write to us first, we forward your request to the school.

The Act also asks you not to impersonate anyone, not to hide material information, and not to file false or frivolous complaints.

15.Marketing messages

We send product news, event invitations and offers by WhatsApp, SMS, e-mail or phone only if you have opted in. Opting in is never a condition for getting a demo or a reply to your enquiry. You can opt out at any time:

• E-mail: use the unsubscribe link in any marketing e-mail;
• WhatsApp or SMS: reply to the message asking us to stop;
• Any channel: write to info@schoolcanvas.com or call +91 86086 24700 / 86084 24700.

Opting out of marketing does not stop service messages that are needed for an account or contract, such as OTPs or billing notices. Messages that your school sends you through Schoolcanvas are the school's communications; ask your school to change those preferences.

16.Grievance officer and data protection contact

If you have a question or complaint about how we handle personal data, please contact our data protection contact, who also acts as our Grievance Officer:

We acknowledge your grievance and respond within the period set by the DPDP Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

For school platform data, your school's own data protection contact is your first point of contact.

17.Changes to this policy

We will update this policy as our services, the law and the DPDP Rules develop. The date at the top shows when it last changed. If we make an important change, we will tell schools directly and show a notice on this website. Where a change needs fresh consent, we will ask for it.

18.Contact us

For anything about this policy or your personal data, write to info@schoolcanvas.com, call +91 86086 24700 / 86084 24700 (Monday to Friday 9 am to 6 pm, Saturday 9 am to 4 pm), or visit our contact page.