Privacy Policy

Pideia is a school-management platform operated by BARAKVENTURES PRIVATE LIMITED, incorporated in India at WeWork Block 10, DLF Cybercity, 124, Mount Poonamallee Rd, Manapakkam, Chennai, Tamil Nadu 600089 (“Pideia”, “we”). For a school’s records, the school is the data fiduciary and Pideia is a data processor; for website visitors and account holders, Pideia is the data fiduciary.

• Student data — name, date of birth, class/section, guardian contacts, attendance, academic records; limited health info (e.g. allergies) where a school provides it.
• Staff data — contact and role details, attendance.
• Parent/guardian data — contact details and the link to their child.
• Financial data — fee and payment records.
• Calls and recordings — when a class or mentoring session runs in Pi-Meet, audio and video pass through our calling provider. A member of staff may record a session; students cannot. Recordings are stored by that provider and played back inside Pideia. We also log who joined a call and when they joined and left.
• Skill showcase — photographs and video a student uploads to show something they can do, with the skill named and anything they write about it. Nothing is visible until the student’s class teacher or the school’s leadership has approved it; until then only the student, their guardians and those reviewers can see it. Approved does not mean public — it means visible to the student, their guardians, and staff of that school.
• Profile picture — a photo of the account holder, where one is set.
• Devices, for notifications — where the Pideia app is installed, the address the device can be reached at, its platform, and the device name and app version it reports. This is how a notification gets to a phone rather than only to the app.
• Performance reports — a summary of a student’s attendance, marks, coursework and wellbeing over a period, composed from records the school already holds and written down each week and month. Nothing new about the child is collected to make one. It is a working document for their teacher and the school’s leadership, and is not shown to the student or to you.
• Wellbeing check-ins — if a student uses Wellness Wave, the mood they record. This is visible to the student, and to a counsellor only where the school has explicitly granted that access; it is not shown to teachers generally.
• Support conversations — messages you send us through the chat on our public website, and the tickets a school raises with us.
• Account & usage data — credentials (passwords stored only as salted hashes), and technical logs such as IP, device/user-agent, and action timestamps, kept for security and audit.

We do not collect Aadhaar, PAN, religion, caste, biometric data, or continuous location unless legally required or explicitly consented to.

We process personal data to deliver and secure the platform, on the basis of consent and/or performance of the service. Purposes include academics, attendance, fees and communication; authentication; security; and legal compliance. We do not sell personal data, and we do not use data for profiling or targeted advertising.

We do not sell or rent personal data, and we do not share it for anyone else’s marketing. We use the service providers (sub-processors) below to run the platform, each under an agreement requiring them to protect it and to process it only on our instructions. We may also disclose data where the law requires it.

• Supabase — database, sign-in, file storage and server functions. Holds the school records.
• Vercel — serves the web application. Requests from India are served from its Mumbai region.
• Daily.co — Pi-Meet audio and video calls, and storage of any recordings.
• Google Firebase — delivers notifications to Android devices and to the web app.
• Apple — delivers notifications to iPhone and iPad.
• Cloudflare — domain names, and the access gate in front of our internal admin console.
• Google Workspace — our own email, including anything you send to our published addresses.
• Intercom — the support chat on our public website only. It is not loaded inside the school app, so it never sees student records.

One thing about notifications is worth saying plainly. To reach a phone’s lock screen, the wording of a notification has to travel to Apple or to Google along with the address of the device. So the text of a message such as “New message from…” is read in transit by whichever of them delivers it. That is how push works on those platforms rather than a choice we made, and a school that would rather avoid it can ask us to turn push off for them; people then see notifications inside Pideia only.

If we add or change a sub-processor we will update this list. Schools that need advance notice of such a change can ask for it in their agreement.

Some of your data is processed outside India. Specifically: school records are held in our database provider’s Singapore region; the web application is served to Indian users from Mumbai; calls, and any recordings of them, are handled by our calling provider in the United States; notifications to phones pass through Apple or Google in the United States; and our email and the support chat on our public website are also handled in the United States.

Transfers are protected by encryption in transit and at rest and by contractual safeguards with each provider. We are working toward holding Indian school records within India, and will update this section when that changes rather than in advance of it.

Records the school must keep — attendance, exam results, coursework, fees, and our record of the consent that permitted the processing — are kept for as long as the school needs them or the law requires. They are not deleted on a timer. When someone exercises the right to erasure we remove what identifies them and leave those records anonymous, so the school’s register stays whole without being about that person.

Everything else is deleted automatically on a schedule:

• Call recordings — about six months.
• Showcase photos and video — two years once approved. Ninety days if nobody ever reviewed it, and thirty days if it was not approved: a file kept for a decision that is not coming, or for one already made, serves nobody.
• Wellbeing check-ins — two years.
• Wellbeing alerts raised to staff — one year.
• Chat messages — two years.
• Call attendance — one year; the room record behind it, two years.
• Notifications — ninety days.
• Performance reports — two years, so a period can be read beside the same period a year earlier. The register and the marksheet they are drawn from are kept on the terms above, not on this timer.
• Security and audit logs — two years, against a commitment of at least one.

On a school’s exit we provide an export window before deletion. These periods are reviewed as the platform changes, and this section is updated when they do.

• Strict tenant isolation via row-level security in the database.
• Role-based access on the principle of least privilege.
• Multi-factor authentication and an access gate on administrative systems.
• Encryption in transit (TLS) and at rest (AES-256).
• Showcase photographs and video are held privately and shown only through short-lived signed links, so a file cannot be shared by copying an address out of the page. Profile pictures are not protected this way — they are stored so they can load without a check on the file itself, and while we do not publish the address, anyone given it could open it.
• An append-only audit log of administrative actions.
• Managed cloud protections: web application firewall, DDoS mitigation, encrypted backups.

Our controls are designed to align with ISO 27001 best practices and OWASP ASVS. No measure is perfect; we cannot guarantee absolute security.

Subject to applicable law you may access, correct, or erase your data, withdraw consent, nominate another to act for you, and raise a grievance. Contact our grievance officer at grievance@pideia.in. Where a school manages your data, we may forward your request to that school.

Correction and erasure requests are answered within thirty days of being filed. You can raise one from Privacy in your account and follow it there; the date it is due is shown alongside it, and the school handling it sees the same date. Where a request is with your school, that school answers it — write to us at the address above if it does not.

Inside the school app we set only what is necessary to run it and keep you signed in. There is no advertising cookie and no cross-site tracking anywhere on Pideia, and we do not profile you.

On our public website only, the support chat is provided by Intercom, which sets its own cookies to recognise a returning visitor and keep a conversation going. It is loaded on the marketing pages and shut down when you enter the school app, so it is never present on a page showing school records. If you would rather not have it, blocking cookies for that page prevents it without affecting the app.

Grievance officer: Raja Samuel, grievance@pideia.in. We may update this policy; material changes are notified here with a revised date.