Privacy Policy

Last updated: 11 June 2026 · Operated by Appkrafterrz Software Solutions (OPC) Private Limited ("Appkrafterrz", "we", "us")

Kalvi360 is a school management platform used by schools and educational institutions in India. Schools are the data fiduciaries for the personal data of their students, parents, teachers, and staff; Appkrafterrz operates the platform and processes that data on the school's instructions. This policy explains what we collect, why, where it lives, who else touches it, and the rights of the people it belongs to — written to align with India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

What we collect

• Identity & contact data — names, email addresses, phone numbers, and login credentials (passwords are stored only as salted, one-way cryptographic hashes, never in plain text).
• Student academic records — enrollment, class/section, attendance, homework, exam results, progress reports, and (where the school uses them) government education identifiers such as APAAR / PEN / EMIS.
• Documents the school uploads — student photographs, identity documents (e.g. Aadhaar scans), admission documents, certificates. These are stored as access-controlled (non-public) objects and served only to authenticated users with a legitimate role-based reason to see them.
• Fee & payment records — fee structures, installments, and payment entries recorded by the school. We do not process card/UPI payments ourselves and never see payment instrument details.
• Communications — messages, announcements, and notifications sent through the platform, plus delivery logs.
• Technical data — server logs (IP address, timestamps, requested pages) kept for security and debugging.

Why we process it

Solely to provide the school-management service the school signed up for: running attendance, academics, examinations, fees, communication between the school and families, and the optional Kalvi AI study features described below. We do not sell personal data, we do not use it for advertising, and we run no third-party trackers or analytics on the platform.

Children's data and parental consent

Most students on Kalvi360 are children under the DPDP Act. Verifiable parental consent is the school's and our shared responsibility: public admission applications require an explicit declaration by the parent/guardian submitting the form, and AI features that process a student's conversations are disabled until a parent grants consent on the parental-consent dashboard, where it can also be revoked at any time. We do not use children's data for tracking, behavioural monitoring, or targeted advertising of any kind.

Who else processes data (our sub-processors)

We use a small number of service providers to deliver specific features. Each receives only what its function needs:

• Email delivery provider — transactional email (e.g. notifications, verification emails). Receives recipient name/email and message content.
• SMS / messaging provider — SMS and messaging delivery in India (when the school enables it). Receives recipient phone number and message content.
• AI model provider — powers the Kalvi AI features (study help, teacher content generation). When an AI feature is used, the text of the request (with personal identifiers automatically redacted before sending) and relevant syllabus context are sent to the provider's API. AI features for a student only work after parental consent, and schools can disable AI entirely.
• Cloud infrastructure providers — our application, database, and uploaded files are hosted on access-controlled cloud infrastructure located in India. Backups are stored on access-controlled object storage.

Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Passwords are protected with strong, industry-standard one-way hashing; sessions and tokens are cryptographically signed.
• Every school's data is isolated per tenant; role-based access control governs who sees what, and an audit log records who changed what, when.
• Sensitive uploaded documents (identity documents, photographs, assessment reports) are stored as private objects and served only through authenticated, role-checked endpoints.

Retention

Academic records are retained for as long as the school remains a customer and instructs us to keep them — schools typically need multi-year records for regulatory and transfer-certificate purposes. When a school leaves the platform, its data is exported to the school and then deleted on its instruction. Server logs are rotated on a short cycle.

Your rights (data principals)

Under the DPDP Act you (or your parent/guardian acting for you) may request access to, correction of, or erasure of your personal data, and may withdraw consent for optional features (such as AI) at any time. Because the school is the data fiduciary, the fastest route is your school's administrator — every request they raise with us is actioned. You can also contact us directly.

Grievance officer & contact

Appkrafterrz Software Solutions (OPC) Private Limited, Chennai, India · Grievance/contact for Kalvi360: hello@kalvi360.app. We acknowledge grievances within 72 hours and aim to resolve them within 15 days, in line with DPDP Act timelines.

Changes to this policy

We will post any material change here and notify schools before it takes effect. The "last updated" date at the top reflects the current version.