Gyansetu One World AI

Privacy Policy

Effective date: October 14, 2026

Operated by Ruhil Future Technologies (RFT). Public URL: https://school.gyansetu.ai/privacy.html

Gyansetu One World AI (“Gyansetu School”) is a school management and education platform that helps institutes run academics, attendance, fees, communication, and related school operations. This policy describes how we handle personal information across our web and mobile applications.

1. Introduction

This Privacy Policy explains how Ruhil Future Technologies (RFT) (“RFT”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal information when you use Gyansetu One World AI — a school ERP and learning platform — through our website, mobile applications (Android and iOS), and related services (collectively, the “Service”).

Gyansetu School is designed for schools, colleges, universities, and training organizations. Authorized institute users — such as administrators, teachers, students, and parents or guardians — use the Service to manage academic records, attendance, fees, homework, report cards, messaging, and related school workflows.

We are committed to protecting personal information, operating transparently, and complying with applicable privacy laws, including the General Data Protection Regulation (GDPR), the U.S. Children’s Online Privacy Protection Act (COPPA), India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and app store privacy requirements.

2. Who This Policy Applies To

The Service is intended for use by authorized adults at education institutes and by students and parents where the institute enables those roles. It is not designed for children under 13 to create accounts without appropriate parental consent and institute oversight.

• Institute staff and administrators who create accounts and use the Service.
• Teachers, students, and parents or guardians with institute-provisioned accounts.
• Platform super administrators who operate multi-tenant infrastructure on behalf of RFT.
• Students and family members whose information is stored by authorized institute users or submitted through institute-owned forms, imports, or integrations.
• Individuals who communicate with institutes through channels connected to the Service (email, SMS, WhatsApp, or in-app messaging).

3. Information We Collect

We collect only information that is reasonably necessary to provide, secure, and improve the Service for educational and administrative purposes.

3.1 Account and staff user information

• Name, email address, phone number, role, department, and profile details.
• Login credentials (passwords are stored in hashed form; we do not store plain-text passwords).
• Single sign-on identifiers when you authenticate through Gyansetu One World or other integrated identity providers.
• Activity metadata such as last login time and permission assignments.

3.2 Student, parent, and academic information

• Contact details: name, email, phone numbers, and address information.
• Demographic details: date of birth, gender, admission number, and parent or guardian names where provided.
• Academic data: class, section, subjects, attendance, homework, assessments, report cards, and timetable information.
• Fee and finance data: fee structures, invoices, payments, discounts, outstanding balances, and receipts where enabled by the institute.
• Transport, hostel, library, gallery, diary, and other module data when those features are used.
• Communication preferences and notification settings.

3.3 Communication data

• Email, SMS, and WhatsApp message content, delivery status, and communication logs.
• In-app messenger content and notification records where enabled by the institute.
• Circulars, diary notes, and school announcements delivered through the Service.

3.4 Automatically collected information

• Device type, operating system, app version, browser type, and language settings.
• IP address, session identifiers, and usage logs needed for security and troubleshooting.
• In-app analytics derived from operational data (we do not use third-party advertising analytics SDKs).

3.5 Institute and billing information

• Institute name, domain, subscription tier, and configuration settings.
• Billing contact email and payment-related identifiers processed through our payment providers.

3.6 Mobile app permissions

• Network access — required to connect to the Service.
• Notifications — to deliver alerts about attendance, fees, messages, and assigned tasks (with your consent where required).
• Camera / media — only when you explicitly upload photos, documents, or gallery content.
• Microphone or audio — only when you explicitly use voice or meeting features that require audio.
• Storage — to cache content and attachments needed for offline viewing where supported.

4. How We Use Information

We do not sell personal information. We do not use student or parent data for unrelated advertising or profiling outside the institute’s educational and administrative purposes.

• Provide and operate the Service, including academics, attendance, fees, reporting, and user authentication.
• Enable institute communications such as email, SMS, WhatsApp, and in-app messaging.
• Support school workflows: timetable, homework, report cards, transport, and related modules.
• Process payments, usage limits, and subscription management for institute accounts.
• Maintain security, prevent fraud, enforce access controls, and produce audit logs.
• Improve reliability, troubleshoot issues, and develop product features.
• Comply with legal obligations and respond to lawful requests.

5. Legal Basis for Processing

• Performance of a contract — to provide the Service to institutes and authorized users.
• Legitimate interests — to secure the platform, prevent abuse, and improve functionality, balanced against individual privacy rights.
• Consent — where required for certain communications, marketing outreach, or mobile permissions.
• Legal obligation — where processing is necessary to comply with applicable law.
• Institute instructions — for student and parent data, the education institute typically determines the purpose of processing; RFT processes such data as a service provider on the institute’s behalf.

6. Children’s Privacy

Gyansetu School processes information about students, including minors, on behalf of education institutes. The Service is not directed at children under 13 to create their own accounts without institute and parental oversight.

In line with COPPA and similar laws, collection of personal information from children under 13 should occur only with verifiable parental consent obtained by the institute or through institute-controlled enrollment processes. Institutes are responsible for ensuring they have a lawful basis to collect and upload student data.

If we learn that personal information from a child under 13 was collected through the Service without appropriate consent, we will take steps to delete that information upon verified request. Parents or guardians may contact us using the details in Section 14.

7. How We Share Information

We share personal information only when necessary and under appropriate safeguards:

• With the education institute that owns or manages the relevant tenant account.
• With trusted service providers that help us operate the Service, such as cloud hosting, email delivery, SMS and WhatsApp providers, payment processors, and identity integration partners. These providers may process data only to perform services for us and are contractually required to protect it.
• When required by law, regulation, legal process, or governmental request.
• To protect the rights, safety, and security of RFT, institutes, users, or the public.
• In connection with a merger, acquisition, or sale of assets, subject to continued protection of personal information.

Third-party services used by the platform may include:

• Cloud infrastructure and secrets management (e.g., AWS).
• Email delivery providers (e.g., SendGrid, Amazon SES).
• SMS and WhatsApp messaging (e.g., Twilio).
• Online meeting providers where enabled by the institute.
• Payment processing providers configured for the institute.
• Gyansetu One World identity services for optional single sign-on across products.

8. Data Security

No method of transmission or storage is completely secure. While we implement industry-standard safeguards, we cannot guarantee absolute security.

• Encryption in transit (TLS/HTTPS) for data transmitted between apps, browsers, and our servers.
• Encrypted storage and access controls for sensitive credentials and tenant data.
• Role-based access control, authentication, and audit logging within the platform.
• Tenant isolation using separate database schemas per institute where applicable.
• Monitoring, backup, and incident response procedures designed to protect against unauthorized access.

9. Data Retention

We retain personal information for as long as an institute maintains an active account and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Institutes may export or manage student and operational data through the platform. When an account is terminated, we delete or anonymize data within a reasonable period unless retention is required by law or legitimate business needs (such as billing records or security logs).

10. Your Rights and Choices

Institute staff should contact their institute administrator for tenant-level data requests. Students and parents whose data is stored in the Service should contact the relevant education institute first; we will assist institutes in responding to valid requests.

To exercise rights directly with RFT, contact us using the details in Section 14. We may need to verify your identity before fulfilling a request.

• Access — request a copy of personal information we hold about you, where applicable.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of personal information, subject to legal and contractual limitations.
• Restriction or objection — object to or request restriction of certain processing under GDPR or similar laws.
• Data portability — receive personal information in a structured, commonly used format where applicable.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Communication preferences — opt out of non-essential messages and manage notification settings where available.

11. International Data Transfers

RFT is based in India. Your information may be processed in India and in other countries where our service providers operate. Where required, we implement appropriate safeguards for cross-border transfers, such as contractual protections and compliance with applicable data transfer requirements under GDPR and the DPDP Act.

12. App Store and Mobile Disclosures

When you download the Gyansetu mobile application from Google Play or the Apple App Store, additional platform-specific privacy disclosures may apply. This Privacy Policy describes our data practices across web and mobile access to the same Service.

You can stop mobile data collection associated with your device by signing out, revoking permissions in device settings, or uninstalling the app. Institute-held student data may remain subject to the institute’s retention policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective date” above and, where appropriate, notify institute administrators or display a notice within the Service. Continued use after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact: