Privacy Policy
Last updated: January 11, 2026
ManabiLabs ("ManabiApp," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our school management software platform and related services (the "Services").
This policy is compliant with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. By using our Services, you consent to the data practices described in this policy.
1. Data Fiduciary Information
For the purposes of the DPDP Act, ManabiLabs acts as the Data Fiduciary for the personal data processed through our Services.
Data Protection Officer
ManabiLabs
Bangalore, Karnataka, India
Email: privacy@manabiapp.com
Phone: +91 84462 96595
2. Personal Data We Collect
We collect the following categories of personal data to provide our school management services:
2.1 School Administrator Data
- Name, email address, and phone number
- School name, address, and registration details
- Billing and payment information
- Login credentials (password stored in encrypted form)
2.2 Student Data
- Student name, date of birth, and gender
- Admission number and class/section details
- Parent/guardian contact information
- Attendance records
- Academic marks and report cards
- Fee payment history
- Photographs (for ID cards, with explicit parental consent)
2.3 Parent/Guardian Data
- Name, email address, and phone number
- Relationship to student
- Communication preferences
- Payment transaction records
2.4 Staff/Teacher Data
- Name, email, phone number, and qualifications
- Employment details and assigned classes
- Login credentials
2.5 Technical Data
- IP address and device information
- Browser type and operating system
- Usage logs and access timestamps
- Cookies and similar tracking technologies
3. Processing Children's Data
Important: Under India's DPDP Act, anyone under 18 years of age is classified as a child. We take additional precautions when processing children's data.
When processing the personal data of students under 18 years:
- We obtain verifiable parental consent through the school enrollment process before processing any child's data
- We do not engage in behavioral tracking or profiling of children for advertising purposes
- We do not serve targeted advertisements to children
- We only track and monitor children's activities for legitimate educational purposes (attendance, academic performance) and safety
- Location tracking (if enabled for school transport) is strictly limited to during school transport hours and with parental consent
4. Purpose of Data Processing
We process your personal data for the following specified purposes:
| Purpose | Data Used |
|---|---|
| Providing school management services | All categories as required |
| Fee collection and payment processing | Student, parent, payment data |
| Attendance tracking and parent notifications | Student attendance, parent contact |
| Academic record management | Student academic data |
| Parent-school communication | Contact information |
| Generating compliance reports (CBSE, etc.) | Student attendance, academic records |
| Customer support | Administrator contact data |
| Service improvement and analytics | Technical data (aggregated/anonymized) |
5. Consent and Legal Basis
Under the DPDP Act, we process your personal data based on:
- Consent: When you sign up for our Services or when a school enrolls student data with parental consent
- Contractual necessity: To fulfill our service agreement with subscribing schools
- Legal obligation: When required to comply with educational regulations (RTE Act, CBSE requirements)
Your consent is free, specific, informed, and unambiguous. You may withdraw consent at any time by contacting us, though this may affect your ability to use certain features of our Services.
6. Data Sharing and Third Parties
We do not sell your personal data. We may share data with:
- Payment processors (Razorpay, PayU) for fee transactions - they act as independent Data Fiduciaries
- Cloud infrastructure providers (AWS, Google Cloud) who host our services under strict data processing agreements
- Communication service providers (WhatsApp Business API, SMS gateways) for notifications
- Government authorities when required by law or to comply with educational regulations
All third-party processors are bound by data processing agreements ensuring DPDP Act compliance.
7. Data Retention
We retain personal data only as long as necessary for the purposes collected:
| Data Category | Retention Period |
|---|---|
| Active student records | Duration of enrollment + 3 years |
| Academic records (marks, certificates) | 7 years (regulatory requirement) |
| Fee/payment records | 7 years (tax/audit requirements) |
| Attendance logs | Current academic year + 2 years |
| System/access logs | 1 year |
| Inactive accounts | Deleted after 1 year of inactivity (with 48-hour notice) |
Upon request or when retention period expires, data is securely deleted or anonymized.
8. Data Security
We implement reasonable security safeguards as required by the DPDP Act:
- Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
- Access control: Role-based access, multi-factor authentication for administrators
- Monitoring: Access logging, intrusion detection, and regular security audits
- Backups: Daily encrypted backups with geographic redundancy
- Employee training: Regular data protection training for all staff
- Incident response: Documented procedures for breach detection and response
9. Data Breach Notification
In the event of a personal data breach, we will:
- Notify the Data Protection Board of India within 72 hours
- Notify affected Data Principals (you) without undue delay
- Take immediate steps to contain the breach and prevent recurrence
- Document the breach and remediation actions taken
10. Your Rights (Data Principal Rights)
Under the DPDP Act, you have the following rights:
- Right to access: Request a summary of your personal data and processing activities
- Right to correction: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your data (subject to legal retention requirements)
- Right to withdraw consent: Withdraw consent at any time for future processing
- Right to grievance redressal: Lodge complaints with us or the Data Protection Board
- Right to nominate: Nominate a person to exercise your rights in case of death or incapacity
To exercise these rights, contact us at privacy@manabiapp.com. We will respond within 7 days.
11. Cookies and Tracking Technologies
We use cookies and similar technologies for:
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Essential | Login sessions, security | No (necessary for service) |
| Functional | Preferences, language settings | No (improves experience) |
| Analytics | Usage patterns, performance | Yes |
We do not use advertising or tracking cookies. You can manage cookie preferences through your browser settings.
12. Cross-Border Data Transfer
Your data is primarily stored and processed in India. If any data is transferred to servers outside India (for cloud services), we ensure such transfers comply with DPDP Act requirements and are made only to jurisdictions not restricted by the Central Government. We do not transfer data to restricted countries.
13. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification at least 7 days before changes take effect. Continued use of our Services after changes constitutes acceptance of the updated policy.
14. Grievance Redressal
If you have concerns about our data practices:
- Contact us first: Email privacy@manabiapp.com - we will respond within 7 days
- Escalate if needed: If unsatisfied, you may file a complaint with the Data Protection Board of India
Contact for Privacy Queries
Email: privacy@manabiapp.com
Phone: +91 84462 96595
Address: ManabiLabs, Bangalore, Karnataka, India