Privacy Policy

2. Data Controller & Data Processor Roles

In the context of the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and international data protection standards:

• Tenant as Data Fiduciary / Controller: The educational institution (school, college, training institute) creating the workspace acts as the primary Data Fiduciary for all institutional data, including student profiles, grades, attendance, and absence notes.
• M-Prime Group as Data Processor: M-Prime Group processes institutional data strictly on behalf of and according to the instructions of the subscribing institution to deliver the M-Classboard platform.
• M-Prime Group as Independent Fiduciary: We act as an independent fiduciary solely for account administration, subscription billing, payment records, tax invoices, and platform security logs.

3. Information We Actually Collect

We only collect and process data that is technically necessary to operate our multi-tenant educational platform:

5. Third-Party Service Providers & Sub-processors

We partner with reputable industry service providers to deliver M-Classboard. All sub-processors are bound by strict confidentiality and data protection agreements:

• Payment Processing: Razorpay Software Private Limited (PCI-DSS compliant payment gateway for processing subscription fees).
• Cloud Hosting & Storage: Secure cloud infrastructure providers for application hosting, database redundancy, and document storage.
• Transactional Email & Notifications: Secure SMTP providers for verification emails, password resets, system alerts, and notifications.

6. File Upload Security & Access Controls

All uploaded files are subjected to rigorous server-side MIME type inspection, cryptographic extension validation, and virus/malicious script prevention. Sensitive files (such as student medical documents and assignment submissions) are strictly partitioned by institution and user authorization, preventing cross-tenant leakage.

7. Data Retention & Account Deletion

We retain tenant and institutional data for the active duration of the subscription agreement. Upon account termination or written deletion request by an authorized institution administrator:

• Tenant academic records and student files will be permanently purged within 30 days of service termination.
• Billing records, GST tax invoices, and payment references will be retained for the minimum statutory period required under Indian taxation and accounting laws (e.g. 7 years under GST laws).
• Security audit logs are retained for a rolling period of up to 180 days for fraud and security forensics.

8. Children & Student Privacy

M-Classboard is an enterprise SaaS platform provided to recognized educational institutions. The subscribing institution is responsible for securing verifiable parental/guardian consent where required by applicable local law before onboarding minors onto the system.

9. Technical & Organizational Security Measures

We employ modern defense-in-depth security measures to protect your data against accidental loss, unauthorized access, alteration, or disclosure:

• HTTPS / TLS 1.3 encryption in transit for all communications.
• Bcrypt password hashing with salted keys.
• Prepared statements and ORM parameterized queries to eliminate SQL injection.
• Multi-tenant scoping barriers and strict authorization policies across all routes.
• Rate limiting and brute-force protection on authentication and sensitive endpoints.