Privacy Policy

Ednova™ is school management software published by Juno AI Private Limited. This policy explains what personal data the software handles, why, for how long, and what you can ask us to do about it. It covers the Ednova web application, the Ednova Android and iOS apps, and this website.

1. Who is responsible for your child's data

This is the most important paragraph in this policy, because it decides who you should ask when you want something changed or deleted.

2. What the software handles

Only what a school switches on. A school that does not use transport stores no transport data.

3. Why we process it

We process personal data for one reason only: to run the school management service your school has asked us to run. In practice that means operating the modules your school has switched on, delivering the notifications it has configured, processing fee payments it has enabled, producing the documents and reports it issues, keeping the service secure and available, and providing support when your school asks for it.

We do not process personal data for advertising, for profiling, for resale, or to train machine-learning models. If we ever needed data for a purpose outside this list, we would need your school's instruction first.

4. Who owns the data

Your school does. Everything a school or its families put into Ednova — student records, marks, fee history, uploaded documents — remains the school's data throughout. We hold it as a processor. We do not acquire ownership of it, we do not license it to anyone, and we do not treat it as ours to reuse.

A school can take its data out at any time, not only when leaving. The software produces a complete export as a ZIP file: the records as CSV files, the uploaded documents alongside them, and a manifest naming every dataset with its row count and stating plainly anything that was deliberately excluded and why. What a school gets back is auditable, not a black box.

5. Consent, and who obtains it

Under the Digital Personal Data Protection Act, the obligation to obtain consent sits with the Data Fiduciary — your school, not us. Your school decides what to record, tells families why, and obtains consent from parents and lawful guardians, including the verifiable parental consent the Act requires before a child's data is processed.

Our contracts with schools require them to have obtained the necessary consents before uploading personal data to the platform. We process on the school's instruction and are not in a position to verify each consent ourselves. If you believe your child's data is held without a proper basis, raise it with your school first — they can act immediately. If they do not resolve it, our Grievance Officer is named at the end of this policy.

Where we collect data directly rather than on a school's behalf — a demo request, a billing contact, a support conversation — we are the Data Fiduciary for that limited data and obtain consent ourselves.

6. Children's data

Most of what this software holds is about children, and India's Digital Personal Data Protection Act treats that as requiring particular care. We do not show advertising of any kind, we do not profile children, and we do not sell or share children's data with third parties for their own purposes.

A child's own account, where a school enables one, gives the child access to their own records only. Guardians see their own children's records and no others.

7. How long it is kept

Academic and financial records are kept for as long as your school needs them — a school is normally required to retain them, and deleting a mark or a receipt on request is usually not something the school can do. The periods below are the ones the software enforces automatically.

Where a record is subject to a legal hold — a dispute, an inquiry or a regulatory requirement — it is kept until that hold is released, and no automatic deletion touches it.

8. Who else sees it

We use the following processors, each for one purpose and none of them for their own. They receive only what that purpose needs.

We disclose data to no one else, except where the law requires it. Data is stored on servers located in India.

9. Where it is stored, and what leaves India

School records are stored on servers located in India, and the working copy of your school's data does not leave the country.

Three of the processors named above are global services, and using them means a specific, limited item of data crosses a border at the moment a message is sent:

No student record, mark, fee history or uploaded document is transferred abroad. The Act permits such transfers except to countries the Central Government restricts by notification, and we will stop using any processor that becomes restricted.

10. How it is protected

• Traffic between your device and our servers is encrypted in transit.
• Sensitive fields are encrypted at rest with a key held separately from the database.
• Access is permission-controlled: staff see only what their role allows, and a teacher sees only their own classes.
• Reads of sensitive personal data are recorded, so a school can answer "who looked at this, and when".
• Links to uploaded files expire, so a shared link does not become a permanent open door.
• Each school's data is fenced from every other school's.

11. If something goes wrong

If personal data held in Ednova is exposed, altered or lost without authorisation, we will:

• Tell your school first and quickly, because as Data Fiduciary the school carries the duty to inform you and the regulator, and it cannot discharge that duty until we have told it what happened.
• Notify the Data Protection Board of India within the period the DPDP Rules require, and support the school in notifying affected people without delay.
• Say what we actually know — what happened, which categories of data were involved, roughly how many people, what we have done to contain it, and what you should do.
• Preserve the evidence. Reads of sensitive personal data are already recorded, so a school can be told who accessed what and when, rather than guessing.

We would rather tell a school about an incident that turns out to be minor than sit on one while we decide how serious it is.

12. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• Access the personal data held about you or your child.
• Correct anything inaccurate, incomplete or out of date.
• Request erasure where the data is no longer needed and no law requires it to be kept.
• Nominate another person to exercise these rights on your behalf.
• Complain to the Data Protection Board of India if we or your school do not resolve your grievance.

Ask your school first. The school holds these records and can act at once; we act on the school's instruction. If your school does not resolve it, contact our Grievance Officer below.

13. Notifications, and turning them off

The software sends SMS, WhatsApp, email and push notifications about your child — attendance, fees, results, transport and school announcements. You can change what you receive, per channel, in the app's notification settings. Some messages cannot be switched off, because they are how a school discharges a duty to you: a fee demand, a safety alert, or a one-time passcode you asked for.

We do not send marketing messages to families on these channels.

14. Cookies and tracking

This website sets no cookies and runs no JavaScript at all. There is no analytics tag, no advertising pixel and no third-party tracker on ednova.in. Nothing here follows you to another site.

The Ednova application does not use cookies either. When you sign in, your session is held in your browser's local storage on your own device, and signing out clears it. The mobile apps hold the equivalent on the device.

The application records its own usage diagnostics, described in the children's-data section above. These are first-party and stay with us: which screen was opened, which kind of control was used, which API call was made, and a trimmed error summary. Identifiers inside screen paths are masked before the event is stored, so records aggregate without naming anyone. No form value, no typed text and no advertising identifier is ever collected, nothing is shared with a third-party analytics provider, and events from a student's own account are dropped at the server and never stored.

15. Changes

If we change this policy materially we will tell schools before the change takes effect, and the version and date at the top of this page will change.

16. Governing law

This policy is governed by the laws of India, and the courts at Fatehabad, Haryana have exclusive jurisdiction over any dispute arising out of it. Nothing here limits a right you have under the Digital Personal Data Protection Act, 2023, including your right to complain to the Data Protection Board of India.

17. Contact