Privacy Policy

We collect information you provide directly, information generated through your use of the application, and limited technical data necessary for the app to function. The categories below describe what we collect and why.

We do not collect biometric data, precise location, payment information, or any data unrelated to the leave management workflow.

Your information is used exclusively to deliver, maintain, and improve the Vidya Darpana service within your institution. Specific uses include:

• Authenticating users and enforcing role-based permissions (student, faculty, admin).
• Processing, routing, and tracking leave requests through the approval workflow.
• Sending in-app and push notifications about the status of leave requests.
• Generating leave history reports accessible to authorized administrators and faculty.
• Diagnosing technical issues, preventing abuse, and ensuring application security.
• Complying with institutional policies and applicable legal obligations.

We do not use your data for advertising, profiling, or any commercial purpose outside the scope of the leave management service.

All data is stored on servers hosted within secure cloud infrastructure. We apply the following technical and organisational measures to protect your information:

• Encryption in transit: All data exchanged between the app and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Database records and uploaded files are stored with AES-256 encryption.
• Access control: Role-based access ensures students can only view their own records; faculty can only review records assigned to them.
• Authentication: Passwords are hashed using bcrypt. We support session expiry and secure token refresh flows.
• Audit logging: Changes to leave request statuses are logged with timestamps and user identifiers.

While we implement industry-standard safeguards, no method of electronic storage is 100% secure. In the event of a data breach that affects your rights, we will notify affected users and the relevant institutional authority within 72 hours of discovery.

We do not sell, rent, or trade your personal information. Sharing is limited to the following circumstances:

• Within your institution: Leave records are visible to the faculty member assigned to review them, and to authorised administrators of your institution.
• Service providers: We work with cloud infrastructure providers (hosting, storage) and push notification services (Expo, Firebase) that process data solely on our behalf under confidentiality agreements.
• Legal requirements: We may disclose information if required by law, court order, or to protect the safety and rights of users or the public.
• Business transfer: In the event of a merger or acquisition, user data may be transferred. We will notify users and provide an opt-out window before any such transfer takes effect.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your data, subject to institutional record-keeping obligations.
• Portability: Receive your leave history in a structured, machine-readable format.
• Notification opt-out: Disable push notifications at any time in your device settings without affecting core app functionality.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details in Section 09. We will respond within 30 days. Some requests may be subject to verification of your identity.

We retain your data only as long as necessary for the purposes described in this policy or as required by your institution's record-keeping policy.

• Active accounts: Data is retained for the duration of your enrolment or employment at the institution.
• Leave records: Retained for a minimum of 3 academic years after the record was created, unless institutional policy requires longer.
• Uploaded attachments: Retained alongside the associated leave record; deleted when the record is purged.
• Device & usage logs: Retained for 90 days and then automatically deleted.

When data is no longer required, it is securely deleted or anonymised so it can no longer be linked to an individual.

Vidya Darpana is intended for use by enrolled students and faculty within registered educational institutions. Students are enrolled and managed through their institution's administration — we do not collect information from minors directly outside of institutional control.

Institutions using Vidya Darpana for students under the age of 13 (or the applicable age of digital consent in their jurisdiction) are responsible for obtaining appropriate parental or guardian consent as required by local law.

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please reach out using the details below. We are committed to responding within 30 days.