Data Protection & Compliance

Last updated: 3 October 2026

Schools trust Pipality with some of the most sensitive data there is: information about children. This page explains how Akasuya Pvt. Limited designs, runs and governs Pipality to protect that data, and how we help schools meet their own legal obligations. It should be read with our Privacy Policy and Terms of Service.

1. Legal framework

Pipality is operated from India and is designed to support compliance with:

• the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it;
• the Information Technology Act, 2000, including the reasonable security practices rules and the intermediary guidelines;
• applicable tax and record-keeping laws for billing.

Schools outside India remain responsible for meeting any local laws that apply to them, and may contact us to discuss their requirements.

2. Roles and responsibilities

As a Data Processor, Akasuya processes school records only to provide the Services, follows the school’s documented instructions, and does not use the data for its own purposes.

3. Children’s data

• Schools obtain verifiable parental or guardian consent for the children’s data they record in Pipality, as required by the DPDP Act.
• Akasuya does not track children for advertising, does not engage in behavioural monitoring of children, and does not show advertising in the student and parent apps.
• Student accounts are created and controlled by the school. Parents can see their own child’s information through the parent login.

4. Security measures

• Tenant isolation: each school’s operational data lives in a separate database.
• Access control: granular roles and permissions let each school limit who can view or change data, down to individual modules.
• Authentication: passwords are stored only as salted one-way hashes, and two-factor authentication is available for dashboard users.
• Encryption in transit: all traffic to the Services uses HTTPS/TLS.
• Backups and recovery: databases are backed up regularly, and schools can create their own database backups from the dashboard.
• Payment security: card payments are handled by PCI-DSS compliant payment gateways; Pipality never stores full card numbers or CVV codes.
• Form protection: public forms can be protected with reCAPTCHA and every form is protected against cross-site request forgery.
• Personnel: Akasuya staff access school data only when needed for support or operations and are bound by confidentiality obligations.

5. Sub-processors

We use carefully chosen providers to deliver the Services:

We will update this list when we change sub-processors.

6. Data subject rights

Pipality gives schools the tools to respond to requests from students, parents and staff: records can be viewed, corrected, exported and deleted from the dashboard. When Akasuya receives a request about a school’s records, we pass it to the school and help it respond.

7. Retention and deletion

School data is kept for the life of the subscription. After an account is closed, the school can request an export for up to 90 days, after which the data is deleted or anonymised, except where law requires us to keep certain records (such as invoices).

8. Breach notification

If we become aware of a personal data breach affecting a school’s data, we will inform the school without undue delay with the information it needs, and notify the Data Protection Board of India and affected individuals as required by law.

9. Contact the Grievance Officer

For data protection questions, a data processing agreement, or to report a security concern, contact:

Grievance Officer – Pipality
Akasuya Pvt. Limited
Email: hello@pipality.com