Privacy Policy

Effective date: 3 October 2026 · Last updated: 3 October 2026

This Privacy Policy explains how Akasuya Pvt. Limited (“Akasuya”, “we”, “us”) collects, uses, shares and protects personal data when you use Pipality, our school management platform, including the Pipality website, the school administration dashboard, school websites hosted on Pipality, and the Pipality mobile apps for students, parents, teachers and staff (together, the “Services”).

We have written this policy to meet the requirements of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under it, and other laws that apply to us.

1. Who is responsible for your data

Pipality is used by schools to run their operations. Our role depends on whose data it is:

• School records (students, parents/guardians, teachers and staff). The school that uses Pipality decides what data it collects about its students, families and staff and why. For this data, the school is the Data Fiduciary and Akasuya acts as its Data Processor, processing data only on the school’s instructions and under our agreement with the school. Questions about these records, including requests to access or correct them, should first go to your school.
• Account and business data. For data about schools that sign up or enquire (for example the school administrator’s name, email and phone number, billing details and support conversations) and for visitors to the Pipality website, Akasuya is the Data Fiduciary.

2. Personal data we process

2.1 Data you or your school give us

• School registration and account data: school name, address, email, phone number, tagline, logo, and the name, email and mobile number of the school administrator, plus any additional registration fields your school chooses to fill in.
• Student and guardian records: name, admission number, roll number, class and section, date of birth, gender, photograph, address, guardian name, relationship, email and mobile number, and any custom fields the school configures (which may include details such as blood group).
• Academic records: attendance, timetables, lessons, assignments and submissions, online and offline exam marks, results, report cards, certificates, ID cards, diary entries and promotion history.
• Fee and payment records: fee structures, instalments, payments made, receipts and outstanding dues. Card and bank details are entered directly with our payment partners; Pipality does not store full card numbers or CVV codes.
• Staff and teacher records: name, contact details, qualifications, photograph, role, subjects and classes assigned, leave requests, salary structure, allowances, deductions and payroll slips.
• Communications: announcements, notifications, in-app chat messages between staff, students and parents, and the files attached to them.
• Enquiries: the name, email and message you send through our contact form, and online admission applications sent to schools.

2.2 Data collected automatically

• Log and device data: IP address, browser and device type, operating system, pages visited, date and time of access, and error logs, used for security and to keep the Services running.
• Mobile app data: a device notification token (so we can deliver push notifications) and basic app diagnostics.
• Cookies and local storage: see section 9.

3. Why we use personal data

• To provide the Services: running each school’s dashboard, apps and website, and the features the school has subscribed to.
• To create and secure accounts, including login, password reset and two-factor authentication.
• To process subscription payments and fee payments, and to issue bills and receipts.
• To send service messages such as login credentials, password resets, billing reminders, plan-expiry warnings and notifications the school sends to its users.
• To respond to enquiries and provide customer support.
• To keep the Services secure, detect and prevent fraud and abuse, and fix problems.
• To meet legal, tax and accounting obligations.

We process school records only to provide the Services to the school. We do not sell personal data, we do not use student data for advertising, and we do not build marketing profiles of students.

4. Legal basis and consent

Where Akasuya is the Data Fiduciary, we process personal data on the basis of your consent, or for legitimate uses permitted by the DPDP Act, such as providing a service you asked for or complying with law. You may withdraw consent at any time by writing to us (see section 12); withdrawal does not affect processing that took place before it.

Children’s data. Many Pipality users are under 18. Under the DPDP Act, schools must obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data, and must not use it for tracking, behavioural monitoring or targeted advertising. Schools are responsible for obtaining this consent for the records they create in Pipality, and Akasuya processes children’s data only to provide educational and administrative services to the school.

5. Who we share data with

We share personal data only as described below:

• Your school. Data entered by students, parents and staff is visible to authorised users at your school according to the roles and permissions the school sets.
• Service providers who process data on our behalf under contracts that require confidentiality and security, including:
  • cloud hosting and database infrastructure;
  • email delivery (for example Amazon Web Services Simple Email Service);
  • push notifications (Google Firebase Cloud Messaging);
  • spam protection on public forms (Google reCAPTCHA);
  • payment gateways such as Stripe, Razorpay, Paystack and Flutterwave, which process payments under their own privacy policies.
• Legal and safety reasons: when required by law, court order or a government authority, or to protect the rights, safety and property of users, schools or Akasuya.
• Business transfers: if Akasuya is involved in a merger, acquisition or sale of assets, subject to this policy continuing to protect your data.

6. How we protect data

• Separate database per school: each school’s operational data is stored in its own database, separate from other schools.
• Role-based access control: schools decide which staff can see or change which records.
• Account security: passwords are stored only as one-way hashes, and two-factor authentication is available.
• Encryption in transit: the Services are delivered over encrypted HTTPS connections.
• Backups: data is backed up so it can be recovered.
• Restricted staff access: Akasuya personnel can access school data only when needed to provide support or keep the Services running, and are bound by confidentiality.

No system is completely secure. If a personal data breach occurs, we will notify the affected school(s), the Data Protection Board of India and affected individuals as required by the DPDP Act and applicable rules.

7. How long we keep data

We keep school records for as long as the school’s subscription is active and for as long as the school instructs us. After a school’s account is closed, we keep its data for up to 90 days so the school can request an export, and then delete or anonymise it, unless the law requires us to keep it longer (for example invoices and tax records). Website enquiry data is kept for up to 24 months.

8. Your rights

Subject to the DPDP Act and other applicable law, you have the right to:

• obtain a summary of the personal data we process about you and how we process it;
• have inaccurate or incomplete data corrected and updated;
• have data erased when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• withdraw consent;
• nominate another person to exercise your rights if you die or become incapacitated;
• have your grievances addressed.

If your request concerns records held by your school, please contact your school first; we will help the school respond. For anything else, write to us at the address in section 12. We will respond within the time limits set by law.

9. Cookies and local storage

We use strictly necessary cookies to keep you signed in, protect forms against cross-site request forgery, and remember your language. We also use your browser’s local storage for interface preferences such as light or dark theme and sidebar layout. We do not use third-party advertising cookies. reCAPTCHA, when enabled on a form, may set its own cookies to tell humans from bots.

10. Where data is stored

Data is stored on servers operated by our hosting providers. If data is processed outside India, we will do so only where such transfer is allowed under the DPDP Act and with safeguards in place.

11. Changes to this policy

We may update this policy as the Services or the law change. We will post the updated version on this page with a new “Last updated” date and, for material changes, notify school administrators by email or in the dashboard.

12. Contact and Grievance Officer

For privacy questions, to exercise your rights, or to raise a grievance, contact our Grievance Officer:

Grievance Officer – Pipality
Akasuya Pvt. Limited
Email: hello@pipality.com

We will acknowledge grievances within 72 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.