Privacy Policy

Last updated: 1 November 2026

This policy explains how YURschool collects, uses, shares and protects personal data when schools, their staff, parents, guardians and students use YurSchool, our school management platform at yurschool.in and on each school's own address (school-name.yurschool.in). It also explains the choices and rights you have.

1. Who we are

2. Our role and the school's role

A school that uses YurSchool decides what it records about its students, parents, guardians and staff, and why. For those school records the school is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023, and YURschool processes the data on the school's behalf and on its instructions.

YURschool is the Data Fiduciary for the data we need to run the service ourselves: the accounts of people who sign up a school or contact us, security records, and the billing records between YURschool and the school.

If you are a parent, guardian, student or member of staff, your school is usually the right place to start with questions about your records. We help the school answer them, and you can always write to our Grievance Officer.

3. What we collect

Accounts and sign-in

• Name, mobile number, email address, the school you belong to and your role there.
• Your password, stored only as an Argon2id hash, and one-time codes used to confirm a sign-in or a sensitive change.
• Sign-in and security records, such as when you signed in and which security-relevant actions were taken on your account.

School records the school enters

• Student profiles, admissions, enrolment, class and section.
• Attendance, including times recorded by the school's biometric attendance devices. We receive only the device's user number, the name typed on the device and the time of each punch. Fingerprint and face templates, card numbers and device passwords are never read or stored by YurSchool.
• Timetables, homework, assessments and results.
• Fees, bills and receipts. When a parent pays a school by UPI and reports it, we store the amount and the UPI reference number. Payments go straight to the school's own bank account; we do not receive card or bank login details.
• Notices and messages the school sends, the people they were sent to, and their delivery status.
• Other records a school keeps in the modules it uses, such as wellbeing and safeguarding notes, transport, library, visitors, and documents or photos the school uploads.

Technical data

• The information your browser sends with each request (such as its type and your network address), used to deliver pages, keep the service secure and limit abuse.

4. How we use it

• To provide YurSchool to the school: keeping its records, showing each person what their role allows, and sending the notices and messages the school asks us to send.
• To secure the service: checking sign-ins, keeping an audit trail of changes, and detecting and stopping misuse.
• To support schools and answer questions and complaints.
• To meet our legal obligations.

We do not sell personal data. We do not use it for advertising, and we do not build profiles of students, parents or staff for marketing.

5. WhatsApp messages and data from Meta

Schools can send notices to parents and staff on WhatsApp through YurSchool. We use the WhatsApp Business Platform provided by Meta Platforms, Inc. and its affiliates ("Meta").

• What we send to Meta: the recipient's mobile number, the school's name and the text of the notice, so that WhatsApp can deliver it. Meta handles this data under its own terms and privacy policy.
• What we receive from Meta: a message ID and delivery updates (sent, delivered, read or failed), which we show to the school. Replies sent to the school's WhatsApp number are not stored by YurSchool at present.
• When a school connects its own WhatsApp Business Account through Meta's sign-up flow, Meta shares with us the IDs of the business portfolio, WhatsApp Business Account and phone number the school chose, and an access token that lets us send messages and manage message templates for that school. We use these only to provide messaging for that school. We stop using them when the school disconnects, and we delete them as described in our data deletion instructions.

We use data we receive from Meta only to provide WhatsApp messaging to the school it belongs to. We do not sell it, use it for advertising, or share it with anyone except as this policy describes.

Schools must send WhatsApp messages only to people who have agreed to receive them from the school. Anyone who does not want WhatsApp messages from their school can ask the school to stop them.

6. Who we share data with

• The school and the people it authorises, according to their roles.
• Meta (WhatsApp), to deliver the WhatsApp messages a school sends, as described above.
• Cloudflare, which carries traffic to our servers and protects them from attacks. Traffic passes through Cloudflare's network, which may be outside India.
• Authorities, when Indian law requires us to disclose data, and only what is required.

We do not share personal data with anyone else.

7. Children's data

Many students are under 18. Their records are created by their school, which is responsible for obtaining the consent of a parent or lawful guardian where the law requires it. YurSchool does not use children's data for tracking, behavioural monitoring or targeted advertising, and parents and guardians see only the records of their own children.

8. Where data is stored and how we protect it

School records are stored on servers that YURschool operates in India. We protect them by:

• encrypting traffic between your browser and YurSchool (HTTPS);
• keeping each school's data separate from every other school's at the database level;
• giving each person access only to what their role in the school allows;
• storing passwords only as Argon2id hashes;
• keeping an audit trail of important changes.

If a personal data breach happens, we will inform the affected school and, where the law requires, the Data Protection Board of India and the people affected.

9. How long we keep data

We keep a school's records for as long as the school uses YurSchool, or as the school instructs us. When a school stops using YurSchool, we delete its data or hand it back to the school on its instructions. Records that the law requires the school or us to keep, such as fee receipts, are kept only as long as the law requires. Copies of deleted data in our backups are removed when those backups are deleted.

10. Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• ask what personal data is held about you and how it is used;
• ask for it to be corrected, completed or updated;
• ask for it to be erased, where it is no longer needed or you withdraw consent;
• withdraw consent you have given;
• nominate someone to exercise these rights for you if you die or become unable to;
• complain to our Grievance Officer, and, if you are not satisfied with the answer, to the Data Protection Board of India.

For school records, send your request to your school first; we act on the school's instructions. You can also write to our Grievance Officer at [email protected]. We reply within a day. Our data deletion instructions explain how to ask us to delete data.

11. Cookies and browser storage

YurSchool sets one cookie that is needed to keep you signed in. Your browser also keeps some settings and unfinished work on your own device, such as light or dark mode and drafts on some pages. We use no advertising or third-party analytics cookies.

12. Changes to this policy

When we change this policy we update the date at the top of this page. If a change affects how a school's data is used, we tell the school before it takes effect.

13. Contact