StackERP Solutions Private Limited

Privacy Policy

School ERP Software · Web Dashboard · Cloud ERP Platform
Admin · Teacher · Student · Parent · Accountant · Admission Modules

1. Introduction and Company Information

This Privacy Policy ("Policy") is published and maintained by StackERP Solutions Private Limited, a company incorporated under the Companies Act, 2013, bearing Corporate Identification Number (CIN) U62013RJ2026PTC115794, having its registered office at E-409, IV Floor, Avni Homes, Khasra No. 356, Vatika, Sanganer, Jaipur, Rajasthan, India.

StackERP operates a cloud-based School Enterprise Resource Planning (ERP) platform, accessible via the website https://www.stackerpsolutions.com, associated web dashboards, and dedicated mobile applications for Administrators, Teachers, and Students/Parents (collectively, the "Platform" or "Services"). The Services enable schools, trusts, and educational institutions ("Institution", "School", or "Client") to digitize and manage academics, attendance, communication, fee and finance management, admissions, transport, hostel operations, examinations, homework, AI-assisted academic tools, and related administrative functions.

This Policy explains, in plain and professional language, what personal information StackERP collects, how and why it is collected, how it is used, stored, secured, shared, and retained, and the rights available to individuals whose personal data is processed through the Platform. This Policy is framed with due regard to the Information Technology Act, 2000 and rules made thereunder (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), together with such rules as may be notified thereunder from time to time.

By accessing or using the Platform — whether as a School, Administrator, Teacher, Accountant, Student, or Parent/Guardian — you acknowledge that you have read and understood this Policy. Where the Platform is used by or on behalf of a School, the School's own institutional privacy notices and its agreement with StackERP (including any Data Processing Agreement, "DPA") shall operate alongside this Policy, and in the event of any conflict solely as between StackERP and the School regarding the processing of Student, Parent, or Teacher data, the terms of the applicable DPA shall prevail.

This Policy does not apply to any third-party website, application, or service that may be linked to or integrated with the Platform, except to the extent expressly stated in Section 10 (Third-Party Service Providers and Data Sharing) below.

2. Definitions

For the purposes of this Policy, unless the context otherwise requires:

• "Administrator" or "Admin" means a School official granted administrative access to the Admin Panel and Admin Mobile App to configure, operate, and manage the Institution's use of the Platform.
• "Consent" means the free, specific, informed, unconditional, and unambiguous indication of agreement, by clear affirmative action, signifying agreement to the processing of personal data, as contemplated under the DPDP Act.
• "Data Fiduciary" means the entity that, alone or in conjunction with others, determines the purpose and means of processing personal data. The School is ordinarily the Data Fiduciary in respect of Student, Parent, and Teacher personal data, and StackERP acts as the School's Data Processor for such data. StackERP is itself the Data Fiduciary in respect of data it collects directly, such as School/institutional account data, billing contacts, and website visitor data.
• "Data Principal" means the individual to whom the personal data relates, and where such individual is a child, includes the parent or lawful guardian of such child.
• "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.
• "Personal Data" or "Personal Information" means any data about an individual who is identifiable by or in relation to such data.
• "Platform" means, collectively, the StackERP website, web-based ERP dashboards (Admin Panel, Teacher Panel, Student Panel, Parent Portal, Accountant Panel, Admission Panel), and the Admin Mobile App, Teacher Mobile App, and Student Mobile App (which also serves Parents through independent parent login credentials).
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Sensitive Personal Data" includes, without limitation, financial information, health information disclosed for hostel, transport, or medical-emergency purposes, biometric information (where enabled under the Enterprise Plan), and any other category recognised as sensitive under applicable Indian law.
• "Services" has the meaning given in Section 1 above.
• "User" means any individual who accesses or uses the Platform, including Administrators, Teachers, Accountants, Students, and Parents/Guardians.

3. Scope of this Policy

This Policy applies to all personal data processed by StackERP in connection with the Platform, whether collected directly through the website or mobile applications, entered into the ERP by a School or its Administrators/Teachers, or generated automatically through use of the Platform (such as device and log data). This Policy applies uniformly across StackERP's Basic, Standard, Professional, and Enterprise subscription plans, save that certain modules described in this Policy (for example, biometric, GPS, RFID integrations, WhatsApp/SMS communication modules, or a dedicated Parent App) are available only on specific plans or as optional add-ons, and the corresponding processing activities described herein will only be relevant to an Institution to the extent it has activated such modules.

4. Information We Collect

StackERP collects personal data from multiple categories of individuals, in connection with the operation of the Platform. The categories set out below are illustrative of the fields typically configured within the Platform's modules; the precise fields collected for a given Institution depend on the modules and plan activated by that Institution.

4.1 Personal Information Generally

Name, gender, date of birth, contact number, email address, residential address, photograph, government-issued identification numbers (such as Aadhaar, where voluntarily provided by a School for admission or verification records), and login credentials (username and encrypted password) associated with a User's account on the Platform.

4.2 School / Institutional Information

School or trust name, registered address, affiliation/board details, official contact persons, institutional email domains, billing and subscription information, GSTIN and other statutory registration details of the Institution, bank account or payment details used for invoicing, and configuration data such as academic sessions, class/section structures, and fee heads created by the Institution within the Admin Panel.

4.3 Student Information

Full name, date of birth, gender, class/section, roll number, admission number, photograph, parent/guardian names and contact details, residential address, blood group and medical information (where voluntarily entered for hostel or emergency purposes), attendance records, academic performance, examination results, homework and assignment submissions, disciplinary and leave records, library borrowing history, transport route and pickup details, hostel room allocation and mess/complaint records, fee payment history, and any documents uploaded to the Student Panel.

4.4 Parent / Guardian Information

Name, relationship to the Student, contact number, email address, residential address, occupation (where requested by a School for admission records), parent login credentials for the Student/Parent App, communication preferences, and fee payment and transaction records associated with the Parent's account.

4.5 Teacher / Staff Information

Name, contact details, photograph, employee/staff ID, subject and class assignments, qualifications, attendance and leave records, timetable and schedule data, salary and remuneration details (Professional and Enterprise Plans), digital ID card data, and materials, assignments, question banks, or exam content uploaded by the Teacher.

4.6 Administrator Information

Name, designation, contact details, login credentials, and activity logs associated with administrative actions performed on the Platform, which are retained for audit and security purposes.

4.7 Device and Technical Information

IP address, browser type and version, device type, operating system, unique device identifiers, mobile network information, and general location information (such as city-level location inferred from IP address), collected automatically when the Platform is accessed.

4.8 Cookies and Tracking Technologies

StackERP and its service providers use cookies, local storage, and similar tracking technologies on the website and web dashboards to enable core functionality, remember preferences, and understand usage patterns. Further detail is provided in Section 17 (Cookies Policy) below.

4.9 Analytics Data

Aggregated and, where necessary, individual-level usage data — such as pages/screens visited, features used, session duration, click patterns, and crash/error reports — collected through analytics tools (including Google Analytics and Firebase Analytics, where enabled) to help StackERP understand and improve the Platform.

4.10 Log Files

Server and application log files recording access timestamps, IP addresses, requests made to the Platform, error codes, and referring/exit pages, retained for security monitoring, troubleshooting, and audit purposes.

5. Purpose of Collection and Use of Information

StackERP collects and processes personal data for the following purposes:

• To create and manage User accounts and provide role-based access to the Admin Panel, Teacher Panel, Student Panel, Parent Portal, and Accountant Panel;
• To operate core ERP functions, including attendance tracking, timetable management, examinations, homework and assignment management, marks entry and result publication;
• To process admissions, including enquiry management, admission approval workflows, and admission-related communication;
• To manage fee collection, generate invoices and receipts, process online payments, track dues, and generate financial and fee reports for the Institution;
• To operate the Hostel Module and Transport Module where activated by an Institution;
• To send academic, administrative, and transactional communications via SMS, WhatsApp, email, and in-app/push notifications, where such communication modules are enabled by the Institution;
• To operate AI-assisted features, as further described in Section 18 (AI Features and Automated Processing);
• To provide customer support, respond to queries, and carry out onboarding, training, and data migration services requested by an Institution;
• To maintain the security, integrity, and proper functioning of the Platform, including fraud prevention, access control, and audit logging;
• To comply with applicable law, respond to lawful requests from public authorities, and enforce StackERP's agreements with Institutions; and
• To improve and develop the Platform, including through aggregated and de-identified analytics.

StackERP does not use Student, Parent, or Teacher personal data processed on behalf of a School for StackERP's own independent marketing purposes, and does not sell such personal data to third parties.

6. Legal Basis for Processing

Where the DPDP Act applies, StackERP and the relevant Institution rely on the following legal bases for processing personal data through the Platform:

• Consent: Where an Institution or, in respect of a child, a parent/lawful guardian, has provided consent for the collection and processing of personal data for specified purposes, consistent with the notice-and-consent framework under the DPDP Act;
• Performance of a contract: Processing that is necessary to perform StackERP's contract with the Institution for the provision of the Platform;
• Legitimate use: Certain limited processing (such as security logging and fraud prevention) may be carried out on the basis of legitimate uses recognised under the DPDP Act; and
• Compliance with law: Processing necessary to comply with a legal obligation, including obligations relating to education, taxation, and financial record-keeping applicable to Institutions.

Withdrawal of Consent

Where processing is based on consent under the Digital Personal Data Protection Act, 2023, Data Principals may withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal. Certain services may become unavailable where consent is withdrawn.

As between StackERP and an Institution, the Institution is responsible for obtaining and maintaining valid consent from Students, Parents, and Teachers (or, in the case of children, verifiable consent from parents/guardians) prior to entering their personal data into the Platform, and for providing appropriate notice regarding such processing, as further detailed in the applicable DPA between StackERP and the Institution.

7. Children's Privacy

StackERP recognises that a significant proportion of personal data processed through the Platform relates to children, being Students enrolled with an Institution. StackERP takes the following approach to children's privacy, consistent with the heightened obligations applicable to processing of children's personal data under the DPDP Act:

• StackERP does not knowingly permit any User to create a Student or Parent account directly on the Platform independent of, or without the involvement of, the enrolling School. Student and Parent accounts are created and issued by the Institution, based on the Institution's own admission and consent processes with parents/guardians.
• StackERP does not undertake behavioural monitoring or targeted advertising directed at children through the Platform.
• Communication features directed at or visible to Students are limited to academic and administrative purposes configured by the Institution, and are not used by StackERP to send unsolicited marketing content to children.
• Where an Institution enables AI-assisted features that process Student data, such processing is limited to the academic purpose configured by the Institution and is not used to build independent behavioural or advertising profiles of the child.
• Parents/Guardians may contact their child's School, or StackERP directly, to raise questions regarding their child's personal data on the Platform. Because Student data is entered and controlled by the School as Data Fiduciary, requests concerning correction, access, or deletion of a Student's data should ordinarily be routed through the School in the first instance; StackERP will provide reasonable operational assistance to the School in fulfilling such requests.

8. School Data Ownership

StackERP expressly acknowledges that all data entered into the Platform by or on behalf of an Institution remains the property of that Institution. StackERP does not claim ownership over any Institutional data processed through the Platform. StackERP's role in respect of such data is that of a service provider and Data Processor, processing the data strictly on the documented instructions of the Institution and for the purpose of providing the Services.

Upon termination or expiry of an Institution's subscription, StackERP shall, subject to the terms of the applicable agreement, make Institutional data available for export by the Institution for a reasonable transition period, after which such data shall be deleted or anonymised in accordance with Section 13 (Data Deletion) below, save where retention is required by applicable law.

9. Relationship Between StackERP and Schools (Data Fiduciary and Data Processor)

• The Institution acts as the Data Fiduciary in respect of Student, Parent, and Teacher personal data entered into or processed through the Platform.
• StackERP acts as the Data Processor in respect of such data, processing it only on the documented instructions of the Institution, for the purpose of providing the Services.
• StackERP acts as Data Fiduciary in its own right in respect of: (i) account and billing data of Institutions and their authorised representatives; (ii) website visitor and prospective-customer data collected via the public website; and (iii) data generated in connection with StackERP's own security, support, and platform-improvement activities.

10. Data Security

StackERP performs periodic backups to support disaster recovery and business continuity. Backup retention periods may vary depending on the customer's subscription plan and technical architecture. StackERP implements administrative, technical, and organisational security measures designed to protect personal data processed through the Platform against unauthorised access, alteration, disclosure, or destruction.

Encryption

Personal data transmitted between User devices and StackERP's servers is protected using industry-standard transport encryption protocols (such as TLS/HTTPS). Passwords are stored using one-way cryptographic hashing and are not stored or transmitted in plain text. Sensitive fields are handled in conjunction with PCI-DSS compliant payment gateway partners rather than stored directly on StackERP's servers wherever technically feasible.

Cloud Storage and Hosting

The Platform and associated databases are hosted on reputable third-party cloud infrastructure providers. StackERP configures logical access controls, network firewalls, and role-based access restrictions to limit access to Institutional data to authorised personnel on a need-to-know basis. Enterprise Plan clients may be offered dedicated server/hosting arrangements as described in their commercial agreement.

Access Controls and Internal Safeguards

Access to production systems and databases is restricted to authorised StackERP personnel involved in the operation, maintenance, and support of the Platform. Administrative actions performed on the Platform are logged for audit purposes. StackERP conducts periodic reviews of its access control and security practices as part of its ordinary course of business.

No method of electronic transmission or storage is completely secure, and while StackERP takes reasonable and appropriate measures to protect personal data in line with the requirements of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, StackERP cannot guarantee absolute security of information transmitted to or stored on the Platform.

11. Third-Party Service Providers and Data Sharing

StackERP engages certain third-party service providers to operate specific features of the Platform. These providers process personal data solely to the extent necessary to perform the relevant function, under contractual confidentiality and data-protection obligations consistent with this Policy.

• Payment Gateway Providers: Where an Institution enables online fee payment, fee transactions are processed through third-party payment gateway partners, including Razorpay and UPI-based payment rails. StackERP does not store full card numbers or UPI PINs on its own servers.
• Google Services: StackERP may use Google services (such as Google Cloud infrastructure, Google Analytics, and Google Maps for transport/bus-tracking features, where enabled) in connection with the Platform.
• Firebase: Where enabled, StackERP uses Firebase for mobile application services such as push notifications, crash reporting, and app analytics.
• SMS Providers: Where an Institution enables SMS notifications, StackERP transmits the relevant mobile numbers and message content to licensed SMS gateway/aggregator providers registered under applicable TRAI regulations.
• WhatsApp Business API Providers: Where an Institution enables WhatsApp-based communication, StackERP transmits relevant contact numbers and message content through WhatsApp Business API infrastructure.
• Email Service Providers: Transactional and administrative emails are delivered through third-party email delivery/relay service providers.
• Cloud Hosting Providers: The Platform's infrastructure is hosted with established cloud infrastructure providers, which may maintain data centres within or outside India, as further described in Section 16 (International Data Transfers).

StackERP does not permit any of the above service providers to use personal data processed through the Platform for their own independent marketing purposes, and requires such providers to implement appropriate security safeguards consistent with this Policy.

12. Data Sharing and Disclosure

Save as set out in Section 11 above, StackERP does not sell, rent, or trade personal data processed through the Platform. StackERP may disclose personal data in the following limited circumstances:

• To the relevant Institution's own Administrators and authorised Teachers/Staff, strictly in accordance with the role-based access configured by that Institution;
• To StackERP group entities or personnel involved in providing support, hosting, or maintenance of the Platform, under confidentiality obligations;
• Where required to comply with applicable law, a court order, or a lawful request by a government or regulatory authority in India;
• To protect the rights, property, or safety of StackERP, an Institution, Users, or the public; and
• In connection with a merger, acquisition, corporate reorganisation, or sale of business assets of StackERP, subject to the acquiring entity agreeing to honour the commitments set out in this Policy.

13. Data Retention

StackERP retains personal data processed through the Platform for as long as reasonably necessary to provide the Services to the relevant Institution and for such further period as may be required to comply with applicable legal, tax, accounting, or regulatory retention obligations.

• Active Student, Parent, and Teacher records are retained for the duration of the Institution's subscription and the individual's association with the Institution;
• Fee, invoice, and financial records are retained for the period required under applicable Indian tax and accounting law;
• Server and access log data is retained for a limited period (ordinarily not exceeding twelve (12) months) for security and audit purposes; and
• Upon termination of an Institution's subscription, data is handled as described in Section 8 (School Data Ownership) and Section 14 (Data Deletion).

14. Data Deletion

An Institution may request deletion of specific Student, Parent, or Teacher records through the Admin Panel or by written request to StackERP, subject to any retention obligations under applicable law. Upon termination or non-renewal of an Institution's subscription, StackERP will delete or irreversibly anonymise the Institution's data from its production systems within a reasonable period, save for data that StackERP is required to retain under applicable law or that persists in encrypted backup systems until the ordinary backup-cycle overwrite/deletion occurs.

15. User Rights (Rights of Data Principals)

Subject to applicable law, including the DPDP Act, individuals have the following rights in relation to their personal data processed through the Platform:

• Right to access a summary of personal data being processed;
• Right to correction and updation of inaccurate or incomplete personal data;
• Right to erasure of personal data that is no longer necessary for the purpose for which it was collected;
• Right to grievance redressal; and
• Right to nominate another individual to exercise rights under the DPDP Act in the event of the Data Principal's death or incapacity.

Requests to exercise these rights in respect of Student, Parent, or Teacher data should ordinarily be directed to the relevant Institution in the first instance. Requests relating to data for which StackERP is itself the Data Fiduciary may be directed to StackERP using the contact details in Section 22.

16. School Rights and Responsibilities

Each Institution using the Platform is responsible for: (a) obtaining and maintaining valid notice and consent from Students, Parents, and Teachers prior to entering their data into the Platform; (b) ensuring the accuracy of data entered into the Platform; (c) configuring role-based access appropriately; (d) promptly notifying StackERP of any unauthorised access to its Administrator accounts; and (e) complying with its own obligations as an educational institution under applicable Indian law.

17. International Data Transfers

The Platform's primary hosting infrastructure is intended to be located within India; however, certain third-party service providers (such as Google/Firebase services) may process or store data on servers located outside India. Where personal data is transferred outside India, StackERP takes reasonable steps to ensure that such transfers occur through service providers that maintain appropriate contractual and technical safeguards. Institutions that require data to be hosted exclusively within India may request such an arrangement, subject to availability under the applicable subscription plan.

18. Cookies Policy

The StackERP website and web-based dashboards use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: required for core functionality, such as maintaining a User's authenticated session;
• Preference cookies: used to remember display and configuration preferences;
• Analytics cookies: used to understand aggregate usage patterns, in order to improve the Platform; and
• Security cookies: used to detect and prevent fraudulent login attempts and unauthorised access.

Users may control or disable non-essential cookies through their browser settings; however, disabling strictly necessary cookies may prevent proper functioning of the Platform. StackERP does not use cookies to serve third-party behavioural advertising on the Platform.

19. AI Features and Automated Processing

Certain features of the Platform (currently made available primarily under the Enterprise Plan) involve automated analysis of academic data to generate insights, summaries, or recommendations for the Institution. In connection with such AI-assisted features:

• StackERP does not guarantee the accuracy, completeness, or suitability of AI-generated outputs. Schools and authorized users must independently verify all AI-generated reports before relying upon them for academic or administrative decisions.
• Processing is limited to the academic and administrative data already held within the Platform for the relevant Institution;
• StackERP does not use Student personal data processed through AI-assisted features to train general-purpose or cross-customer AI models without the Institution's explicit instruction;
• AI-generated outputs are provided as decision-support tools and are not intended to be the sole automated basis for any decision producing legal or similarly significant effects concerning a Student, without human review; and
• Institutions that enable AI-assisted features remain responsible for ensuring that their use of such features is consistent with the Institution's own policies and applicable law.

20. Security Incident and Breach Notification

In the event StackERP becomes aware of a breach of personal data processed through the Platform that is likely to affect Users, StackERP will: (a) take prompt steps to investigate, contain, and remediate the incident; (b) notify the affected Institution(s) without undue delay, in accordance with the DPDP Act and its rules; and (c) provide the affected Institution with such information as is reasonably necessary to enable the Institution to meet its own notification obligations.

21. Changes to this Privacy Policy

StackERP may update or revise this Policy from time to time to reflect changes in the Platform's features, legal or regulatory requirements, or StackERP's data-processing practices. The "Last Updated" date at the foot of this Policy indicates when it was last revised. Continued use of the Platform following any update to this Policy constitutes acceptance of the revised Policy.

22. Grievance Officer and Contact Information

In accordance with the Information Technology Act, 2000 and the DPDP Act, StackERP has designated the following contact point for queries, complaints, and grievances relating to this Policy:

StackERP will endeavour to acknowledge grievances promptly and to resolve them within the timelines prescribed under applicable Indian law.

23. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the rules and regulations made thereunder. Subject to the dispute resolution provisions of the applicable agreement between StackERP and an Institution, the courts at Jaipur, Rajasthan shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy. Any dispute shall first be attempted to be resolved through good-faith negotiations before initiating legal proceedings.