Draft — pending legal review
Privacy policy
Who we are, and who your school is
NeevOs is a school operating system used by schools in India to run attendance, homework, fees, results, transport and communication. Under the Digital Personal Data Protection Act 2023 (DPDP), your school is the data fiduciary for the records it keeps about staff, parents and children. NeevOs processes that data on the school’s instructions. Questions about a specific record go to your school office first; questions about NeevOs itself go to hello@neevos.ai.
What is collected
- Account details: name, email address, mobile number, role (school admin, teacher, parent, student), and a password we store only as a hash.
- Student records entered by the school: name, class and roll number, date of birth, guardian contact, attendance, homework, marks and results, fee invoices and receipts, transport route, and — where the school has recorded guardian consent — caste category, religion, medical notes and Aadhaar number. Those four are encrypted at rest with AES-256-GCM and shown only to the roles listed below.
- Things you upload: photos and files attached to homework, library notes and the school feed; a student photo; the school’s logo.
- Messages and posts you send through the app.
- Sign-in records: the time, IP address and browser or app version of each sign-in attempt, kept to detect abuse.
- From the Android app: a push-notification device token and the app version, so notifications can reach your phone. No location, contacts or other device data.
- Audit trail: who did what, when, inside the school’s account — required for the school’s own accountability under DPDP.
Why
To run the school’s day: mark and report attendance, set and collect homework, raise and record fees, publish results, run buses, and tell parents and staff what they need to know. Push notifications are sent only for events that already appear in your in-app notifications.
Who can see what
- School admins see the school’s records, including the encrypted sensitive fields, each reveal of an Aadhaar number being audit-logged.
- Teachers see the children in the classes they teach. Only a child’s class teacher sees their medical notes.
- Parents see their own children. Students see their own record.
- NeevOs support staff can open a school’s account only through a logged support session that the school can see in its audit trail.
Third parties
- Google Firebase Cloud Messaging delivers push notifications to the Android app. It receives the device token, the notification title and text, and the in-app path the notification opens. No student record leaves NeevOs for this.
- Anthropic powers the AI tools (worksheets, lesson plans). Only the text a teacher types into those tools is sent; student records are not.
- A WhatsApp or SMS provider may be added for school messages in future; when it is, this page will name it and the school will be told first.
- NeevOs does not sell data and does not use it for advertising.
Children’s data
Records about children are entered by the school on the strength of the guardian’s consent, which the school records with a date and notice version. Sensitive fields cannot be saved without an active consent record. NeevOs is used by children only through accounts their school creates.
Retention
Records deleted inside the app are held for 30 days in a trash the school can restore from, then removed permanently. Backups are encrypted and kept for 14 days. Sign-in records and the audit trail are kept for at least a year, as an accountability record.
Your rights, and deleting your account
Under DPDP you may ask to see, correct or erase personal data about you or your child, and to withdraw consent. Because the school is the fiduciary, requests are decided by the school: ask your school office, or use Delete my account inside the app, which closes your login at once and sends the request to the school. The school retains the records it is required to keep (attendance, marks, fee receipts) even after a login is removed. The process is described at /delete-account on the app.
Security
Passwords are hashed, sensitive fields are encrypted at rest, backups are encrypted, and sign-in is rate-limited. HTTPS is applied to every deployment that serves a school.
Contact
hello@neevos.ai. This page will name a grievance officer once one is appointed, as DPDP requires.