Privacy Policy

1. Overview & Scope

This Privacy Policy describes how Gendemy (“we”, “us”, or “our”) collects, uses, processes, stores, and protects personal information when you access our SaaS platform, mobile application (available on the Google Play Store and web), and related services (collectively, the “Services”).

We are committed to maintaining the highest standards of data integrity and transparency in compliance with the Google Play Developer Program Policies (User Data & Data Safety), the Indian Digital Personal Data Protection Act (DPDP Act 2023), and international data protection standards.

2. Controller vs. Processor Roles

Depending on your relationship with Gendemy, our data processing responsibilities vary:

3. Information We Collect

We only collect data strictly necessary to provide academy and institute operational services:

• Identity & Contact Data: Full name, verified mobile phone number, email address, profile picture (optional), role designation (Institute Admin, Faculty, Student), and branch assignment.
• Academic & Operational Records: Batch enrollment, course curriculum details, daily class schedules, attendance logs, homework/event records, performance evaluations, and skill ratings.
• Financial & Fee Transaction Data: Student fee plan details, due dates, offline receipts, and digital payment records. Digital payments are processed through PCI-DSS Level 1 certified payment gateways (e.g., Razorpay). We never store raw credit card numbers, debit card numbers, or bank account PINs on our servers.
• Technical Device Information: Device model, OS version, IP address, and unique app instance identifiers used solely for session management, push notification routing, and crash debugging.

4. Mobile Device Permissions (Google Play Compliance)

Our Android mobile application requests the following runtime device permissions. Each permission is requested strictly in context and only with explicit user action:

5. How We Use Information

We process personal data for legitimate and specified educational SaaS purposes:

• Authenticating user sessions and enforcing multi-tier role-based access control (Admin, Faculty, Student).
• Generating digital attendance logs and calculating monthly attendance percentages.
• Managing fee structures, creating GST-compliant tax invoices, and facilitating direct payment settlements to institute merchant accounts.
• Sending timetable alerts, class reschedule notifications, and broadcast announcements.
• Maintaining system uptime, preventing fraudulent activity, and complying with statutory tax obligations under Indian law.

Note: We never sell, rent, or trade your personal data to third-party advertisers or data brokers.

6. Data Sharing & Third-Party Sub-processors

We only share data with vetted service providers who are bound by strict data processing agreements and security requirements:

• Cloud Infrastructure: Cloudflare (Edge CDN, SSL encryption, DDoS mitigation), high-security cloud hosting facilities.
• Database & Cache Services: Encrypted PostgreSQL storage and Redis cache for session token verification.
• Payment Processing: Razorpay (RBI-authorized, PCI-DSS Level 1 compliant payment aggregator).
• Push Notifications: Expo Notification Infrastructure / Google Firebase Cloud Messaging (FCM).
• Legal Authorities: Disclosed only if strictly required by a court order, law enforcement subpoena, or statutory Indian regulation.

7. Data Security & Encryption

We implement enterprise-grade security controls to safeguard your data:

• Encryption in Transit: 100% of data transmitted between mobile devices, web browsers, and our API servers is encrypted using modern TLS 1.3 / HTTPS protocols.
• Encryption at Rest: Database volumes and automated backup snapshots are encrypted using AES-256 standards.
• On-Device Credential Security: Mobile session tokens are stored in hardware-backed secure storage (Android Keystore via Expo SecureStore).
• Access Segregation: Strict multi-tenant isolation ensures one institute can never read, modify, or leak data belonging to another institute.

8. Data Retention & Account Deletion

We retain personal data only for as long as an active institute subscription is maintained, or as required by applicable tax and accounting laws in India (e.g., maintaining fee invoice records for statutory audit cycles).

In full compliance with Google Play Console Account Deletion requirements, users can request full deletion of their account and associated personal data at any time:

9. Your Rights & Choices

Under the DPDP Act 2023 and applicable privacy frameworks, you have the right to:

• Access and review a summary of your personal data processed by the platform.
• Request correction or updating of inaccurate personal information.
• Withdraw consent for optional processing (e.g. promotional emails or push notifications).
• Request erasure of your personal data when no longer required for academic records or legal compliance.

10. Children's Privacy

Where students enrolled in an institute are minors (under 18 years old), their account is created and administered either directly by the educational institute or with verifiable parental/guardian oversight. We do not knowingly collect personal information from children for direct marketing, behavioral profiling, or advertising purposes.

11. Grievance Officer & Contact

If you have questions, concerns, or grievances regarding this Privacy Policy or our data handling practices, please contact our designated Grievance Officer: