KVA Scholar App Privacy Policy
Last updated: 22/10/2026
This policy explains what personal data the KVA Scholar app collects, why, who can see it, how long it is kept and what you can do about it. It covers the KVA Scholar apps for Android and iOS.
1. Who we are
The KVA Scholar app is provided by Kharagpur Vision Academy ("the School", "we"), Mumbai - Kolkata Highway Sadatpur, Kharagpur 721301, West Bengal, India. The School decides how the app's personal data is used and is responsible for it (the data fiduciary under India's Digital Personal Data Protection Act, 2023).
Questions, requests and complaints: developer@kvaschool.edu.in · +91 9679792085.
2. Who uses the app
- Students and their parents or guardians. The School creates every student account from its admission records; nobody can sign up in the app. A family may keep up to five of its children on one phone and switch between them.
- School staff: administrators, teachers, the school office, reception, security and the accounts office. The School creates their accounts.
- Visitors who book a visit to the school. They don't create an account. The app gives them a temporary, anonymous sign-in that only lets them book and follow their own visits.
3. What we collect, and where it comes from
From the School's records
- The student's name, student ID, class, section and stream, date of joining, and date of birth. The date of birth is used only to check a student's first sign-in. The server keeps only a one-way fingerprint of it, never the date itself, for that check.
- Parents' or guardians' names, phone number and email address.
- Fee records and receipts, read from the School's records when you open them (see section 4).
When you use the app
- Sign-in: your student ID or staff email and your password. Passwords are handled by Google Firebase Authentication; the School never sees them.
- School life:
- notices and their attachments;
- comments and likes;
- attendance marked by teachers;
- the notifications sent to you.
- The gate, for the school's safety:
- Visit bookings: the visitor's name and phone number, whom they will meet, the purpose, the times, and check-in and check-out.
- Early-leave passes: who collects the child, their relation and phone number.
- Material passes and deliveries, with photos of the material or the bill.
- Vehicle trips: the driver's name and phone number, the odometer reading and fuel, with photos of fuel receipts.
- The accounts office (seen only by the School's owner and accountants):
- payee names, bills and bill photos;
- for the School's own bank accounts, the bank's name and the last four digits.
From your device
- Device record:
- an install number the app makes;
- the device's model, or on Android the name set in the phone's Settings (which may include a person's name);
- the operating system and app version;
- sign-in and last-active times;
- the push-notification token.
This powers notifications and the "Signed-in devices" list, where you can sign a device out.
- Several children on one phone: a secret key for each child, kept in the phone's secure storage. Our server keeps only a one-way fingerprint of it.
- App integrity checks: Google Play Integrity on Android and Apple App Attest on iOS confirm that requests come from the genuine app.
- Camera and photos, only when you choose to use them:
- teachers attaching photos to notices;
- gate staff scanning visitor passes, and photographing materials, bills and fuel receipts;
- the accounts office photographing bills;
- anyone saving a notice's image to the phone.
You can turn these permissions off at any time in your phone's settings.
What we don't collect
- We don't collect your phone's location, contacts or microphone.
- We don't collect the advertising ID.
- The app contains no advertising or tracking software, and we don't track you across other apps or websites. The School uses no analytics or crash-reporting software of its own. Razorpay's checkout, which opens only when you choose to pay through Axis Bank (Razorpay), collects information about your device, how its screens are used, and its own crashes, for its fraud checks and service, as Razorpay's privacy policy describes.
- We don't sell personal data to anyone.
4. Fees and payments
- Fees and receipts: the app shows a student's fees and receipts from the School's records, fetched through the School's website server when you open them. To show them when you're offline, the phone keeps the last copy for each child. It deletes that copy when the child is signed out or removed from the phone.
- Paying: you pay through ICICI Bank (EazyPay) or Axis Bank (Razorpay), whichever you choose.
- Your card number, CVV, UPI PIN and net-banking password go only to the bank's own payment screen or page. They never pass through the app or the School.
- The School receives the payment's status, amount and method, and the bank's reference.
- To fill in its payment screen and its own payment confirmation, the School shares with the payment gateway the payment's reference and amount, the child's name, and the payer's phone number. Razorpay also receives the payer's name and email; ICICI Bank also receives the child's Student ID.
- Razorpay's checkout opens inside the app; ICICI Bank's page opens in your phone's browser. To offer UPI apps, Razorpay's checkout checks which UPI apps are on your phone, and it may use the phone's NFC to read a card you tap.
- The banks' own privacy policies cover what you enter on their pages.
- Notifications: you get a notification when a payment is received, confirmed or doesn't go through.
5. Why we use it
We use personal data only to run the School and the app's features:
- notices;
- attendance;
- fees, receipts and payments;
- gate, visitor and vehicle records;
- the accounts office;
- notifications;
- keeping accounts secure (sign-in checks, integrity checks, signed-in devices).
We also use it to answer your requests and to meet our legal duties. We don't use it for advertising or marketing, and we don't build profiles of children.
6. Who can see it
- Within the School, by role:
- Students and parents see their own child's records.
- Teachers and administrators can see student records, including contact details, and attendance.
- Reception can see the student list, to issue early-leave passes.
- Reception and security see visitor and gate records.
- Only the School's owner and accountants see accounts-office records.
- Other app users:
- Notices, comments and likes, and the names on them, are visible to the School's app users.
- Visitors see the names and titles of the people they can ask to meet.
- On your lock screen: notifications can show names, for example a child's first name on a shared phone, or a visitor's name to the staff member who approves the visit. You can hide notification previews in your phone's settings.
- Service providers who process data for the School under its instructions:
- Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging for notifications, Cloud Logging, and App Check with Google Play Integrity);
- Apple (App Attest, and the delivery of iOS notifications);
- Supabase, the School's records database, which the School's server reads;
- the School's website server, through which fees, receipts and payments pass (hosted by Vercel, running in Mumbai);
- the payment gateways ICICI Bank (EazyPay) and Razorpay (Axis Bank).
- When the law requires it: for example, a valid order from a court or a government authority.
7. Where it is stored
The app's database and files are stored on Google Cloud in Mumbai, India. The School's records database and its website server are also in Mumbai. Some processing happens on Google's servers outside India: delivering notifications, keeping logs, and requests from older app versions.
8. How long we keep it
| Data | How long |
|---|---|
| Notifications | 7 days |
| Notices, with their attachments and comments | Deleted automatically one year after posting. Attachments removed from a notice are deleted after 7 days |
| Visit bookings and early-leave passes | Up to about 2 months |
| Visitors' temporary sign-ins and their devices | Deleted 31 days after the sign-in was made, unless a visit is still booked |
| Vehicle trips and fuel-receipt photos | 12 months |
| Material passes, deliveries and their photos; accounts-office records; attendance | Kept as the School's records |
| A student's account | While the student is at the School. When a student leaves, sign-in is switched off at once. When the School removes the account, its profile, notifications and device records are deleted. Attendance, comments and gate records may stay as the School's records |
| Device records | Until the account is removed |
| Records of failed sign-ins and repeated requests | Kept only to limit repeated attempts; request counts go after a few hours, and sign-in records go with the account |
| The website server's log of app requests (the address, the result, the time taken, the student's record number and the app account's reference; no names or payment details) | 1 day |
| Backups | Daily, each kept 7 days |
| On your phone: fee copies, receipt files, and the keys for switching children | Until that child is signed out or removed from the phone |
9. Children
- Most of the app's users are children, from Nursery to Class 12.
- Their accounts are created by the School from its admission records. The School is responsible for getting a parent's or guardian's consent for the use of their child's data in the app, at admission. A parent can withdraw it at any time by contacting the School (section 10).
- Students can't change their personal details in the app, and comments are off for students unless the School turns them on.
- The app shows no advertising, has no tracking, and doesn't monitor children's behaviour for any purpose other than running the School.
10. Your choices and rights
- See or correct your details: ask the School office. Students can't edit their details in the app.
- Delete your account and data: email developer@kvaschool.edu.in or ask the School office. Some records must be kept by law or as the School's records (section 8); we'll tell you which.
- Notifications: turn them off in your phone's settings.
- Signed-in devices: sign any device out from the app's Profile tab.
- Withdraw consent: contact us. Some features need certain data, so they may stop working.
- Complaints: contact us first, and we'll reply within a reasonable time. If we can't resolve your concern, you may be able to complain to the Data Protection Board of India.
11. Security
- All the app's traffic is encrypted (HTTPS).
- Who can see what is enforced on the School's servers, not only in the app.
- Passwords are handled by Google Firebase Authentication.
- The app's keys are kept in the phone's secure storage and are left out of phone backups.
- Integrity checks help keep out modified copies of the app.
No system is perfectly secure, so we also limit who can see each kind of data (section 6).
12. Changes
When this policy changes, we'll post the new version on this page with a new date. If a change affects how we use your child's data, we'll also post a notice in the app.
13. Contact
Kharagpur Vision Academy, Mumbai - Kolkata Highway Sadatpur, Kharagpur 721301, West Bengal, India