Edorapad Privacy Policy

1. Introduction & Scope

Edorapad ("Edorapad", "we", "our", or "us") operates a multi-role educational management platform comprising our website at https://edorapad.com, the Edorapad mobile application for Android and iOS devices, and related cloud services (collectively, the "Services").

Our platform connects educational institutions, online and offline tutors, students, parents/guardians, and administrative personnel to streamline academic scheduling, attendance tracking, classroom lectures, homework management, tuition fee records, and institutional communications.

This Privacy Policy governs the manner in which Edorapad collects, uses, maintains, and discloses information collected from users. By registering an account, downloading the mobile application, or accessing any part of the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect information necessary to deliver educational workflows and manage platform integrity across our distinct user roles:

A. Account & Profile Information

When registering or onboarding an account, we collect: full name, email address, password credentials (stored using salted one-way hashes), phone number, profile photo, date of birth, gender, nationality, and user role designation (Student, Parent, Online Tutor, Offline Tutor, Institute Admin, Accounts & Marketing Staff).

B. Student, Parent & Tutor Information

Student enrollment details, student IDs, roll numbers, department and batch assignments, parent-student relationships, guardian contact credentials, tutor academic qualifications, subject specializations, and faculty rosters.

C. Attendance & Academic Data

Class attendance logs, timestamps for online and offline classroom presence, leave requests and approval records, assessment submissions, exam and quiz marks, teacher remarks, certificates earned, and academic performance summaries.

D. Face Verification Data (Faculties/Tutors)

For tutors utilizing optional face verification for lecture clock-in, facial landmarks are captured temporarily to verify identity at the start of a session. Facial geometry templates are processed strictly for verification, are encrypted, and are never sold, licensed, or shared with commercial brokers.

E. Device & Technical Information

Device model, operating system version, screen resolution, IP address, unique device identifiers, network connection status, crash logs, and diagnostic telemetry necessary to maintain app stability and prevent unauthorized multiple-device takeovers.

3. How We Use Your Information

Edorapad uses collected information strictly for educational, operational, and safety purposes:

• Core Educational Delivery: Facilitating live online video classrooms, offline lecture scheduling, batch assignments, and course materials access.
• Attendance & Grade Tracking: Calculating monthly attendance percentages, compiling report cards, and issuing verified certificates.
• Institutional Administration: Enabling institutions and faculty to review leave requests, student progress, fee payments, and admissions.
• Parent-Institute Transparency: Providing parents visibility into their child's attendance, teacher assessments, and pending fee dues.
• Security & Authentication: Verifying user role permissions (RBAC), defending against brute-force attacks, and preventing unauthorized account sharing.
• Platform Reliability: Monitoring application health, resolving bugs, and ensuring smooth performance on low-bandwidth networks.

4. Mobile Device Permissions

The Edorapad mobile application requests runtime device permissions only when strictly required for explicit features:

• Camera Permission: Used for live video lecture participation, profile photo capture, tutor lecture clock-in verification, and scanning admission verification documents.
• Microphone Permission: Used exclusively for interactive classroom discussions, student Q&A sessions, and tutor presentations during scheduled live lectures.
• Notifications Permission: Used to deliver class reminders, live lecture start alerts, fee due dates, exam marks notifications, and urgent institutional broadcasts.
• Secure Storage: Mobile authentication session tokens are stored in hardware-backed encrypted storage (iOS Keychain and Android Keystore/EncryptedSharedPreferences).

Users can view, grant, or revoke permissions at any time through their device's Settings menu. Revoking camera or microphone will only disable live streaming functionality while keeping other features active.

5. Notifications & Push Tokens

When you allow notifications, Edorapad collects a unique push notification device token (such as an Expo Push Token, Apple APNs token, or Google Firebase Cloud Messaging token).

These tokens are linked to your authenticated user account and are used solely for:

• Notifying you when a live lecture is starting or when a class schedule is updated.
• Informing parents of student absence or late check-in.
• Delivering tuition fee payment receipts and due date reminders.
• Announcing exam scores, certificates, and institutional community updates.

We do not use push tokens for third-party commercial advertisements. You can disable push notifications directly inside the Edorapad application settings or via device settings at any time.

6. Payment & Financial Information

Edorapad facilitates tuition fee tracking, payment collection receipts, and tutor salary record-keeping.

Security of Financial Credentials: When payments are submitted electronically, transactions are processed directly by certified, PCI-DSS Level 1 compliant payment gateways. Edorapad does not store full credit card numbers, CVVs, or online banking passwords on its servers.

We store only transaction reference metadata required for accounting audit trails: transaction ID, installment amount, currency, timestamp, payment method type (e.g. Card, UPI, NetBanking), and payment confirmation status.

7. Data Sharing & Third-Party Disclosures

We respect the privacy of academic and personal records. We do not sell or rent personal information. Data is shared strictly under the following circumstances:

• With Your Enrolled Institution: Student academic records, attendance history, and course progress are shared directly with the authorized administration and assigned faculty of the student's institution.
• With Verified Parents / Guardians: Parents linked to a student account can view their child's academic assessments, attendance statistics, fee records, and institutional feedback.
• With Infrastructure Service Providers: Trusted third-party cloud hosting providers, database providers, push notification services (Expo, Firebase), and payment gateways that process data on our behalf under strict Data Processing Agreements (DPAs).
• Legal Requirements: When required by applicable law, regulation, subpoena, or enforceable governmental order to protect the rights, property, or safety of students, users, or the public.

8. Children's & Student Privacy (COPPA & FERPA)

Edorapad is committed to the protection of young learners. Where students under 13 (or the legal age in their jurisdiction) access the Services:

• Student accounts are created either by the educational institution or under the authorization and consent of the student's parent or legal guardian.
• Student personal data is used solely for educational purposes, classroom learning, and institutional administration.
• We do not build advertising profiles or conduct behavioral marketing targeting students of any age.

Parents and legal guardians have the right to inspect their child's records, request corrections, or request deletion of their child's personal information by contacting their institution or our privacy team.

9. Data Retention & Account Deletion Policy

We retain personal information for the period necessary to fulfill the educational purposes outlined in this Privacy Policy, unless a longer retention period is required by statutory educational regulations or tax accounting obligations.

How to Request Account & Data Deletion

Users have the full right to delete their account and associated personal data at any time, in compliance with Google Play Store and Apple App Store policies:

• In-App Deletion: Navigate to Settings > Profile > Delete Account inside the mobile application or web portal.
• Email Request: Send an account deletion request to privacy@edorapad.com from your registered email address with the subject "Account Deletion Request".

Upon receipt and verification of your request, your personal profile data, authentication credentials, and active tokens will be permanently removed from our active databases within 30 days. Certain academic records (such as completed course transcripts) may be archived by your enrolled institution as required by educational regulatory laws.

10. Data Security & Safeguards

We deploy multi-layered physical, technical, and administrative defenses to safeguard your personal data:

• Transport Layer Security (TLS): All communications between mobile clients, browsers, and our backend servers are encrypted using modern TLS 1.3 / HTTPS.
• Database Encryption at Rest: User tables, credentials, and records stored in cloud databases are protected using AES-256 bit encryption.
• Role-Based Access Control (RBAC): Strict backend middleware ensures students, parents, tutors, and staff can only access data explicitly permitted for their role.
• Token Protection: Stateless JWT tokens are signed with rotating cryptographic secrets and securely stored in device-native secure keystores.

11. Your Privacy Rights

Depending on your jurisdiction (including GDPR, CCPA, and Indian Digital Personal Data Protection laws), you possess the following rights:

• Right to Access: Request a copy of the personal data Edorapad holds about you.
• Right to Rectification: Request correction of inaccurate, out-of-date, or incomplete profile details.
• Right to Erasure: Request deletion of your personal data when it is no longer required for educational or legal duties.
• Right to Restriction of Processing: Request limits on how your data is handled during active dispute reviews.
• Right to Withdraw Consent: Revoke granted permissions (camera, microphone, push notifications) at any time.

12. Contact Information & Grievance Officer

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our Data Protection Officer:

We respond to all verified privacy and data deletion inquiries within 30 days of submission.