Privacy Policy

This policy explains how WebPrims (“we”, “us”) handles personal data in WebPrims Coaching (the “Service”), a management app for coaching institutes, tuition centres and academies (“Institutes”). It is written with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 in mind.

1. Our role

• For account data of the people who sign up (institute owners and staff) we are the data fiduciary.
• For student, guardian and enquiry data that an Institute adds, the Institute is the data fiduciary and we act as its data processor — we process it only on the Institute's instructions to provide the Service.

2. Data we process

• Account data: name, email, phone, password hash or Google sign-in identifier, and your role in each institute.
• Institute data: name, address, logo, UPI ID, bank details, fee settings and message templates.
• Student & parent data entered by the Institute: student name, photo, date of birth, class, school, roll number, guardian names and phone numbers, address, batches, fee plans, dues, payments and receipts, attendance, test marks, notes and documents.
• Enquiry data submitted through an Institute's public enquiry page: name, phone, guardian, class, school, city, course and message.
• Usage data: sign-in times, device/browser type, IP address and an audit log of important changes, kept for security.

3. Children's data

Many students are under 18. Institutes are responsible for obtaining verifiable consent from a parent or lawful guardian before adding a child's data, as required by law. We do not use children's data for advertising, profiling or tracking, and there are no ads in the Service.

4. How we use data

• To run the Service: calculate fee dues, generate receipts, record attendance and results, and show them to authorised staff.
• To power the parent / student portal — a private, hard-to-guess link per student that shows only that student's information.
• To prepare reminder and notification messages for the Institute to send.
• To secure the Service, prevent abuse, provide support and send essential account emails.

We never sell personal data and never use an Institute's student data to market anything to students or parents.

5. WhatsApp, SMS and UPI

Reminders are sent by the Institute from its own WhatsApp or SMS app using click-to-chat links (wa.me / sms:). When a staff member taps Send, the phone number and message are handed to WhatsApp or the SMS app on their device, and WhatsApp's (Meta's) own privacy policy applies to that message. UPI payment links open the parent's UPI app; payments go directly to the Institute — we never receive or store card, bank or UPI credentials.

6. AI features

When a staff member uses WebPrims AI, their question and the relevant records their role is allowed to see (for example names, dues or attendance) are sent through our AI gateway, OpenRouter, to the model provider that generates the answer (currently DeepSeek; we may also use Anthropic). Teachers never send fee data to the AI because they cannot access it. We choose provider settings that do not allow your data to be used for model training where the provider offers that option. Institute admins can switch AI off for the whole institute in Settings.

7. Service providers

We use trusted processors: Supabase (database, authentication and file storage), our web hosting provider, Google (sign-in and email delivery), and OpenRouter with its model providers such as DeepSeek and Anthropic (AI features). Some of them process data outside India under contractual safeguards and as permitted by Indian law.

8. Security

Data is encrypted in transit (HTTPS) and at rest by our database provider. Each Institute's data is isolated with database row-level security, access is limited by staff role, and important changes are logged. An Institute can reset a parent link at any time, which immediately disables the old link. No system is 100% secure; if a breach affects your data we will notify you and the authorities as required by law.

9. Retention & deletion

We keep data while the Institute's account is active. Institutes can delete students, enquiries or the whole institute. Deleted data is removed from the live database immediately and from backups within 30 days, unless the law requires us to keep it longer (for example payment records for tax purposes).

10. Your rights

You can access, correct, export or delete your data and withdraw consent. Parents and students: your data is controlled by your Institute — please contact the Institute first; if you cannot reach them, write to us and we will help route your request. You may nominate another person to exercise your rights, and you may complain to the Data Protection Board of India.

11. Cookies

We use only essential cookies to keep you signed in and remember preferences such as the theme. We do not use advertising cookies.

12. Contact & Grievance Officer

Grievance Officer, WebPrims — webprims@gmail.com. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.