Privacy Policy.

1 Who we are & scope

The Infoiles brand and platform are owned by Infoiles Inc., a holding company registered in Ontario, Canada. All operations, data processing, legal responsibility and compliance for infoiles.com and its sub-domains (such as ed.infoiles.com) rest solely with its Indian subsidiary, Infoiles Ed Private Limited (based in Delhi, India; full registered address in section 13). Throughout this policy, "Infoiles", "we", "us" and "our" mean Infoiles Ed Private Limited unless stated otherwise; Infoiles Inc. acts only as a holding company and is not involved in data processing.

This policy covers: (a) this marketing website at infoiles.com, including its contact / demo-request form; and (b) the Infoiles Ed platform we provide to schools, comprising the web portal at ed.infoiles.com and the Infoiles Ed mobile app for students (Android), where the school makes it available; and (c) Infoiles Mail, Drive and Docs, the school email, file storage and document apps at webmail.infoiles.com, drive.infoiles.com and docs.infoiles.com, with their sign-in page at account.infoiles.com, where a school uses them. Where a school's own agreement with us says something more specific about its data, that agreement also applies.

2 Controller vs processor: an important distinction

Who is responsible for personal data depends on whose data it is and why it is being handled. This distinction shapes the rest of the policy.

3 Data we collect

(a) Marketing / contact-form data, given to us directly

When you contact us or request a demo through this website, we collect what you provide:

• your name, school name and role;
• your email address and phone number;
• any message you choose to send us; and
• basic technical metadata recorded with the submission (such as the time, IP address and browser) to help prevent spam and abuse.

(b) School-side data, processed on behalf of schools

When a school uses Infoiles Ed, or Mail, Drive and Docs, we process the data it and its people put into them to run the service. This is collected and controlled by the school; we process it on the school's instructions. It can include:

• student, guardian and staff details (demographics, contact details and profiles);
• academic records (classes and sections, attendance, marks and report cards);
• fees, invoices and receipts, and supporting documents the school uploads;
• in Infoiles Mail: the emails people send and receive, with their attachments and the names and addresses of senders and recipients (including people outside the school who write to a school address), and a searchable copy of each email's text;
• in Infoiles Drive and Docs: the files people upload and the documents, spreadsheets and presentations they create, with earlier versions, comments, and who each item is shared with;
• to make those apps work: each person's name, role, class and section copied from Infoiles Ed, and how much storage they use; and
• Aadhaar-related data: Aadhaar numbers, identity documents the school uploads (which can include Aadhaar card scans) and, for staff, the result of an optional DigiLocker verification, handled as described in section 5.

(c) Technical & usage data

When you use the web portal, the app, or Mail, Drive and Docs, we record basic technical and usage data (such as device and browser type, IP address, sign-ins, and logs of key interactions such as a file being shared, changed or deleted) to keep the service secure, reliable and working correctly.

4 How & why we use it; legal basis

Marketing data. We use the details you submit through the form solely to respond to your enquiry and arrange a demo. As the controller for this data, our basis is your consent (given when you submit the form) and our legitimate interest in responding to a request you have made of us.

School data. We use school-side data only to provide and operate the platform on the school's instructions (for example, generating receipts, producing report cards, running attendance, delivering email or storing files). We process it under the school's authority as the data fiduciary.

Email, files and documents. We do not read the contents of people's email, files or documents, except where the school asks us to, where it is needed to fix a problem the person has reported, or where the law requires it. Automated checks run on them to keep the service safe, such as a virus check on every file people upload or attach.

We do not sell personal data, and we do not use it for unrelated profiling or advertising.

5 DigiLocker / Aadhaar handling

Where a school chooses to verify a staff member's identity, Aadhaar is verified through the government's DigiLocker (Meri Pehchaan) service, at hiring or at any time afterwards. This verification is optional: schools can onboard staff without it. Admissions no longer use DigiLocker; records of student and guardian verifications carried out earlier are retained.

From a DigiLocker verification, the Aadhaar number is recorded only in masked form (for example, XXXXXXXX1234, where only the last four digits are readable), together with a DigiLocker reference showing that the verification took place. Aadhaar numbers entered on admission forms and student records are also saved in masked form.

Identity documents that a school uploads, which can include scans of Aadhaar cards, are kept in private, access-controlled storage: in the platform, only school users whose role covers those student or staff records can open them.

6 Payment data (CCAvenue)

Online fee payments are processed through CCAvenue's hosted checkout. Card details, UPI IDs and bank details are entered on CCAvenue's secure pages, not on ours.

• No card data is stored on our systems: no card number, expiry date or CVV. This keeps the payment path within a reduced PCI scope (SAQ-A); CCAvenue is itself PCI-DSS compliant.
• We retain only non-sensitive transaction references (such as a transaction ID, amount and status) needed to reconcile payments and issue receipts.
• For how CCAvenue handles your payment data, see CCAvenue's privacy policy at ccavenue.com/privacy-policy.

7 Cookies & analytics

This marketing website sets no cookies and uses no third-party analytics or advertising tools. It counts its own visits with a simple counter on our own server that keeps daily totals only: how many times each page was opened, how many visits arrived and from which website (its name only, such as google.com), how many times people went from one of our pages to another, and how often buttons such as “Try it live” or “Log in” were clicked, and on which page. The counter stores no IP address, no device or browser details and no identifier, so it cannot tell who you are or follow anyone from page to page. Our live demo at try.infoiles.com counts, in the same way, how often it is opened and which role is chosen.

The Infoiles Ed platform (web portal and app) uses essential cookies needed to keep you signed in and to operate the service, and records usage logs to keep the platform secure and reliable. The app uses no advertising or third-party tracking SDKs. You can manage cookies through your browser settings.

Mail, Drive and Docs use an essential sign-in cookie on each app's own address, and remember whether you chose the light or dark look in a cookie shared by infoiles.com addresses. Your browser also sends that light-or-dark cookie to this website, which does not read it. They use no advertising or third-party tracking either.

8 Sharing, sub-processors & international transfers

We do not sell personal data. We share data only with the limited sub-processors needed to run the service, each under appropriate terms:

• CCAvenue: online fee payments (hosted checkout).
• DigiLocker / Meri Pehchaan: optional Aadhaar identity verification of school staff.
• LiveKit: media for self-hosted live online classes.
• Our hosting / infrastructure provider: OVH.

Mail, Drive and Docs add no sub-processors. They run on our own servers at OVH, using open-source software that we operate ourselves (Stalwart for email, ONLYOFFICE for the document editor and ClamAV for virus checks). Email sent to people outside the school is, by its nature, delivered to their own email providers.

We may also disclose personal data to legal or regulatory authorities where required by law or a valid court order.

International data transfers

We operate primarily from India. Because our holding company is in Canada, some data may be transferred to or accessed from outside India (for example, servers in Canada). Where data is transferred internationally, we apply appropriate safeguards, such as Standard Contractual Clauses (SCCs) or data anonymisation, consistent with applicable law.

9 Data retention

We keep personal data only as long as needed for the purpose it was collected:

• Marketing leads from the contact form are kept for as long as needed to respond to and follow up on your enquiry, and then deleted.
• School-side data is retained for as long as the school uses the service, and otherwise handled per the school's instructions and agreement (export, return or deletion on termination).
• Payment records and transaction metadata (transaction ID, amount and status; never card or UPI details) are retained for up to 10 years, as required by Indian tax and financial-reporting laws (including GST), then securely deleted or anonymised unless a longer period is required by law or to resolve a dispute.
• Audit logs are retained in line with the platform's audit-log retention policy and then securely removed.
• Mail, Drive and Docs: email, files and documents are kept while the school uses the apps. A deleted file or document can be restored for 30 days and is then removed, and email in Deleted or Spam is removed for good after 30 days. A document keeps its last 50 versions, and any version someone names, until the document itself is deleted. Records of sign-ins to the apps are removed 90 days after the sign-in ends. When a person's Infoiles Ed account is switched off, they can no longer sign in to the apps; their email and files stay with the school until the school asks us to remove them.
• Backups: we keep nightly backups for 14 days, and copies of files removed from Drive for 30 days, so we can recover from mistakes and failures.

10 Security measures

We take protecting personal data seriously and apply, among others:

• Per-school data isolation: each school runs in its own isolated database; one school's data is never mixed with another's. Mail, Drive and Docs keep each school's email and files apart under that school, and check every request against the person's school and what has been shared with them;
• Checked files: every file uploaded to Drive or Docs, or attached to an email written in Mail, is checked for viruses before anyone can open it, and files are only handed out after the apps have checked who is asking;
• Trustworthy school email: email from a school's addresses is signed, and published records (SPF, DKIM and DMARC) let other services check that it really came from that school;
• Protected credentials: sensitive credentials such as payment-gateway keys are encrypted, passwords are stored only as one-way hashes (never in readable form), logins are rate-limited and idle sessions time out;
• Access control (RBAC): staff access is role-based with per-user overrides, and deactivation can take effect mid-session; and
• an append-only audit log of key actions, such as sign-ins, staff access changes, data exports and online payments.

No method of storage or transmission is ever 100% secure, but we work to protect personal data using measures appropriate to its sensitivity.

11 Children's data

The platform handles the personal data of students, who are often minors, on behalf of schools. Under the DPDP Act 2023, the school is the data fiduciary and is responsible for obtaining the necessary parental / guardian consent. Infoiles processes children's data only on the school's instructions and does not use it for any independent purpose.

Where a school gives students Mail, Drive or Docs, student accounts can by default only email and share with people inside the school, and no one can share a file with "anyone who has the link" unless the school allows it.

12 Your rights under the DPDP Act 2023

Subject to the DPDP Act and its rules, you may have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• correct, complete or update inaccurate or incomplete data;
• erase data that is no longer needed for the purpose it was collected;
• withdraw consent you previously gave (without affecting earlier lawful processing); and
• grievance redressal: raise a concern and have it addressed.

If you are in Canada, you also have rights under PIPEDA, including the right to access your personal data and request corrections.

13 Grievance officer & contact

To exercise a right or raise a grievance, contact the Grievance Officer at Infoiles Ed Private Limited:

• Email: admin@infoiles.com
• Phone: +91 8448570294
• Registered address: B-83, Shakti Apartments, Sector-9, Rohini, Delhi 110085, India

We will acknowledge and respond to requests within the timelines required under the DPDP Act and its rules.

14 Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the latest version. Where changes are material, we will notify affected parties by email and/or an in-app or on-site notice.