Privacy Policy

1. Who we are

Acadvio is school management software made by Boffin Coders Private Limited (“we”, “us”), CIN U72900PB2017PTC046403, registered office C 201-202 (B), Cyber Cube, Phase 8B, Industrial Area, Sector 74, Mohali, Punjab 160055.

This policy covers this website (including the demo request, question and grievance forms) and summarises how personal data is handled in the Acadvio service that schools use.

2. Our two roles

On this website and for demo requests, questions and grievances, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023: we decide what is collected and why, as this policy explains.

In the Acadvio service, each school is the Data Fiduciary and we are its Data Processor. The school decides what it records about its students, parents and staff. We process that data only on the school’s instructions, under our Data Processing Addendum (v2026-10-16). Parents can read our plain-language Privacy Notice for Parents and Students, and should contact their school first about their child’s records.

3. What we collect on this website

This website does not set cookies and does not use analytics, advertising or tracking tools. While you fill in the demo or question form, your draft is kept in your own browser (session storage) so it is not lost; it is cleared when you close the tab or send the form. The grievance form keeps nothing in your browser. See our Cookie Policy.

We do not collect passwords, financial details or other sensitive information through this website.

4. Why we may use it

• Demo and pilot requests and questions: you give us the information voluntarily for this purpose (section 7(a) of the DPDP Act). You can ask us to stop at any time.
• Grievances: you give us the information voluntarily so that we can answer you (section 7(a)); handling grievances is also a duty the DPDP Act places on us.
• Security logs: to protect our systems and to meet legal requirements, including the CERT-In Directions.
• Legal duties: where a law, court or authority requires it.

5. Personal data in the Acadvio service

Depending on what a school records and which features it uses, Acadvio processes for the school:

• Students: name, class, section, roll and admission numbers, date of birth, gender, photo, attendance, leave, homework, marks and report cards, certificates, fee records and documents the school uploads.
• Parents and guardians: name, phone, email, relation to the student, messages with the school, consent decisions and fee payments.
• Staff: name, contact details, role, classes and subjects, attendance and leave, and sign-in details (passwords are stored only as hashes).
• Technical data: sign-in sessions, security logs and an access log of sensitive actions (kept as counts, without copying the data).

Most students are children. The school is responsible for obtaining a parent’s or guardian’s verifiable consent where the law requires it; Acadvio lets the parent give, decline or withdraw consent themselves, in the app or through an emailed link, and records who decided, when, how and on which version of the notice. We never use children’s data for tracking, behavioural monitoring, profiling or advertising.

6. Who we share data with

We share personal data only with service providers that help us run the website and Acadvio, under written terms, and only for that purpose. They are listed on our Sub-processors page.

Within a school, people see data according to the role the school gives them; parents never see staff phone numbers or email. We may disclose personal data where the law requires it, for example to a government agency acting under a lawful order. We never sell personal data.

7. Where data is stored

Data is stored in India: the database in Mumbai, and hosting and files at DigitalOcean in Bengaluru. We do not transfer it outside India except as permitted under section 16 of the DPDP Act, and never to a country or territory the Government of India has restricted.

8. How we protect data

• Connections are encrypted (HTTPS). Each school’s records are kept in a separate database.
• Access is limited by role; staff access to sensitive information is logged, and unusual patterns raise a flag for the school.
• Documents and photos are kept in private storage and open only through short-lived links (files from before October 2026 are being moved there). ID numbers such as Aadhaar are encrypted and shown masked.
• Backups are encrypted (AES-256-GCM) before they leave the server and are kept off the server.

9. How long we keep data

• Demo and pilot requests and questions: for 12 months after our last contact with you, then deleted. You can ask us to delete them sooner.
• Grievances and other requests (including Help & requests raised in Acadvio): for three years after the request is closed, resolved or declined, then deleted with its messages and attachments. A count of deletions is kept.
• Emails with us: as long as needed to deal with your query, and as the law requires.
• Security logs: at least 180 days, as the CERT-In Directions require, and one year once the DPDP Rules require it; no longer than we need them.
• School data: as set by the school during its subscription (for example, fee and financial records for eight years, the access log for one year). When a school leaves, we give it an export and delete its data within 90 days after it confirms the export, unless the law requires us to keep it. Encrypted backup copies are removed within about five weeks.

10. Your rights

Under the DPDP Act you have the right to:

• a summary of the personal data we hold about you, how we use it, and who we have shared it with;
• have it corrected, completed, updated or erased;
• withdraw your consent at any time, as easily as you gave it (this does not affect what was done before);
• have your grievance addressed, and complain to the Data Protection Board of India;
• nominate someone to exercise your rights if you die or become unable to.

For data on this website, write to info@boffincoders.com. For data a school holds in Acadvio, ask the school: it is the Data Fiduciary, and we help it answer.

11. If there is a personal data breach

If a breach affects data we hold as Data Fiduciary, we inform you and the Data Protection Board of India as the DPDP Act and Rules require, and report to CERT-In where its Directions apply. If it affects school data, we notify the school within 24 hours of becoming aware and help it inform the Board and parents.

12. Grievance officer

Our grievance officer is Manoj Sethi, info@boffincoders.com, Boffin Coders Private Limited, C 201-202 (B), Cyber Cube, Phase 8B, Industrial Area, Sector 74, Mohali, Punjab 160055.

We acknowledge grievances within 48 hours and resolve them within 30 days. Details and escalation are on our Grievance Redressal page.

13. Changes to this policy

We update this policy when the law or the way we work changes; the date at the top shows the latest version. If a change materially affects how school data is processed, we tell schools at least 30 days in advance.

14. Contact