Privacy Policy

1. Introduction

aiCamu provides a multi-tenant education management and Enterprise Resource Planning (ERP) software-as-a-service platform designed for schools, colleges, and multi-campus institutions.

Roles of Educational Institutions and aiCamu: For personal data submitted to aiCamu by an institution for use of the aiCamu platform, the institution generally determines the purposes and means of processing, while aiCamu processes such data to provide the contracted services on behalf of the institution. Depending on the specific processing activity, aiCamu may also process personal data for its own legitimate operational purposes, such as managing accounts, providing customer support, maintaining platform security, preventing misuse, processing enquiries, managing billing and transactions, and complying with applicable law.

2. Information We Collect

We collect information in two ways: directly through institutional onboarding and account creation, and as entered or uploaded by authorized institutional users during daily campus operations.

3. How We Use Information

We process collected data exclusively to deliver, maintain, and support our education ERP services, including:

• Provisioning and routing access to dedicated institutional subdomains (e.g., yourcampus.aicamu.in).
• Managing admissions workflows, student records, enrollment lifecycles, and academic batches.
• Recording and computing daily or period-wise attendance records and triggering absentee alerts.
• Generating fee invoices, calculating discounts or waivers, and dispatching digital receipts.
• Delivering critical multi-channel notifications (transactional email, SMS, WhatsApp, and in-app announcements).
• Executing rule-based insight algorithms (such as attendance shortage triggers or overdue installment reminders).
• Detecting, preventing, and addressing technical faults, security anomalies, and unauthorized access.
• Responding to institutional customer support requests and onboarding assistance enquiries.

4. Legal Basis & Permitted Uses

Depending on the nature of the processing activity and applicable law, aiCamu may process personal data on the basis of contractual necessity, applicable consent or authorization, legitimate operational purposes where recognized by applicable law, compliance with legal obligations, or other lawful grounds. Specifically, these may include:

• Contract Performance: To fulfill our contractual commitments under the service agreement or terms with the subscribing institution.
• Institutional Authority & Consent: Pursuant to the lawful authority, notices, and permissions established by the educational institution for its staff, students, and guardians.
• Legitimate Operational Purposes: To maintain system uptime, detect security anomalies, protect institutional data integrity, prevent fraud or platform misuse, and ensure service reliability where recognized by applicable law.
• Legal Compliance: Where required to comply with statutory obligations, regulatory directives, or lawful judicial processes.

5. Information Sharing and Disclosure

aiCamu maintains confidentiality regarding institutional data and adheres to the following safeguards:

• No Sale of Personal Data: aiCamu does not sell personal data to third parties for their own independent advertising or marketing purposes.
• Tenant Isolation: aiCamu uses logical tenant isolation and access-control mechanisms designed to prevent unauthorized access to data belonging to other institutions.
• Legal and Regulatory Disclosure: aiCamu may disclose information where required or permitted by applicable law, regulation, legal process, or lawful governmental request. Where legally permissible, aiCamu will endeavor to provide reasonable advance notice to the affected institution.

6. Service Providers / Third-Party Services

aiCamu engages third-party service providers to support cloud hosting, communications, and operational infrastructure. These providers process information only as necessary to perform services on behalf of aiCamu or under applicable contractual and privacy obligations. Categories of service providers include:

• Cloud Infrastructure & Hosting: Cloud servers, object storage, and managed database infrastructure.
• Email Delivery: Transactional email delivery infrastructure (such as Resend) for dispatching account notifications, credentials, and institutional alerts.
• SMS Providers: Telecom aggregators and SMS gateways for automated alerts and verification messages.
• WhatsApp & Messaging Providers: Meta’s WhatsApp Business Platform and authorized messaging service providers for institutional WhatsApp communications.
• Payment Processors & Aggregators: Payment gateway providers handling institutional fee payments and payment processing links.
• Monitoring, Diagnostics & Security: Application performance monitoring, error logging, and security diagnostics infrastructure.

7. Data Storage and Security

aiCamu implements reasonable administrative, technical, and organizational security measures designed to protect institutional records from accidental loss, unauthorized access, destruction, alteration, or disclosure:

• Logical Schema Isolation: Subscribing institutions are partitioned using dedicated database schemas (such as tenant_<id>), designed to maintain separation between institutions and prevent cross-tenant data access.
• Encryption in Transit: Data transmitted between client web browsers and aiCamu application endpoints is encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3).
• Role-Based Access Control: Access controls and administrative privileges govern access to operational infrastructure and database systems.

Security Disclaimer: While aiCamu implements commercially reasonable safeguards, no electronic transmission over the Internet or digital storage architecture can be guaranteed completely secure or impenetrable. Subscribing institutions and users remain responsible for safeguarding their login credentials and maintaining proper account security.

8. Data Retention

aiCamu retains personal data for as long as necessary to provide the services, fulfill the purposes outlined in this policy, comply with contractual commitments, resolve disputes, and meet applicable legal obligations.

Following termination or expiry of an institution’s account, aiCamu may provide an applicable data export or transition period in accordance with the institution’s agreement and operational procedures. After the applicable period, personal data may be deleted, anonymized, de-identified, or otherwise disposed of in accordance with applicable law, contractual obligations, and retention policies. Data stored in routine system backups will be retired or overwritten in the ordinary course of backup lifecycle management.

9. User and Institution Rights

Individuals whose personal data is processed through aiCamu may have statutory rights under applicable data protection laws to access, review, rectify, or request deletion of their personal data, or to withdraw previously given consent, subject to legal and contractual conditions.

Institution-Managed Records: For student, parent/guardian, teacher, employee, or other institution-managed information, requests should generally be directed to the relevant educational institution or its authorized administrator. Because the institution controls its operational records, the institution is responsible for reviewing and responding to such requests. aiCamu will provide reasonable assistance to the institution where required under the applicable service agreement or law.

Certain personal data may need to be retained where required by applicable statutory, tax, regulatory, accreditation, or legal audit obligations, or where necessary to resolve active disputes or enforce agreements.

10. Children’s & Student Data

aiCamu may process information relating to students, including children, where such processing is carried out through an institution using the aiCamu platform.

The subscribing institution is responsible for ensuring that it has the appropriate authority, notices, and permissions required to provide and process student information through the platform, including obtaining parental or guardian consent where required by applicable law. aiCamu does not independently verify the parental or guardian relationship for individual students without institutional direction and involvement.

Where applicable law requires verifiable parental consent or imposes additional safeguards for processing children’s personal data, the relevant institution and aiCamu will support the applicable requirements within their respective operational responsibilities. aiCamu does not use student data for unrelated commercial advertising, data broker monetization, or behavioral profiling.

11. Cookies and Similar Technologies

The aiCamu website and web portals utilize essential cookies and browser storage technologies strictly required for system functionality:

• Authentication & Session Cookies: To keep authorized administrators, teachers, and students logged in securely across active page requests.
• Theme Preferences: Storing local UI display preferences (e.g., light mode or dark mode).
• Session Storage: Storing temporary session-level markers (such as preventing repeated modal banners during a single browser visit).

We do not utilize invasive third-party tracking or behavioral retargeting cookies.

12. Third-Party Links

Our marketing site or campus communications may occasionally contain links to third-party websites (e.g., government education portals, official board boards like CBSE/ICSE, or payment gateway checkout portals). We do not control and are not responsible for the content, security, or privacy practices of external third-party sites.

13. International / Cross-Border Data Processing

aiCamu is operated from India. Depending on the cloud infrastructure, service providers, and third-party integrations utilized by an institution, personal data may be processed or stored in India or other jurisdictions.

Where cross-border data processing occurs, aiCamu will take reasonable measures designed to address applicable contractual, security, and legal data protection safeguards. Users and institutions accessing the platform acknowledge that data protection laws may differ across jurisdictions.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements in our ERP functionality, operational changes, or statutory requirements. When updates occur, we will revise the “Effective Date” at the top of this page.

For material changes affecting how institutional data is processed, we will provide prominent notice through the administrative portal or via direct email notification to registered institutional administrators prior to the change taking effect.