1. Introduction

CHERI School Management System ("CHERI SMS", "we", "us") is committed to protecting the privacy of students, parents, staff, and administrators who use our platform. This policy describes what data we collect, why we collect it, how we protect it, and your rights regarding your personal information.

2. Data We Collect

• Identity data — name, date of birth, gender, admission/employee number, photographs
• Contact data — email, phone number, address
• Academic data — grades, attendance, timetable, homework, exam results, certificates
• Financial data — fee structure, payment history, wallet balance (we do NOT store card/bank details — payments are processed by the configured payment gateway)
• Health data — health records, wellness check-ins (only if the school enables these modules)
• Technical data — IP address, browser type, device info, login timestamps, FCM tokens for push notifications
• Communication data — messages sent via the in-app chat, feedback, support tickets

3. How We Use Your Data

• Providing and operating the school management platform
• Generating academic reports, attendance analytics, and fee statements
• Sending notifications (push, email, SMS) about school activities, homework, and fee reminders
• AI-powered features (risk scoring, learning analytics, chatbot) — only when enabled by the school administrator
• Ensuring platform security (login auditing, rate limiting, abuse detection)

4. Data Sharing

We do NOT sell personal data. Data may be shared with:

• Your school — the school is the data controller; we are the data processor
• Payment gateways (Razorpay, PayU, etc.) — only during fee payment processing
• Email/SMS providers (Zoho, Twilio) — for transactional notifications only
• Law enforcement — if required by law or court order

5. Data Retention

Data is retained for the duration the student is enrolled / staff is employed, plus any additional period required by local education regulations (typically 5-10 years after departure). Schools can configure custom retention policies under Data Retention Settings.

6. Your Rights

• Access — view your data via the My Data & Privacy page
• Export — download a JSON copy of all your personal data
• Erasure — request anonymisation of your data (subject to school approval and legal retention requirements)
• Consent management — grant or withdraw specific consents at any time
• Correction — contact your school administrator to correct inaccurate records

7. Security Measures

• Passwords hashed with BCrypt (work factor 12)
• Sensitive configuration encrypted with AES-256-CBC
• JWT-based authentication with configurable token expiry
• HTTPS enforced via HSTS (Strict-Transport-Security)
• Rate limiting on login and API endpoints
• Multi-factor authentication (TOTP / security question) available
• Per-device session management (single-device login enforcement)

8. Children's Privacy

We process student data on behalf of schools. Schools are responsible for obtaining parental consent as required by local law (COPPA, GDPR Article 8, or national equivalents). The platform provides parental access controls so guardians can view and manage their child's data.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the school's announcement system. Continued use of the platform after updates constitutes acceptance of the revised policy.

10. Contact

For privacy-related queries, contact your school administrator or reach us at Help & Contact.