Privacy Policy

1. Introduction

Exo (“Exo”, “we”, “us”) provides a multi-tenant school and institute management platform at exostudy.in and its subdomains (the “Service”). This policy explains what information we collect, how it's used, and the choices you have. It applies to institutes that subscribe to Exo (“Institutes”) and to the staff, students, guardians, and other individuals whose data an Institute manages through the Service (“Users”).

For data that an Institute enters about its own students, staff, and guardians, the Institute is the data controller and Exo acts as a data processor on the Institute's behalf. Questions about that data should generally be directed to the Institute first.

2. Information We Collect

• Account information — name, email, phone number, and role, provided when an Institute or User registers or is added to the Service.
• Institute data — student, staff, guardian, academic, attendance, examination, and finance records that an Institute enters to operate the Service.
• Payment information — fee and subscription payments are processed by Razorpay; we do not store full card or bank account numbers ourselves.
• Files you upload — documents, photos, and attachments (e.g. assignments, certificates, profile pictures) stored via Cloudflare R2.
• Usage and log data — device, browser, IP address, and interaction data collected automatically to operate and secure the Service.
• Communications data — content needed to deliver email, SMS, and push notifications you or your Institute request (e.g. fee reminders, circulars, verification codes).

3. How We Use Information

• To provide, maintain, and secure the Service for each Institute.
• To authenticate Users and enforce role-based access within an Institute.
• To process payments and send fee, billing, and account notifications.
• To send transactional email, SMS, and push notifications (e.g. attendance alerts, circulars, verification links).
• To provide AI-assisted features (such as in-app chat) that an Institute enables, using the content necessary to generate a response.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To improve the Service and understand how it's used in aggregate.

4. Third-Party Services

We rely on the following third parties to operate the Service. Each processes data only as needed to provide their respective function to us:

• Razorpay — payment processing for fees and subscriptions.
• Cloudflare — content delivery, DNS, DDoS protection, and file storage (R2).
• Google — optional sign-in via Google OAuth.
• MSG91 — SMS delivery (e.g. OTPs, fee and attendance alerts).
• Firebase — push notifications to the mobile app.
• Email delivery providers — for transactional and notification email.
• An AI model provider — for Institutes that enable AI-assisted chat features.

We do not sell personal information to third parties, and we do not share Institute data across Institutes.

5. Data Isolation & Security

Each Institute's data is logically isolated from every other Institute on the platform. Passwords are hashed (never stored in plain text), access is controlled by role-based permissions, and traffic to the Service is encrypted in transit via TLS.

6. Data Retention

We retain Institute data for as long as the Institute maintains an active subscription, and for a reasonable period afterward to allow for export or reactivation, unless the Institute requests earlier deletion or a longer period is required by law.

7. Your Rights

Depending on your role and applicable law, you may have the right to access, correct, export, or request deletion of your personal information. Students, guardians, and staff should generally start with their Institute, since the Institute controls that data; Institutes can contact us directly at [email protected].

8. Children's Data

Because Exo is used by schools and institutes, student data may include information about minors. This data is entered and controlled by the Institute (or a student's parent/guardian acting through the Institute), and is used solely to provide the Service the Institute has subscribed to — not for advertising or sold to third parties.

9. Cookies

We use essential cookies to keep you signed in and to remember basic preferences. We do not use third-party advertising cookies.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and, where appropriate, communicated to Institute administrators.

11. Contact Us

Questions about this policy can be sent to [email protected].