Legal
Privacy Policy
This Privacy Policy explains how GKC EdVance handles personal data when parents, students and school staff use it on the web or in the mobile apps: what is collected, why, who it is shared with, how long it is kept, and the choices and rights you have. It is issued under the Digital Personal Data Protection Act, 2023 (the DPDP Act), the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 with its rules.
At a glance
- Your school uses GKC EdVance to bring homework, attendance, class updates, notices, fees and messages into one place.
- Your information is used only to provide these school services. It is never sold, never used for advertising, and never used to build profiles of children.
- It is stored in India, encrypted, and kept separate from every other school's data.
- The AI assistant is used only with your agreement, which you give on the consent screen.
- You can see, correct or erase your data, and reach us any time, from Privacy and Support in the app.
1. Who provides GKC EdVance
GKC EdVance is provided to you by your school. Your school chooses the services it offers through the app and decides how school information is used, as it does for all of its school records. Under the DPDP Act this makes the school the *Data Fiduciary*.
GKC EdVance is built and operated for schools by GKCodeLabs Private Limited ("GKCodeLabs", "we"). We run the platform on the school's behalf under a written agreement (section 8 of the Terms of Service) and use the data only to provide the service, which makes us the school's *Data Processor*. Our company details are at the top of this page and in section 10.
This Policy is the notice your school gives you through GKC EdVance.
2. Information we handle
| Category | Examples | Whose data |
|---|---|---|
| Identity | Name, role, admission number or employee ID, class and section, designation and department, photo if the school adds one | Parents, students, staff |
| Contact | Mobile number, email address | Parents, staff, students who have a login |
| Attendance | Daily attendance marks | Students |
| Homework and academics | Assignments, due dates, progress notes, focus goals | Students |
| Leave | Leave dates, the reason given, and any medical certificate uploaded | Students |
| Fees | Invoices, payments recorded by the school, receipts | Students, parents |
| Documents | Report cards, certificates and other files the school shares | Students |
| Photos and gallery | Photos and videos of school activities shared by the school | Students and staff shown in them |
| Messages and notices | Messages with teachers, school notices, event invitations, feedback | Parents, students, staff |
| Complaints | Complaints and grievances raised, and the school's replies | Parents, students, staff |
| Work records | Classes assigned, attendance marked, assignments and notices posted, and other entries made | Staff |
| AI assistant | Questions asked and the assistant's answers | Parents, students, staff |
| Device and notifications | Push-notification token, device type, app version | Anyone who enables notifications |
| Security | Sign-in times, IP address, a record of actions taken in the platform | Everyone |
We do not collect Aadhaar numbers, dates of birth, home addresses, bank or card details, health records (other than a medical certificate you choose to upload with a leave request), location, or contacts from your phone.
3. How it is used
| Purpose | Data used | Basis |
|---|---|---|
| Providing school services: attendance, homework, leave, fees, notices, messages, documents, gallery, events and complaints | Identity, contact and the service data above | Consent given by the parent for the child (DPDP s.6 and s.9). For staff, their work for the school, a legitimate use under s.7(i) |
| Signing you in and keeping your account secure | Contact, security | Consent, or legitimate use for staff; security safeguards required by s.8(5) |
| Sending notifications by push, SMS and email | Contact, device and notifications | Consent, or legitimate use for staff |
| The AI assistant (section 4) | The questions asked and the school records needed to answer them | Your agreement, given as a separate tick on the consent screen |
| Understanding complaints and feedback: sorting a complaint into a category, suggesting follow-up replies, and summarising parent-teacher meeting feedback for the school | The text of the complaint or feedback | Part of school services |
| Security, audit, legal and record-keeping duties | Security logs, audit records | Legal obligations, including CERT-In directions and DPDP Rules 6 and 8 |
We never use children's data for advertising, never build behavioural profiles of children, and never track children across websites or apps (DPDP s.9(3)). GKC EdVance has no analytics or advertising software.
4. The AI assistant
The AI assistant answers questions about school information in plain language, for example what homework is due this week. To answer, the question and the relevant school records (which can include a child's name, class, attendance, homework, fees or leave) are shared securely with our AI service provider, OpenAI, L.L.C., which processes them in the United States. The same provider helps sort complaints into categories, suggest follow-up replies and summarise meeting feedback for the school.
- Your agreement. You are asked to agree to use the AI assistant on the consent screen, as its own tick. A parent's agreement covers their children's school records. It is recorded with the version you accepted, the date and time, and how your identity was verified.
- Safeguards. Requests are sent with storage turned off (
store: false) and do not carry your name, email or phone number as an account identifier. Conversations are kept in GKC EdVance for 90 days. - Accuracy. Answers are generated from school records and can be incomplete or out of date. Check anything important with your school.
- Withdrawing. You can withdraw your agreement at any time from Support in the app or by writing to the grievance officer (section 10). From then on, that child's records are not sent to OpenAI by the assistant on any screen, including the assistant used by teachers and staff. Your other school services are not affected.
Transfers of personal data outside India are permitted under DPDP s.16 unless the Government restricts a country. We will update this Policy if that changes.
5. Who it is shared with
- Your school, its teachers and staff, each seeing only what their role needs. Parents see their own children's information.
- GKCodeLabs, to run and support the platform for the school.
- Our service providers listed below, only for the work listed.
- Authorities, only where the law requires it, for example a court order or a report required under the POCSO Act.
We do not sell personal data.
Service providers (sub-processors)
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Amazon Web Services India Private Limited | Hosting, database, file storage, backups, logs | All platform data, encrypted at rest | India (Mumbai, ap-south-1) |
| OpenAI, L.L.C. | AI assistant; sorting complaints into categories; suggested follow-up replies; summaries of meeting feedback | The question or text, and the school records needed to answer it, sent with storage off. Not sent for a child whose parent has withdrawn the AI assistant | United States |
| Walkover Web Solutions Private Limited (MSG91) | Sign-in codes and messages by SMS and email | Mobile number or email address, and the message text | India |
| Google LLC (Firebase Cloud Messaging) | Push notifications to phones | Device push token and the notification title and text | Global |
GKC EdVance does not use any advertising, analytics or crash-reporting service. Schools are told at least 30 days before a new service provider is added.
6. How long it is kept
| Data | How long |
|---|---|
| Academic, attendance, fee and communication records | While the student is enrolled, and afterwards for the period your school sets for its own records |
| Fee and payment records | As long as tax and accounting law requires (generally 8 years) |
| Staff accounts and work records | While the account is active, then as the school's records policy requires |
| AI assistant conversations | 90 days |
| Sign-in codes | 24 hours |
| Sign-in sessions | 1 year after the session ends |
| Notifications | 1 year |
| Delivery records for push and messages | 90 days |
| Push tokens that are no longer used | 30 days after they stop working |
| Security and audit logs | At least 1 year and up to 3 years, stored in India |
| Backups | Erased data leaves backups within 35 days |
When a school stops using GKC EdVance, its data is returned to it and then deleted within 90 days.
7. How it is protected
Data is stored in India (AWS Mumbai) and encrypted at rest and in transit. Each school's data is isolated from every other school's at the database level. Access is limited by role, sign-in uses one-time codes, and every access to sensitive records is logged. Everyone with access to student and family records, at the school and at GKCodeLabs, is bound by confidentiality. If a personal-data breach occurs, your school and the Data Protection Board of India will be informed, and you will be told without delay, as the DPDP Rules require.
8. Children and students
Students are under 18, so a parent or guardian gives consent for their child in the app. The parent's identity is taken from the school's admission records and confirmed with a one-time code sent to the contact details in those records (DPDP Rule 10). Children's data is used only for school services, as described above.
A note for students
- Your school uses GKC EdVance to share homework, attendance, notices, photos and messages with you and your family.
- It holds your name, class, attendance and homework, and anything your school or family adds, like leave requests or documents.
- Your teachers, school staff and your parents or guardians can see it. Other students and strangers cannot.
- It never shows you ads, never tracks what you do on other apps or websites, and never sells your information.
- The AI assistant can use your school records to answer questions because your parent agreed. If your parent asks for it to be switched off, the assistant will tell you it is off.
- Be kind and safe: do not share anything unkind, rude or private about anyone. If something online makes you feel unsafe or uncomfortable, tell a parent or a teacher straight away.
- Questions? Ask your parent or your class teacher.
9. Your rights
Under the DPDP Act you may:
- Access a summary of your data and your child's data, what it is used for and who receives it (s.11). A summary is shown in the app any time; ask for more detail with an access request.
- Correct, complete or update data that is wrong or incomplete, and erase data that is no longer needed (s.12). Some records must be kept by law (for example fee records) or by the school as its academic record; we will tell you if that applies. An erased account is anonymised: your name, email and phone are removed, and the records that must be kept are linked only by an internal ID.
- Withdraw consent at any time, as easily as you gave it (s.6(4)). Withdrawing does not affect processing that happened before. Withdrawing consent to school services for a child means the platform cannot be used for that child, and your school will be told.
- Nominate someone to exercise these rights for you if you die or become unable to (s.14).
- Raise a grievance with your school or with us (s.13), and then, if it is not resolved, complain to the Data Protection Board of India.
To use a right, open Privacy in the app (from Profile), choose the kind of request (access, correction, erasure, grievance, nomination or a question about consent), add details and submit. You can track its status there. You can also write to us from Support in the app or to the grievance officer below.
10. Contact us and grievance redressal
If your school has named its own grievance officer, their details are shown in the app under Privacy. Otherwise, or if you prefer, contact GKCodeLabs:
Nishu Chaudhary, Grievance Officer, GKCodeLabs Private Limited
Email: nishu@gkcodelabs.com · Phone: +91-7508115859
Data requests: contact@gkcodelabs.com
Address: Building A, Tower-1, Mahendra Aarna, Sai Sarana Layout, Phase 1, Phase II, Electronic City, Hebbagodi, Karnataka 560100
| Step | Time |
|---|---|
| Acknowledgement | Within 24 hours |
| Resolution of a grievance | Within 15 days of receipt (IT Rules 2021, rule 3(2)) |
| Complaints about content that exposes someone's private area, shows them in sexual content, or impersonates them | Acted on within 24 hours |
| Data-principal rights requests | Within 15 days as a practice, and never later than 90 days (DPDP Rules 2025, rule 14) |
If your grievance is not resolved, you may complain to the Data Protection Board of India through the Board's online process. For content matters under the IT Rules, you may also approach the Grievance Appellate Committee.
11. Changes to this Policy
If we make a material change, such as a new purpose, a new kind of data or a new service provider, you will be asked to review this Policy again the next time you sign in. Minor clarifications are published here with a new version date.