Stored in India
School data is stored on Amazon Web Services in Mumbai, India. It leaves India only to the listed sub-processors, for the listed purposes.
Security and privacy
School data security, built for the DPDP Act
Schools trust GKC EdVance with information about children and their families. This page sets out how that data is protected, where it is stored, and how the platform meets the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
How school data is protected
Encrypted
Data is encrypted at rest and in transit.
Isolated per school
Each school’s data is isolated from every other school’s at the database level.
Role-scoped access
Teachers, school admins, parents and students each see only the school, class or child their role permits.
Passwordless sign-in
Sign-in uses time-limited one-time codes instead of passwords, so there are no passwords to reuse or leak.
Every access logged
Access to personal data is logged, and the logs are kept in India for at least one year. The school can ask for them.
Monitored and backed up
The platform is monitored with alerting, backed up daily, and covered by a tested incident-response procedure.
Confidentiality
Staff with access to school data accept a confidentiality undertaking.
How the school and GKCodeLabs work together
The school stays in charge of its records; GKCodeLabs runs the platform for it under a written agreement, as the DPDP Act sets out.
- The school decides how its records are used, as it does today. Under the DPDP Act this makes it the Data Fiduciary.
- GKCodeLabs Private Limited runs the platform for the school and uses data only on the school’s instructions, under the data processing terms for schools. This makes it the school’s Data Processor.
- Parents give verifiable consent for their children, confirmed by a one-time code sent to the contact details in the school’s admission records.
Children’s data is never used for advertising
Children’s data is never used for advertising, never used to build behavioural profiles, and never used to track children across websites or apps, as section 9(3) of the DPDP Act requires. The platform has no analytics or advertising software. Personal data is not sold.
If something goes wrong
- GKCodeLabs tells the school about a personal-data breach within 24 hours of becoming aware of it.
- It helps the school notify the Data Protection Board of India and affected families, and file the detailed report due within 72 hours.
- Cyber-security incidents are reported to CERT-In within 6 hours where the CERT-In Directions require it.
Retention and deletion
- Records are kept while a student is enrolled, and afterwards for the period the school sets. Fee records are kept as long as tax law requires.
- AI assistant conversations are kept for 90 days, and sign-in codes for 24 hours.
- When a school stops using GKC EdVance, its data is available for export for 30 days and then deleted, including from backups, within 90 days.
Rights and grievances
Parents, students and staff can see a summary of their data, correct it, ask for it to be erased, withdraw consent and nominate someone, from Privacy in the app. Requests are acknowledged within 24 hours and resolved within 15 days. See contact and grievance redressal.
The documents
The binding commitments are in the Privacy Policy, including its list of service providers, and the Terms of Service, including the data processing terms for schools. Both are on the legal page.
A better school day starts here
Start your free trial.
Try GKC EdVance free for 30 days. We walk you through the modules that matter to you and set your school up for you.
Start free trial 30-day free trialLog in