Last updated: 20 October 2026
EduRit is a school management platform run by Ritik Maurya (Founder & CEO), from Mumbai, Maharashtra 400033. In these pages, "EduRit", "we", and "us" mean Ritik Maurya, trading as EduRit.
This policy explains what personal data EduRit handles, why, who we share it with, how long we keep it, and how you can exercise your rights. It applies to this website (edurit.in) and to the EduRit app each school uses at its own address (for example, yourschool.edurit.in).
When a school uses EduRit, the school decides what records to keep about its students, parents, staff, and visitors, and why. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the school is the Data Fiduciary for those records, and EduRit is its Data Processor: we process them on the school's behalf and under our agreement with the school.
For information you give us directly, such as the contact and demo forms on this website or a school administrator's dealings with us about their account, EduRit is the Data Fiduciary.
Contact form: your name, work email, school name, phone number (optional), the topic you choose, and your message.
Demo form: your name, your role, school name, work email, phone number (optional), the number of students, what your school uses today, and whether you want a demo or a trial.
We use these details only to reply to you, arrange a demo, prepare a quote, or set up your school's trial. You give them to us so that we can do this, which is a legitimate use under the DPDP Act. We will not add you to a newsletter or send you marketing unless you ask us to, and you can ask us at any time to stop contacting you and delete your enquiry.
We keep enquiry details for up to 24 months after our last contact with you, then delete them, unless your school becomes a customer.
Cookies: this website sets no cookies. The school app uses only the cookies needed to keep you signed in. Our hosting provider keeps standard server logs, such as IP address and browser type, to keep the services secure.
Students: name, admission number, date of birth, gender, blood group, photo, address, phone and email, class and section, guardians, attendance and leave, homework and its attachments, exam marks, results and report cards, fee invoices and payments, library loans, transport route and stop, certificates issued, and visits to the school infirmary (the complaint and the treatment given).
Parents and guardians: name, mobile number, email address, occupation, and relationship to the student.
Staff: name, photo, contact details, department, designation, attendance, leave, appraisals, and payroll details such as salary, allowances, deductions, and payslips.
Visitors to the school: name, phone number, purpose of visit, and check-in and check-out times.
Admission applicants: the details entered in the school's enquiry or online admission form, such as the child's name, date of birth, and class applied for, the parent's name and contact details, and entrance-test results.
Account and technical data: login identifiers (email, mobile number, or admission number), password hashes, IP addresses, an audit log of changes made in the school's account, and messages in support tickets.
Of these, passwords, blood group, and infirmary records are sensitive personal data under the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Only to provide EduRit to the school: running its attendance, academics, fees, admissions, library, transport, HR, and front-office work; sending account emails such as login details, temporary passwords for first sign-in, and password resets; answering support tickets; and keeping the service secure.
To resolve a support request, or when a school asks us to, our support staff can view the school's account as one of its users. Each such session is time-limited, needs a recorded reason, and is logged.
We do not sell personal data, use it for advertising, or use one school's data for another school.
Most students are under 18 and are children under the DPDP Act. When the DPDP Rules apply (from 13 May 2027), the school must obtain verifiable consent from a parent or lawful guardian before a child's data is processed, except where the Rules exempt the school, for example for tracking and monitoring done for its educational activities or for children's safety. The same applies to the lawful guardian of a person with a disability.
EduRit does not use children's data for its own purposes, for advertising, or to build profiles. Features such as attendance and the infirmary log are used by the school for its own educational work.
Parents can see their own child's records in the parent login. To access, correct, or erase a child's data, a parent should contact the school, and we will help the school act on the request.
We use a small number of providers to run EduRit, under contracts that require them to protect the data: Vercel (hosting for this website and the school app), Render (application servers), Prisma Postgres (through Vercel) (the database that stores school records), Cloudflare (R2 file storage for uploaded photos, logos, homework attachments, and question papers, kept private and opened only through short-lived links), and Brevo (sending account emails, including temporary passwords for first sign-in, and delivering website enquiries to our inbox).
These providers store or process data outside India, for example in the United States, Europe, or Singapore, as the DPDP Act allows unless the government restricts a country. We transfer data to them only as needed to provide EduRit. We do not share personal data with anyone else, except when the law requires it.
All traffic to EduRit uses HTTPS. Passwords are stored only as secure hashes. Each school's records are kept separate from every other school's, staff and parents see only what their role allows, and changes to records and roles are recorded in an audit log.
If a personal data breach affects a school's records, we will tell the school without delay, so that it can inform the Data Protection Board of India and the people affected, as the DPDP Rules require, and we will report cyber incidents to CERT-In where the law requires.
We keep a school's records for as long as the school uses EduRit. When a school leaves, it can ask us for a copy of its records, which our team prepares in Excel or CSV format within 30 days. We then remove the school's records from our live systems within 90 days of the request, and from backups as they expire, except anything the law requires us to keep.
We keep security logs for at least one year, as the DPDP Rules require.
You can ask for a summary of your personal data and how it is processed; ask for it to be corrected, completed, updated, or erased; withdraw consent you have given, as easily as you gave it; and nominate someone to exercise these rights for you if you die or become unable to. To do any of these, email our Grievance Officer.
For records your school keeps in EduRit, please contact your school first. For anything else, or if you are not satisfied, write to our Grievance Officer at support@edurit.in. We will resolve your request or grievance within 30 days.
From 13 May 2027, if you are not satisfied after using our grievance process, you may complain to the Data Protection Board of India.
You can ask for this policy in Hindi or any other language listed in the Eighth Schedule to the Constitution.
Grievance Officer: Ritik Maurya, support@edurit.in, Mumbai, Maharashtra 400033.
For any other question about this policy, email support@edurit.in.
If we change this policy, we will post the new version here with a new date. If a change is significant, we will also tell school administrators by email or in the dashboard.