Privacy Policy

CircleUp (“we”, “us”) operates a school and college communication platform connecting parents, teachers, students and administrators. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it.

This policy covers all users of the CircleUp web app and any related services. It is written to comply with India's Digital Personal Data Protection (DPDP) Act 2023, the United States Children's Online Privacy Protection Act (COPPA), and the European Union's General Data Protection Regulation (GDPR).

We follow a strict data-minimisation principle: we only collect information that is strictly necessary for the app to function.

• All users: Full name, email address, role (parent / teacher / student / admin), and the name of your school, college or institution.
• Optional: Mobile phone number (used only for two-factor authentication and critical alerts — never for marketing without a separate, explicit opt-in).
• Students: Grade or year of study, roll number or student ID (only when pre-loaded by the institution), and academic activity within the app (homework submissions, attendance records, forum posts).
• Parents: The relationship link to your child's account, and your consent timestamp and IP address (required by law as an audit trail).
• What we do NOT collect: Home addresses, dates of birth, government ID numbers, financial account details, precise GPS location, or any biometric data.

Uploaded files (homework, profile pictures) have EXIF metadata automatically stripped on our servers before storage.

We use personal data solely to provide school and college communication services:

• Delivering announcements, homework updates and attendance records to the right people.
• Enabling secure parent–teacher communication threads.
• Sending transactional notifications (e.g. new message, fee due).
• Providing institution administrators with aggregated, anonymised analytics.

We never use your data to serve advertising, build behavioural profiles, or sell to third parties — under any circumstances.

This section is the most important part of our Privacy Policy.

Under India's DPDP Act, anyone under 18 is legally a child. Under COPPA, the threshold is 13. CircleUp applies the stricter 18-year rule for all users.

• Verifiable Parental Consent is required before a student account becomes active. We implement this via an OTP sent directly to the parent's registered mobile or email. The student account remains locked until the parent completes this step.
• No tracking or profiling. We are legally prohibited from — and technically do not — track children's behaviour, create interest profiles, or serve targeted content to students.
• No third-party SDKs on student surfaces. Analytics and crash-reporting tools that could automatically collect device identifiers are disabled for all parts of the app accessible to students under 18.
• Institution-led consent (Option A): If a school or college has already obtained parental consent via physical forms, the admin can pre-upload the student roster and mark consent as institution-verified.

When a school or college signs up, it enters into a formal Service Agreement with CircleUp:

• The institution is the Data Fiduciary — it is responsible for the lawful basis of collecting student and teacher data.
• CircleUp is the Data Processor — we act strictly on the institution's documented instructions and may not use that data for any other purpose.
• The institution contract explicitly prohibits us from using student data for advertising, profiling, or any purpose beyond operating the institution's communication services.

• In transit: Hosted deployments must use HTTPS. The local Docker environment uses HTTP on the loopback interface.
• At rest: Storage encryption and backup protection depend on the hosting configuration. The application does not encrypt individual database fields.
• Messages: Messages are stored on the server and are accessible to school administrators. End-to-end encryption is not implemented.
• Access control: APIs check account roles, school assignments, and record ownership.

Schools manage their deployment's data retention and backups:

• Account deletion and export requests are submitted to school administrators for processing.
• Automated deletion of graduated students, uploaded media, and backup copies is not implemented.
• Contact your school for its retention schedule and the status of a submitted request.

You (and parents on behalf of their children) have the right to:

• Access — request a copy of personal data.
• Correct — update inaccurate data.
• Erase — request immediate deletion from Settings → Your Data.
• Withdraw consent — parents can withdraw consent at any time.
• Portability — download a machine-readable export from Settings.

We respond to requests within 72 hours and complete them within 30 days.

CircleUp does not share personal data with advertisers, data brokers, or social networks. We use limited infrastructure providers:

• Cloud hosting and database providers bound by strict data-processing agreements.
• Email delivery providers used only for transactional notifications.

Third-party SDKs collecting device identifiers are disabled on all student surfaces.

We may update this policy when laws change. Material changes are notified at least 14 days in advance via the app.

For privacy questions, contact us via the contact page or email privacy@circleup.app with subject line “Data Rights Request”.