When an institution registers on Kiteum Edu, we collect institution-level information including institution name, type (school, college, or coaching centre), year of establishment, email address, phone number, physical address, and logo.

Most personal data about students and staff is uploaded directly by the institution administrator — not by the individual themselves. This includes names, roles, dates of birth, photographs, identity documents, marksheets, fee records, admission documents, and contact details. The institution is responsible for ensuring this data is accurate and lawfully obtained before uploading it to the Platform.

Through use of the Platform, additional data is generated including attendance records marked by teachers, examination schedules and results entered by administrators, fee payment records, class and subject assignments, and communication logs between users and the AI chatbot.

We also collect technical usage data including IP addresses, browser type, device information, pages visited, features used, and session duration, to operate, secure, and improve the Platform.

To provide and operate the Platform: powering all core features including admissions management, attendance tracking, examination management, fee collection, staff and student record management, and AI-powered tools.

To enable the AI chatbot to respond to queries from students, parents, and staff, and to generate automated documents, notices, and reports requested by institution administrators.

To send transactional communications including account verification, fee payment receipts, exam result notifications, attendance alerts, and support responses.

To improve the Platform: analysing aggregated, anonymised usage patterns to identify bugs, improve features, and develop new capabilities. We do not use individually identifiable student data to train AI models without explicit institutional consent.

To comply with applicable laws, respond to lawful requests from authorities, and enforce our Terms of Service.

All institutional data — including student records, staff records, academic data, fee records, attendance records, uploaded documents, photographs, and marksheets — remains the exclusive property of the respective institution.

Kiteum does not claim any ownership over data submitted by institutions or generated through institutional use of the Platform. We process this data solely as a data processor acting on the institution's instructions.

Institutions are responsible for ensuring that the data they upload about students and staff is accurate, complete, and lawfully obtained prior to uploading it to the Platform. Kiteum handles the consent process directly with each individual after the data is uploaded.

Kiteum Edu processes personal data on the legal basis of consent under the Digital Personal Data Protection Act, 2023 (India). In most cases, a student or staff member's data — including their name, photograph, marksheets, documents, and contact details — is uploaded by the institution administrator before the individual ever logs in. Kiteum automatically sends a consent request to that individual (or to their parent/guardian if they are a minor under 18) so they can review what has been uploaded and decide whether to consent before their account is activated.

The consent page shows the individual exactly what data the institution has uploaded about them, how it will be used, and what rights they have. An account is not activated until consent is given. Consent records — including who consented, the date and time, and the IP address — are stored and can be produced on request.

For students under 18 years of age, consent must be given by a parent or legal guardian. Institutions are required to provide a valid parent/guardian contact (email or phone) when adding a minor to the Platform. Kiteum will send the consent request to the guardian, not the minor.

Pending Consent: In cases where a user never responds to the consent request — for example, a young student without a personal email, or a user with an incorrect contact on record — the account remains in a 'Consent Pending' state. The institution administrator can still manage that individual's records (attendance, fees, examination data) through the Platform during this period. However, by continuing to use the Platform to process that individual's data without confirmed consent, the institution accepts full legal responsibility for that data usage and agrees to indemnify Kiteum against any legal claims arising from the absence of confirmed consent.

Kiteum's dashboard clearly marks all accounts with a 'Consent Pending' status so institutions are always aware of which users have not yet confirmed consent. Institutions are strongly advised to resolve pending consents by verifying and updating contact details, or by collecting physical written consent and uploading a record of it.

Any individual may withdraw their consent at any time by contacting their institution administrator or by emailing support@kiteum.com. Withdrawal of consent will result in account deactivation. The actual deletion of personal records must be requested from and carried out by the institution — not Kiteum. Kiteum will action deletion requests only when instructed to do so by the institution.

Kiteum may continue to retain limited data after consent withdrawal where required by a legal obligation — for example, financial transaction records required under applicable tax or accounting law. In all other cases, data will be deleted in accordance with the institution's instructions.

Kiteum implements industry-standard security measures to protect data stored on the Platform, including encryption of data in transit (TLS/HTTPS) and at rest, secure access controls, regular security assessments, and activity logging.

Access to institution data is restricted to authorised Kiteum personnel on a need-to-know basis, and to the institution's own authorised users. Kiteum staff do not access institution data except where required for support, maintenance, or legal compliance.

In the event of a data breach that affects institution or student data, Kiteum will notify affected institutions without undue delay and will cooperate with institutions and, where required, regulatory authorities in responding to the breach.

Institutions are responsible for maintaining the security of their own user accounts, including enforcing strong passwords and promptly removing access for former staff or students.

Kiteum retains institution and user data for as long as the institution's account is active. Following subscription cancellation or termination, data is retained for 60 days to allow institutions to export their data.

After the 60-day retention period, institution data is permanently deleted from Kiteum's active systems. Backups may retain data for a further period in accordance with our backup rotation schedule.

Institutions may request the deletion of specific data records (e.g., a student's personal records) by contacting support. Individual users (students, staff, parents) who wish to have their data deleted must make that request to their institution administrator — the institution is the data controller and holds the authority to instruct Kiteum to delete specific records. Kiteum will action deletion instructions received from institutions within a reasonable timeframe, subject to legal obligations to retain certain records.

Kiteum does not sell institution or student data to third parties. We do not share personal data with advertisers or use personal data for any purpose unrelated to providing and improving the Platform.

We share data with third-party service providers only where necessary to operate the Platform, including cloud infrastructure providers, payment processors, and email delivery services. All third-party providers are bound by confidentiality obligations and are not permitted to use data for their own purposes.

Kiteum may disclose data where required by applicable law, court order, or lawful government request. Where permitted by law, Kiteum will notify the affected institution before complying with such a request.

The Platform's AI chatbot processes queries submitted by students, parents, and staff to generate responses. Conversation data may be retained to improve response quality and to provide context within an active session.

AI-assisted document and report generation uses institution data (such as student records and attendance data) only as directed by authorised institution administrators. Generated documents are stored within the institution's account and are subject to the same data protections as other institution data.

Kiteum does not use personally identifiable student data to train general-purpose AI models without explicit, written consent from the institution.

Kiteum's primary infrastructure is hosted within India. Where third-party service providers process data outside India (for example, cloud infrastructure providers), Kiteum ensures that appropriate safeguards are in place in accordance with applicable Indian data protection law.

By using the Platform, institutions acknowledge that data may be processed in countries other than India, and consent to such processing where necessary to provide the Platform services.

For privacy-related questions, data export requests, data deletion requests, or concerns about how Kiteum handles personal data, institutions and users may contact us at support@kiteum.com or through edu.kiteum.com/contact.

Institutions acting as data controllers may submit formal data subject access requests on behalf of students or staff. Kiteum will respond to such requests within 30 days.

If you believe Kiteum has not addressed a privacy concern adequately, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.