Privacy Policy

1. Introduction & Statutory Data Roles

Cron[X] OS Technologies Private Limited ("Cron[X] OS", "We", "Us", or "Our") provides a cloud-based multi-tenant School Operating System designed for educational institutions (K-12 schools, junior colleges, higher education institutes, and academies).

Statutory Data Roles under DPDP Act 2023: The Client School acts as the primary Data Fiduciary responsible for establishing legal grounds and obtaining valid parental consents. Cron[X] OS operates as the designated Data Processor carrying out operations strictly pursuant to institutional directives.

2. Compliance & Indian Data Residency

Cron[X] OS is designed and operated in strict compliance with applicable privacy laws:

• Digital Personal Data Protection (DPDP) Act, 2023 (Republic of India)
• Information Technology Act, 2000 & SPDI Rules, 2011
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• COPPA Principles for child data safety in educational applications.

Data Residency Guarantee: All primary databases, backups, media files, and application data for Indian educational institutions are stored exclusively in managed, secure cloud servers located within the Republic of India (Mumbai Region).

3. Information We Collect

We collect data necessary to fulfill school administrative functions:

4. Fee Payments & Financial Security

Online fee payments are processed via PCI-DSS compliant third-party payment gateways (such as Razorpay). Cron[X] OS collects transaction IDs, payment status (Success/Pending), payment mode (UPI, card, mandate), and date.

Cron[X] OS never stores raw credit/debit card numbers, CVVs, PINs, or NetBanking passwords on Our servers. All fee refunds, chargebacks, and payment disputes remain strictly between the parent and the Client School.

5. Data Sharing & Verified Sub-Processors

Data is shared only with verified infrastructure partners to operate the platform:

• Cloud Infrastructure: Fly.io (Mumbai Region) & Managed Postgres (India).
• Cloud File Storage: Cloudflare R2 (Encrypted documents & report cards).
• Payment Gateway: Razorpay (PCI-DSS compliant fee processing).
• Messaging API: Meta WhatsApp Business Cloud API & MSG91 (Attendance & fee alerts).
• Voice AI Processing: Sarvam AI (Indian-language voice transcription for teachers).

6. Voice AI & Messaging Disclaimers

WhatsApp Messaging: Notifications rely on Meta WhatsApp APIs and telecommunication networks. Cron[X] OS is not liable for non-delivery resulting from incorrect numbers, network outages, or recipient privacy/blocking settings.

Voice & AI Feature Verification: AI voice transcription and regional language translation features (powered by Sarvam AI) are provided to assist educators. School staff must review and verify all critical academic notices before official dispatch.

7. Retention, Student Transfer & Deletion

Active Accounts: Retained during the school's active subscription term.

Student Transfer / TC Rule: When a student leaves an institution, account deletion or archiving is initiated by the school office upon issuance of an official Transfer Certificate (TC).

Expired Subscriptions: Inactive school data is archived for 90 days to permit data export, after which it is permanently purged or anonymized.

8. Data Security & Audit Logs

We enforce row-level tenant security, TLS 1.3 encryption in transit, AES-256 encryption at rest, and strict Role-Based Access Controls (RBAC) to ensure complete data isolation between schools. Audit trails record student profile reads, mark publications, and fee entries for trustee oversight.

9. Grievance Redressal Officer

In accordance with the IT Act 2000 and DPDP Act 2023, You may contact Our Grievance Officer regarding any privacy inquiries or concerns: