Privacy Policy

This policy covers two distinct things, and it is important to know which one applies to you:

• The chalkpis.com website — if you are a visitor filling in the Contact form, this section governs the limited enquiry data you submit to us directly.
• The ChalkPis platform — if you are a student, parent, guardian, teacher, or staff member whose school uses ChalkPis, this section governs how student, staff, and parent data is processed inside the product.

Where the two differ, each section below says which one it applies to. This policy does not replace the written service agreement (and any Data Processing Agreement) between M2W Technologies and a Customer School; where the two conflict for a specific school, the signed agreement governs.

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the entity that decides why and how personal data is processed is called the Data Fiduciary, and an entity that processes data on the Fiduciary's behalf is called a Data Processor.

For data inside the ChalkPis platform, your school is the Data Fiduciary. Your school decides what student, staff, and parent data to collect, obtains any consent required from parents or guardians, and is your first point of contact for questions about how that data is used.

M2W Technologies acts as the Data Processor: we process data only on your school's instructions, under a service agreement with that school, and we do not use student, staff, or parent data for our own independent purposes such as advertising or building profiles for sale.

The only personal information we collect through chalkpis.com is what you submit through the Contact form:

• Your name, phone number, and email address
• Your school's name
• Number of students and school board (optional)
• Any message you choose to include

We do not currently use cookies, analytics, or tracking technologies on this website. Our hosting provider may automatically log basic technical information (such as IP address, browser type, and access times) for security and operational purposes, as is standard practice for most web hosting. We use this enquiry data to respond to you, follow up about ChalkPis, and keep internal records. We do not sell or rent it to third parties.

What a Customer School enters or generates in ChalkPis depends on which modules it uses. This can include:

• Student data: name, date of birth, class and section, roll number, admission details, academic records, examination results, and report cards
• Attendance data: daily and period-wise attendance, which may include GPS location and biometric verification (such as face or fingerprint matching) at the point the attendance is marked, where the school has enabled these features
• Fee and payment data: fee structure, dues, and payment history. Card, UPI, and net banking details themselves are collected and processed directly by our payment gateway partners (see "Who we share data with"), not stored by ChalkPis
• Staff and HR data: employee profiles, qualifications, attendance, leave records, and payroll information
• Parent and guardian data: name, contact details, and relationship to the student, used for the Parent App and school communication
• Transport data: live GPS location of school transport, where a school uses the transport module
• Communication content: messages, announcements, and notifications sent through the platform via SMS, WhatsApp, push notification, or in-app messaging

Some of these are "sensitive personal data" by nature, particularly biometric data and precise location data. We process these only where a Customer School has enabled the relevant feature, and only for the stated purpose (verifying attendance, tracking a school bus) — not for any secondary use.

Much of the data inside ChalkPis belongs to students who are children under the DPDP Act. The Act requires verifiable consent from a parent or lawful guardian before a child's personal data is processed, and prohibits tracking, behavioural monitoring, or targeted advertising directed at children.

Because your school is the Data Fiduciary, your school is responsible for obtaining the consent required for its students' data, typically as part of admission or enrollment. M2W Technologies does not independently collect this consent, and does not use student data to track, profile, or advertise to children for any purpose outside what the school has instructed.

Data inside the ChalkPis platform is processed to:

• Perform the service agreement between M2W Technologies and your school
• Carry out the specific school administration functions the school has enabled (attendance, fees, examinations, communication, and so on)
• Meet legal or regulatory obligations that apply to schools, where relevant

Website enquiry data is processed based on your consent when you submit the Contact form.

Data enters the ChalkPis platform through:

• Manual entry or bulk import by school administrators
• Direct use of the product by teachers, parents, and students (for example, marking attendance, or a parent updating their own contact details)
• Device-level capture at the moment of use, for features like GPS-verified or biometric attendance and live bus tracking

ChalkPis data is currently hosted on servers we operate ourselves, located in India. We use role-based access control so that admins, teachers, and parents can each see only the data relevant to their role, and we take reasonable technical and organisational measures to protect data against unauthorised access, loss, or misuse.

We are not publishing specific uptime, encryption, or certification claims on this page until they are independently verified — see the Security page for what is currently confirmed, and treat anything not stated there as not yet verified.

We do not sell personal data. We share data only as needed to run the platform:

• Payment gateways (such as Razorpay and PhonePe) to process fee payments — they receive payment details directly and handle them under their own compliance obligations
• Messaging providers (such as WhatsApp Business, and SMS gateway providers) to deliver notifications, alerts, and communications you or your school have requested
• Your school, which as Data Fiduciary can access the data its own staff, students, and parents have entered
• Law enforcement or regulators, where required by law

We do not have a complete published list of every sub-processor on this page yet; a full, up-to-date list is available on request from your school's account contact or by emailing us directly.

As of today, our footprint is India only: ChalkPis's own servers are located in India, and student, staff, and parent data is not transferred outside India by us as a matter of course. Some third-party services we rely on for specific features, such as WhatsApp messaging, may process data outside India as part of how that service works globally; we use such services only where necessary for the feature they provide.

We are planning to expand into the EU. When we do, personal data belonging to EU-based schools and users will be hosted within the EU, kept separate from India-hosted data, and this policy will be updated with our full GDPR compliance details before that data is processed. Nothing in this section describes a current EU operation; it is a stated commitment for when one exists.

We retain platform data for as long as your school's account with ChalkPis is active, so the service keeps working correctly (report cards, historical attendance, and fee records typically need to remain available across academic years).

When a school's agreement with us ends, we delete or anonymise that school's data within the period set out in the service agreement with that school. Website enquiry data is retained for as long as necessary to respond to the enquiry and keep basic business records, and can be deleted on request at any time.

Under the DPDP Act, you (or a parent/guardian acting for a child) have the right to:

• Access a summary of the personal data being processed about you
• Correct inaccurate or incomplete data
• Request erasure of your data, where it is no longer needed for the purpose it was collected
• Withdraw consent, where processing is based on consent
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
• Register a grievance about how your data has been handled

For platform data, please raise requests with your school first, since your school controls the underlying record as Data Fiduciary; we assist schools in fulfilling verified requests. For website enquiry data, or if your school is unable to assist, contact us directly at hello@chalkpis.com.