SCOLA is a school management platform developed by Wibits Web Solutions LLP (“SCOLA”, “we”, “us”). Schools use SCOLA to run admissions, academics, attendance, fees, payroll, communication and related work. This policy explains what personal data the SCOLA web and mobile apps process, why, who it is shared with, how long it is kept, and how you can exercise your rights.
This policy covers the SCOLA apps. Our website and its enquiry forms are covered by our website Privacy Policy.
1. Who is responsible for your data
Each school that uses SCOLA decides what data it records about its students, parents, teachers and staff, and why. The school is responsible for that data (under India’s Digital Personal Data Protection Act, 2023, the school is the “Data Fiduciary”). SCOLA processes the data on the school’s behalf and on its instructions, as its service provider.
Each school runs on its own SCOLA installation with its own database. One school’s data is never visible to another school.
If you have a question about data a school holds about you or your child, please contact the school first. You can also contact us (section 12), and we will help the school respond.
2. Who uses the apps
- Scola Central (web): school administrators and office staff.
- Scola TeachHub (web) and SmartTeach: teachers.
- SmartStaff: non-teaching staff.
- Connect: parents and guardians, for information about their own children.
Accounts are created by the school, not by signing up in the app. Children do not create accounts. Where a child’s information appears in an app, the school entered it.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Account and login | Name, phone number, email, role, password (stored only as a one-way hash), login history, failed sign-in attempts | School; you |
| Student records | Name, date of birth, class and section, admission details, photo, parent/guardian details, attendance, leave, marks and report cards, behaviour notes, health and allergy notes the school chooses to record, fees and receipts | School |
| Staff and teacher records | Employment details, attendance and timesheets, leave, payslips, reimbursements and loans | School; you |
| Government identifiers | Aadhaar number and similar IDs, when the school records them. Aadhaar is shown masked (XXXX XXXX 1234) except to school staff specifically authorised to see the full number. | School |
| Communication | Announcements, assignments and submissions, messages, meeting invitations and replies, files you attach | School; you |
| Payments | Fee amounts, payment status and references. Card, UPI and bank details are entered on the payment provider’s page and are not stored by SCOLA. | You; payment provider |
| Device and app data | Push-notification token, app version, device type and operating system, basic app-usage and crash information, IP address in security logs | Your device |
| Admissions | Details submitted in an online admission application | Parent / applicant |
We do not collect your precise location, and we do not use the mobile advertising ID.
Device permissions (mobile apps)
- Notifications: to show school announcements, reminders and alerts.
- Camera, photos and files: only when you choose to take a photo, attach a file, or scan a code. We do not access your gallery in the background.
- Microphone (Connect voice input): only while you use voice typing. The audio is turned into text by your device’s speech service and is not stored by SCOLA.
4. Why we use it
- To provide the school’s services you use: attendance, academics, fees, payroll, library, communication and so on.
- To sign you in securely and protect accounts, for example by temporarily pausing password login after repeated wrong attempts.
- To send notifications, SMS one-time passwords and emails the school or the app needs to send.
- To process online fee payments.
- To provide optional AI assistant features, if the school turns them on (section 5).
- To keep the service secure, reliable and working, and to fix problems.
- To meet legal obligations.
We do not sell personal data, show advertising in the apps, or use school data for marketing.
5. Service providers we share data with
We use a small number of providers, only for the purposes below and under agreements that require them to protect the data:
| Provider | What for | Data involved |
|---|---|---|
| Cloud hosting providers: Amazon Web Services (AWS), Utho and Contabo | Hosting each school’s SCOLA installation, database and files | All app data, stored in data centres in India (Mumbai, Bengaluru and Chennai). A school’s installation is hosted with one of these providers; the school can ask us which one. |
| Contabo (backup storage server) | Backups of each school’s database and files | Backup copies, stored on a Contabo server in Mumbai, India, managed by Wibits Web Solutions LLP |
| Google Firebase (Cloud Messaging, Analytics) | Delivering push notifications; basic app usage and stability statistics | Device token, notification content, app usage events |
| MSG91 | Sending SMS one-time passwords | Phone number, OTP message |
| A2 Hosting (scolaedu.com email server) | Sending emails (password reset, notifications) | Email address, message |
| Razorpay | Online fee payment | Amount, payer name and contact, payment reference |
| OpenAI | AI assistant features in the school’s apps, when the school turns them on | The text of the request and the school records needed to answer it. Under OpenAI’s API terms, this data is not used to train AI models. |
We may also disclose data when Indian law, a court, or a government authority lawfully requires it.
6. How long we keep it
School data is kept while the school uses SCOLA and as the school’s own policies and the law require. SCOLA applies a documented retention schedule that deletes records once they are no longer needed. For example, routine notification logs are kept for 48 hours, failed-login counters for one day, and many academic records for a fixed number of academic years. When a school stops using SCOLA and its installation is terminated, the live installation (its database and files) is removed at termination. A backup of the school’s data is kept for 90 days, so the school can be reactivated or can ask us for a copy of its data during that period. After 90 days the backup is permanently deleted, except where the law requires us to keep a record. Routine daily backups of active schools are kept for a few days and replaced on a rolling basis. We confirm the deletion to the school on request.
7. Deleting your account or data
Because the school creates and manages SCOLA accounts, account and data deletion requests are handled through the school:
- Ask your school’s office to close your account or remove your data (or your child’s data).
- If you can’t reach the school, or it has stopped using SCOLA, email privacy@scolaedu.com from your registered email or phone number. Tell us the school’s name and which account or data you mean.
We will confirm your identity, coordinate with the school, and respond within 30 days. Some records may have to be kept for a period the law or an education board requires (for example fee receipts or certificates). Where that applies, we will tell you what is kept and for how long. Deleting the app from your phone does not delete your account.
8. Children’s data
SCOLA holds children’s information only because their school records it to run the school. The school is responsible for obtaining any consent the law requires from a parent or guardian. Children do not sign up for SCOLA, and the apps show no advertising and do no behavioural tracking. Parents use Connect to see their own children’s information only.
9. Security
We protect data with measures including encrypted connections (HTTPS), a separate installation per school, role-based access set by the school, masking of Aadhaar numbers, hashed passwords, protection against repeated password guessing, protected session cookies on the web apps, screenshot protection on sensitive mobile screens, and activity logging. No system is perfectly secure. If a breach affects a school’s data, we will inform the school without undue delay so it can meet its obligations.
10. Your rights
Subject to applicable law, including the DPDP Act, 2023, you may ask to access, correct, update or erase your personal data, and to nominate someone to act for you. A parent or guardian can make requests for their child. Please contact your school first, or us using the details below.
11. Changes to this policy
We may update this policy as the apps or the law change. We will post the new version here with a new “Last updated” date. For significant changes we will also tell schools.
12. Contact and grievance officer
Wibits Web Solutions LLP
Nagercoil, Kanyakumari, Tamil Nadu, India
Grievance Officer: Raja Chelliah
Email: privacy@scolaedu.com · Phone: +91 8903033859