1. Who We Are

OlakhSetu ("we", "us", "our") is a multi-institute ID card generation SaaS platform developed and operated by Sundigit, based in India. We provide digital tools to schools, colleges, coaching institutes, and companies for managing student/employee identity records and generating bulk print-ready ID cards.

This Privacy Charter explains our practices regarding the personal information we collect through our platform at olakhsetu.in and any associated sub-domains, APIs, or mobile interfaces.

2. Data We Collect

We collect data in two categories: data provided by institute administrators, and data generated automatically during platform use.

2.1 Institute & Account Data

Institute name, type (school/college/company), address, and contact number
Admin user name, email address, and hashed password
Plan selection and billing information (processed via third-party payment gateways; we do not store raw card numbers)
Institute logo uploaded for ID card branding

2.2 Student / Employee Records

All student and employee data entered into OlakhSetu is owned by the institute. We act as a data processor, not a data controller, for this information. This may include:

Full name, date of birth, blood group, mobile number, email, address
PRN / Roll Number, enrollment number, class, department, academic year
Aadhar number (stored encrypted; only displayed on card if institute enables it)
Student/employee photographs uploaded via bulk ZIP or individual upload
Custom fields defined by the institute

2.3 Automatically Collected Data

IP address, browser type, and device information for session management
Platform usage logs (login time, pages visited, actions taken) for debugging and performance monitoring
Queue and job processing logs for bulk PDF generation

3. How We Use Your Data

We use collected data exclusively to:

Operate and deliver the OlakhSetu platform and its features
Generate ID cards and bulk PDFs as instructed by your institute
Enforce plan limits (student count, template count) per your subscription
Send transactional emails (account creation, plan expiry reminders, password resets)
Diagnose errors, improve performance, and maintain platform security
Comply with applicable Indian laws and regulatory requirements

We never use your student/employee data for marketing, profiling, advertising, or any purpose beyond direct platform operation.

4. Data Storage & Security

All data is stored in a single encrypted MySQL database hosted on secured Indian servers. Each institute's data is logically isolated using a multi-tenant architecture — no institute can access another's records.

Passwords are hashed using bcrypt and are never stored in plain text
Aadhar numbers are stored with additional encryption at the application layer
Student photos are stored in a private, non-publicly-accessible storage partition and served via authenticated URLs
All data in transit is protected via HTTPS / TLS 1.2+
Redis cache is used for temporary session and queue data only — no personal records are persisted in cache
Regular automated backups are performed and stored securely

While we implement industry-standard security measures, no system is 100% immune to breach. In the event of a data incident affecting your institute, we will notify you within 72 hours of discovery as required under applicable law.

We do not sell, rent, or trade your data or your students' data to any third party. Data may be shared only in the following limited circumstances:

Hosting infrastructure providers — our server/hosting provider has access to the physical infrastructure but operates under strict data processing agreements
Payment gateways — billing transactions are processed by third-party gateways (e.g., Razorpay); we share only the minimum required data for transaction processing
Legal compliance — we may disclose data if required by a valid court order, government directive, or applicable Indian law

6. Cookies & Tracking

OlakhSetu uses a minimal set of cookies strictly necessary for platform operation:

Session cookies — to maintain your logged-in state; expire on browser close or after inactivity
CSRF tokens — to protect form submissions from cross-site request forgery attacks
Preference cookies — to remember UI preferences (e.g., selected template)

We do not use third-party advertising cookies, tracking pixels, Facebook Pixel, Google Analytics behavioural tracking, or any third-party profiling cookies on the authenticated institute panel.

7. Your Rights

Under India's Digital Personal Data Protection (DPDP) Act, 2023, and applicable privacy principles, institutes and their data subjects have the right to:

Access — request a copy of all personal data held by OlakhSetu relating to your institute
Correction — request correction of any inaccurate or incomplete data
Erasure — request deletion of your institute account and all associated data (subject to retention obligations below)
Portability — export your complete student data as an Excel/CSV file at any time from your institute panel
Grievance — raise a complaint with our Data Protection Officer (details in Section 11)

To exercise any of these rights, contact us at privacy@olakhsetu.in. We will respond within 30 days.

8. Data Retention

Active institute data is retained for the duration of your subscription and for 90 days after plan expiry (grace period for renewal)
Upon account deletion request, all personal data is permanently purged within 30 days, except where retention is required by law (e.g., billing records retained for 7 years per Indian accounting standards)
System logs (non-personal) are retained for up to 12 months for security and debugging purposes

9. Children's Privacy

OlakhSetu serves institutes that manage student records, which may include minors. All student data is entered and managed by the institute administrator acting as the responsible party on behalf of the educational institution. Institutes are responsible for obtaining any parental or guardian consent required under applicable law before entering minor students' data into the platform.

OlakhSetu does not directly solicit or collect personal information from individuals under 18 years of age.

10. Changes to This Charter

We may update this Privacy Charter periodically to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify institute admins by email at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance of the updated charter.

11. Contact Our Data Protection Officer

For any privacy-related queries, data access requests, or complaints, contact:

Privacy Charter