Privacy Policy

Effective date: This Privacy Policy is effective as of 17 April 2026.

About this policy

ROLLNO31 is an educational platform operated for Indian educational institutions. This policy explains what personal data we collect, how we use it, how we protect it, and what rights you have over it.

The legal framework for this policy is India's Digital Personal Data Protection Act, 2023 (DPDP Act). Under the DPDP Act, you are a Data Principal — the person whose information we collect. We are a Data Fiduciary — the organisation responsible for deciding how that information is used. This policy applies to everyone who registers on ROLLNO31: students, teachers, administrative staff, trustees, and institutions.

Data we collect

Identity data: Full name, date of birth, gender
Profile photo (optional — you choose whether to upload one)
Contact data: Email address, phone number, postal address
Institution data: Institution name, your role (student, teacher, admin), department, batch, roll number, staff title
Academic data (students only): CGPA, backlogs, attendance records, assignment submissions, grades, certifications you upload
Usage data: Pages visited, features used, timestamps, device type, browser — collected automatically when you use the platform to help us fix problems and improve performance
Content you create: Messages, forum posts, comments, assignment submissions, files you upload
Parental data (users under 18 only): Parent or guardian name, contact number, email address, and their relationship to you — required for verifiable parental consent under Section 9 of the DPDP Act before we process data for a minor

We do not collect your Aadhaar number, PAN, or any government-issued identity document unless you choose to upload one as part of a certification or record.

How we use your data

To create and manage your account, authenticate you, and control what you can access
To run institution workflows: attendance, grading, assignments, classroom messaging, notices
To personalise your dashboard and surface content relevant to your role and institution
To send you notifications about platform activity, your institution's announcements, and platform updates
To respond to support requests
To comply with legal obligations — tax, audit, and requests from authorised regulators or courts
To detect and prevent fraud, abuse, or security incidents
To improve the platform using anonymised, aggregated analytics — no individual user is identified in this analysis

The short answer: we do not sell your data. We do not share it with advertisers. We do not share it with third parties for their own purposes.

We share it only in these specific situations:

With your institution

Your school, college, or university can see the data you create and generate on their platform instance — for example, attendance, grades, and submissions. This is necessary for the platform to work. Your institution is also bound by the DPDP Act in how they use this data.

With our service providers

We use the following third-party services to run the platform. Each is bound by a data processing agreement that requires DPDP Act-standard protections:

Supabase — database hosting (Mumbai region, ap-south-1 — your data stays in India)
Anthropic — AI features within the platform (e.g., cognitive companion features)

No other service providers receive your personal data.

With legal authorities

If a court order, law enforcement request, or authorised Indian regulator requires us to produce data, we will comply. We will notify you where we are legally permitted to do so.

Your rights under the DPDP Act

The Digital Personal Data Protection Act, 2023 gives you the following rights. To exercise any of them, email privacy@rollno31.com with your registered email address and a description of your request.

Right to access — You can request a summary of the personal data we hold about you and how we are using it.
Right to correction and erasure — You can update incorrect data through your profile settings. For data you cannot edit yourself, or to request complete erasure of your account, email us.
Right to grievance redressal — You can raise a complaint with our Data Protection Officer (contact details below). If your complaint is not resolved to your satisfaction within 30 days, you may approach the Data Protection Board of India under Section 27 of the DPDP Act.
Right to nominate — You can nominate another person — a family member, for example — to exercise these rights on your behalf if you are incapacitated or unavailable.
Right to withdraw consent — You can withdraw your consent to data processing at any time. Note: if you withdraw consent, we may not be able to provide some or all platform services to you.

If you are under 18, a parent or legal guardian must give verifiable consent before we process your personal data. This is a requirement of Section 9 of the DPDP Act. Your institution manages parental consent during the student registration process. We do not profile minors, and we do not track them for advertising purposes of any kind. If you have questions about how parental consent was obtained for your account, contact your institution's admin or email privacy@rollno31.com.

Data retention

We retain your personal data for as long as your institution actively uses ROLLNO31, plus 6 years after that period ends. This retention period covers our legal obligations for academic records.

After that window, we delete or anonymise the data so it can no longer be linked to you.

You can request deletion before that period ends by writing to privacy@rollno31.com. We will honour the request unless we are legally required to retain specific records — for example, if your data is part of an ongoing audit or legal proceeding.

Data security

We protect your data using industry-standard measures:

Encryption in transit: TLS 1.3 for all connections between your device and our servers
Encryption at rest: AES-256 for all data stored in our database
Role-based access control: staff see only data relevant to their role; no one at ROLLNO31 accesses individual user data except when required for support or a legal obligation
Regular security reviews conducted by our engineering team

Our database is hosted on Supabase in the Mumbai region (ap-south-1). Your data is stored in India.

Changes to this policy

We may update this policy. We will email you at least 14 days before a material change takes effect.

Contact — Data Protection Officer

To exercise your rights, raise a complaint, or ask a question about this policy, contact our Data Protection Officer (DPO):

Name:: Macha Praveen
Email:: dpo@rollno31.com
Address:: 4-6/12 Usha Towers, Gangaraju Nagar, Valasapakala, Kakinada, East Godavari, Andhra Pradesh 533005, India

For general support queries unrelated to privacy, email support@rollno31.com.

Back to home