Privacy-policy

Version 1 · Last updated: 19 October 2026

1. About this policy

This Privacy Policy explains how Menace Techdost Services Private Limited ("Vedmarg", "we", "us", "our") collects, uses, shares and protects personal data. It applies to:

• our website, www.vedmarg.com;
• the Vedmarg school ERP web panel, account.vedmarg.com;
• the Vedmarg mobile apps on Android and iOS, including the Vedmarg School app and the Vedmarg Students & Teachers app;
• apps that Institutions publish under their own name using Vedmarg; and
• our sales, support and other related services

(together, the "Services").

This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act"). Please read it together with our Terms & Conditions, Cookie Policy and Data Security page.

To read this policy in Hindi, write to us at [email protected] and we will send you a Hindi version.

2. Our role and your Institution's role

Records an Institution keeps in Vedmarg. When an Institution uses Vedmarg, it adds information about its students, parents or guardians and staff, and decides how that information is used. For this data the Institution is the Data Fiduciary and Vedmarg is a Data Processor: we process it only to provide the Services to the Institution, under our agreement with it and on its instructions.

Data we decide about. We are the Data Fiduciary for:

• visitors to our website;
• people who contact us or request a demo;
• school and business contacts we reach out to;
• the account and billing details of Institutions that sign up with us; and
• information about how the Services are used.

If you are a student, parent or staff member, your Institution's own privacy notice also applies to you. Questions about why your Institution records certain information are best sent to your Institution.

3. Personal data we collect

3.1 When you visit our website or contact us

• Details you give us when you request a demo, fill in a contact or sign-up form, chat with us on WhatsApp, call or email us, post a comment, or apply to become a partner: for example your name, mobile number, email address, designation and Institution.
• When you buy a plan or pay online: your billing name, billing address and GST details, and the payment status we receive from the payment gateway.
• If you apply for a job with us: the details and documents in your application.

3.2 School and business contacts

To tell Institutions about Vedmarg, we may collect business contact details of schools and their representatives from:

• publicly available sources, such as school directories, affiliation lists, maps and listings, and social media pages;
• lead forms you submit on Facebook or Instagram, which Meta shares with us; and
• partners and third parties that provide us with business leads.

You can ask us to stop contacting you at any time (see Your rights and choices).

3.3 When an Institution signs up

• Name, mobile number (verified by OTP), email address, username and password. Passwords are stored only in hashed form, so we cannot read them.
• Institution name and address, GST and billing details, the plan and add-ons purchased, and an approximate region worked out from the IP address used to sign up.
• Your Institution's logo. We show customer logos on our website or marketing material only with the Institution's permission.

3.4 Records an Institution keeps in Vedmarg

What is recorded depends on the modules the Institution uses and the fields it fills in. It can include:

• Students: name, photograph, date of birth, gender, admission and roll number, class and section, address, category and religion, Aadhaar number (where the Institution chooses to record it), previous school details and documents uploaded by the Institution.
• Parents and guardians: names, mobile numbers, email addresses, address, and occupation, qualification or income where the Institution records them.
• Staff: personal and contact details, qualifications, employment details, attendance and leave, salary and payroll records, and bank account details used for salary.
• Academic records: attendance, homework, timetables, exam marks, marksheets and report cards, online test responses, certificates and ID cards.
• Fees and finance: fee structures, concessions, dues, receipts and payment history, and the Institution's income and expense records.
• Admissions and enquiries: details submitted through admission and enquiry forms.
• Other modules: transport routes and stops, driver details, library, inventory, tasks and similar records.
• Communications: notices, messages, SMS and WhatsApp messages sent through Vedmarg, chats, complaints and feedback.

3.5 Attendance devices and location

• Biometric attendance: we receive punch records from the Institution's attendance devices: the device user code, date and time, punch direction, verification method and, if the device captures one, an attendance photo. Fingerprint and face templates stay on the device; we do not receive or store them.
• Location-based attendance: if an Institution turns on location attendance for a staff member, the app records, at the moment the staff member punches in or out:
  • the location (latitude, longitude and accuracy);
  • whether a mock location was detected; and
  • device and network details.
  We do not track location in the background.

3.6 Payments

Card, UPI and net-banking details are entered on the payment gateway's own page or app screen. We receive the transaction reference, amount, status and payment method type. We never receive or store full card numbers, card expiry dates, CVV, UPI PIN or net-banking passwords.

3.7 Live classes

If your Institution uses live classes, audio and video are streamed in real time to the participants. Classes are recorded only if the Institution turns recording on. We keep live-class attendance (who joined and for how long).

3.8 Support, demos and calls

• Support tickets, issue reports (including screenshots or files you attach and the page you were on), feedback and survey responses.
• If you sign in to a demo account: your name, designation, Institution, mobile number (verified by OTP) and, optionally, email address.
• Calls with our sales and support team may be recorded. We may use AI tools to transcribe and summarise these calls for follow-up and quality.

3.9 Device, log and usage data

• IP address, browser and device type, operating system, app version and push-notification token.
• Login history (time, device and IP address) and activity logs that record which user created, changed or deleted a record, and when.
• How you use our website and web panel, collected through cookies and similar technologies (see Cookies and tracking).

4. How we use personal data

• To provide the Services: run the modules and features an Institution turns on, and show each user the information their role allows.
• To keep accounts secure: sign-in, OTP verification, two-factor authentication, new-device alerts, screen lock, and detecting fraud and misuse.
• To send messages: on the Institution's instructions, SMS, WhatsApp, email and app notifications to students, parents and staff (for example attendance alerts, fee reminders and notices), and service messages about your account.
• To process payments: plan purchases and renewals, fee collection for Institutions, invoices and billing records.
• To support you: answer questions, give demos, investigate issue reports and fix problems.
• For AI-assisted features: when a user chooses one (for example generating questions or cleaning up an imported spreadsheet), we send only the content needed for that task to an AI service provider.
• To improve the Services: using aggregated information about how our website and features are used.
• To market Vedmarg to Institutions: contact schools and their representatives about our products, offers and events by phone, email, SMS or WhatsApp, and measure our advertising. You can opt out at any time.
• To meet legal obligations: comply with law, respond to lawful requests and enforce our terms.

We do not sell personal data. We do not use the records Institutions keep in Vedmarg (such as student, parent or staff records) for our own marketing or for advertising.

5. Children's data

Most students are under 18 and are "children" under the DPDP Act. Their records are added by their Institution, which is responsible for either:

• obtaining verifiable consent from a parent or lawful guardian where the law requires it; or
• relying on an exemption available to educational institutions.

We process students' data only to provide the Services to their Institution. We do not use it to build advertising profiles or to show targeted advertising. Our website is meant for Institutions and their representatives, not for children.

6. Who we share data with

Within your Institution. Authorised users of your Institution see information according to the roles and permissions the Institution sets up. For example, a class teacher can be limited to their own classes.

Service providers. We use trusted providers to run the Services. They may use the data only to provide their service to us.

Purpose	Providers
Cloud hosting, file storage, delivery and protection against attacks	Amazon Web Services, Cloudflare
SMS, WhatsApp and email	Licensed SMS gateways, WhatsApp Business Platform (Meta) and WhatsApp service providers such as MSG91, email delivery services
App and browser notifications	Google Firebase Cloud Messaging
Online payments	Payment gateways such as Razorpay, Easebuzz, Airpay and ICICI Bank Eazypay
Biometric attendance	Attendance device platforms such as eSSL
AI-assisted features and call summaries	AI service providers such as OpenAI and Anthropic
Website analytics, advertising measurement and lead forms	Google (Analytics and Ads), Meta (Facebook and Instagram), Hotjar

As required by law. We may disclose information to government authorities, courts or law enforcement when required by law, or to protect the rights, property or safety of our users or the public.

Business transfers. If Vedmarg is involved in a merger, acquisition or sale of assets, personal data may be transferred under the same protections described in this policy.

7. Cookies and tracking

We use cookies and similar technologies:

• to keep you signed in and secure;
• to remember your preferences;
• to understand how our website and web panel are used; and
• to measure our advertising.

These include:

• Google Analytics and Google Ads: visit statistics and ad conversions.
• Meta Pixel: measuring our ads on Facebook and Instagram.
• Hotjar: on our website, records how visitors click, scroll and move around pages so we can improve them.

• On the web panel (account.vedmarg.com), analytics and marketing cookies are set only if you choose "Accept all" on the cookie banner. You can change your choice at any time from "Cookie settings".
• On our website and in the web panel, you can also block or delete cookies in your browser settings. If you block essential cookies, you will not be able to sign in.
• Our mobile apps do not use browser cookies. They keep your sign-in and preferences on your device.

Our Cookie Policy lists the cookies we use and how long they last.

8. Where data is stored

Our application and database servers are located in India, and the records Institutions keep in Vedmarg are stored there.

Some data is processed outside India:

• uploaded files (such as photos and documents) and backups, which are kept in Cloudflare's cloud storage and may be stored outside India; and
• data handled by service providers such as Google, Meta, Hotjar and AI service providers.

Any transfer outside India is made as permitted under the DPDP Act and any restrictions notified by the Government of India.

9. How long we keep data

• Institution records are kept while the Institution's account exists. If a subscription expires, the data is kept so the Institution can renew and continue, unless the Institution asks us to delete it.
• Deleting an Institution's data: an authorised person of the Institution can ask us in writing to close the account and delete its data. We delete or anonymise it within 30 days of confirming the request, except data we must keep by law.
• Deleting an individual app account stops that person from signing in straight away. The person's records belong to the Institution's account and are not erased automatically; ask your Institution, or us, to erase them.
• Enquiries, demo requests and marketing contacts are kept while they are relevant to our sales and support. If you ask us to stop contacting you, we keep only what we need to respect that request.
• Invoices and payment records are kept for as long as tax and accounting laws require.
• Activity logs are kept for up to 180 days.
• Backups: deleted data can remain in encrypted backups until those backups are deleted.

10. How we protect data

We use reasonable security practices to protect personal data from loss, misuse and unauthorised access. These include:

• HTTPS (TLS) encryption for all connections;
• protection against denial-of-service attacks;
• hashed passwords;
• separation of each Institution's data;
• role-based access;
• two-factor authentication with mobile OTP;
• activity logs; and
• encrypted daily backups.

Read more on our Data Security page.

Please help keep your account safe:

• use strong passwords for every account (admin, teachers and staff);
• turn on two-factor authentication; and
• never share your password or OTP.

No system is completely secure. If a personal data breach occurs, we will act to contain it, and we will inform affected Institutions and users, and the Data Protection Board of India, as the law requires.

11. Your rights and choices

Under the DPDP Act you can:

• ask for a summary of your personal data and how it is processed;
• ask for your personal data to be corrected, completed or updated;
• ask for your personal data to be erased once it is no longer needed, subject to what the law requires us to keep;
• withdraw consent where processing is based on consent (this does not affect processing already done);
• have your grievance addressed; and
• nominate another person to exercise these rights if you die or become incapable.

How to make a request.

• Students, parents and staff should contact their Institution first, because it controls their records. We help Institutions respond.
• Anyone else can write to our Grievance Officer (below).

We may need to verify your identity, and we respond within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Messages.

• You can opt out of our marketing calls and messages at any time by telling us, or by replying STOP where offered.
• Service messages about your account cannot be switched off while the account is active.
• To stop messages your Institution sends through Vedmarg, contact the Institution.

12. Grievance Officer and contact

For questions about this policy, to exercise your rights, or to raise a grievance, contact:

Grievance Officer: Amit Kumar
Menace Techdost Services Private Limited (Vedmarg)
86, Kapoor Complex, Opp. Tyagi Market, Garh Road, Meerut, Uttar Pradesh 250004, India
Email: [email protected]
Phone: +91-8923410020

13. Governing law

This policy is governed by the laws of India. The courts at Meerut, Uttar Pradesh have exclusive jurisdiction over any dispute relating to it.

14. Changes to this policy

We may update this policy from time to time. The version number and date shown with this policy tell you when it last changed. If a change is significant, we will tell Institutions through the web panel or by email before it takes effect.