Privacy Policy

Start here, because it determines who you ask for anything else.

For personal data held inside an institution's organisation — students, guardians, teachers and staff — the institution is the Data Fiduciary under the Digital Personal Data Protection Act 2023. It decides what is collected, why, and for how long. Utkal Technologies is a Data Processor: we hold and process that data on the institution's instructions and for no purpose of our own.

For personal data we collect in our own right, we are the Data Fiduciary. That is a much smaller set: visitors to this website, people who use the contact form or the chat widget, and the billing and administrative contacts on a customer account.

Both roles are covered below, and each section says which one it is about.

This notice covers the AcadiFlow website, the application and its four portals, the public result-lookup and certificate-verification pages, and the emails and notifications the service sends.

It does not cover an institution's own policies. A school decides its own retention rules, its own consent practices for photographs and communications, and who inside the school sees what. Ask the school for its notice; ours describes only the system beneath it.

Acting as processor, on the institution's instructions. The institution chooses what to enter; the categories below are what the service is built to hold.

Most of the students in this system are children, and section 9 of the DPDP Act treats their data differently. So do we.

A child does not create their own account. An institution creates student accounts and invites guardians, and a guardian is linked to a named student rather than registering themselves. Verifiable consent for a child's processing is obtained by the institution as Data Fiduciary, in the course of admission.

Section 9 prohibits tracking, behavioural monitoring and targeted advertising directed at children. We do not do any of them anywhere in the product: there is no advertising in the service, no third-party advertising or analytics tag inside any portal, and no profiling of students. The live-chat widget on the marketing pages is not loaded inside the application.

The one place a child's academic outcome is reachable without logging in is the result-lookup page, and clause 17 explains what protects it.

As processor, only to deliver the service the institution has asked for:

Under the DPDP Act, processing rests on consent or on a legitimate use. As processor we rely on the institution's basis rather than establishing our own, and the institution is responsible for obtaining and recording consent from students and guardians — including verifiable parental consent for a child.

For the data we hold as fiduciary, we rely on: performance of the contract with our customer for account and billing data; consent for marketing communications, which you can withdraw at any time; and our legitimate interests in securing the service for technical logs.

Where we rely on your consent, you can withdraw it as easily as you gave it. Withdrawal does not affect processing already carried out, and it does not remove records we must keep by law.

Acting in our own right, and a much shorter list:

We use the minimum a working application needs, and nothing for advertising.

We share personal data with the sub-processors below and with nobody else. Each is bound by contract to obligations equivalent to ours, may process data only on our instructions, and is engaged for the purpose stated and no other. We remain answerable to our customers for what they do.

We publish the list rather than offering it on request, because a school's board will ask, and "write to us for the list" is not an answer a procurement committee can file.

Some sub-processors operate outside India, as their entries above show. The DPDP Act permits transfer to any country the Central Government has not restricted, and we monitor that list. Transfers are made under contractual terms that hold the recipient to the protections described here.

Where an institution requires that its records stay in India, the primary database can be provisioned in an Indian region. Ask before onboarding: it is a provisioning decision that is straightforward at the start and a migration afterwards.

As processor, we keep an institution's data for as long as its account is active, because a student information system is a record that is supposed to persist — a school issuing a transfer certificate needs the enrolment record from years earlier.

The institution controls deletion within its own account. Deleted records are marked deleted rather than destroyed immediately, so a mistake is recoverable and the audit trail stays intact; they are purged on the schedule below.

The controls are described in full, with the reasoning behind each, on our security page. In summary: every record is scoped to the organisation that owns it and queries are filtered by that scope; access is role-based, with teachers limited to their own sections and guardians to their own children; passwords are hashed; sign-in is rate limited; payment webhooks are verified by HMAC before processing; responses carry hardened security headers; and an audit log records who changed what.

Data is encrypted in transit. Support access is limited to the people who need it, and impersonation displays a banner for the entire session.

No system is beyond compromise, and we do not claim otherwise. What we commit to is the design above, and the disclosure obligations in the next section when something does go wrong.

If a personal data breach occurs, we will notify the affected institution without undue delay and in any event within 72 hours of becoming aware of it, with what we know about what happened, which data is affected, and what we are doing.

We will support the institution in its own notification duties to the Data Protection Board of India and to affected data principals, which under the DPDP Act fall on it as Data Fiduciary. Where we are the fiduciary, we make those notifications ourselves.

Security researchers: report a vulnerability to privacy@utkaltechnologies.com. We will not pursue a good-faith report made without accessing or exfiltrating other people's data.

The DPDP Act gives every Data Principal these rights, and this notice does not narrow them:

If your request concerns a school's records — a student's marks, attendance, fee history, or a guardian's contact details — it goes to the school. The school is the Data Fiduciary and only the school can decide, and act, on its own records. This is not a deflection; it is the same reason your school, and not the company that made its filing cabinets, answers for the file inside.

We will help. Write to privacy@utkaltechnologies.com and we will tell you which institution holds the record and how to reach the right person there, and we will assist that institution in fulfilling the request promptly.

If your request concerns data we hold as fiduciary — a contact-form enquiry, a billing contact, a marketing email — write to privacy@utkaltechnologies.com and we will answer it directly. We may need to verify your identity first, and we will ask for no more than is necessary to do so.

Stated as commitments rather than as an absence, so there is something to hold us to:

Two pages are deliberately reachable without signing in, and both needed a decision about exposure.

Result lookup exists because a parent without a portal account still needs a result on the day it is published. Certificate verification exists because a QR code printed on a transfer certificate has to be checkable by an employer or another school years later.

Both carry noindex directives and a matching response header, so a search engine may fetch them but must not list them: a child's marks should not be findable by searching the child's name. We deliberately do not block them in robots.txt — a blocked page is never fetched, so the crawler never reads the instruction not to index it, and can still list the bare URL from an inbound link. Letting the crawler in to read the directive is what keeps the page out.

Verification pages are never cached, so a certificate revoked an hour ago reads as revoked on the very next check.

We will update this notice as the service or the law changes. Every version carries the effective date shown at the top of this page.

For a change that materially affects how personal data is handled, we give at least 30 days' notice to institutional customers by email and in the application before it takes effect. Corrections and clarifications take effect on publication.

Under section 13 of the DPDP Act 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, we publish the officer responsible for complaints about personal data:

Tapas Jyoti, Utkal Technologies, Bhubaneswar, Odisha, India. Email: grievance@utkaltechnologies.com. Data protection requests: privacy@utkaltechnologies.com.

We acknowledge within 24 hours and respond within 15 days. If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India. Approaching us first is required by the Act before the Board will take a complaint — so please do, and we would rather resolve it than be escalated over.

This notice is published in English, Hindi and Bengali so that it can be read in the reader's own language, as section 5(3) of the Act contemplates. Where a difference of meaning arises, the English text governs.