Privacy Policy

GyanMul is a school management platform used by schools (as customers) and, through them, by school administrators, teachers, students, and parents/guardians (as end users). A school that signs up for GyanMul acts as the data controller for the records it enters — GyanMul acts as a data processor on the school's behalf. See our Data Processing Agreement for the terms governing that relationship. For GyanMul Prep learners and parents who sign up on their own, without a school, GyanMul is the data controller.

We collect the categories of information below. Exactly what is collected depends on your role and how your school configures GyanMul.

Student data

• Identity and enrollment information: full name, date of birth, gender, class/section, roll number, enrollment status
• Family and contact information: guardian names, phone numbers, and relationship to the student
• Academic records: attendance, homework and assignment submissions, exam results, report cards, and grade history
• Financial records tied to the student: fee structure, invoices, and payment history
• Photos submitted through the app (e.g. homework attachments, profile photo) and, where enabled, a student ID photo
• Health or special-needs notes, only where a school explicitly chooses to record them

Teacher and staff data

• Identity and employment information: full name, contact details, role, subjects/classes assigned
• HR and payroll records: attendance, leave requests, salary and payslip data, where the school uses these modules
• Account credentials and authentication data (see Section 4)

Parent / guardian data

• Identity and contact information: full name, phone number, email address
• Relationship to one or more students
• Payment information when paying fees online: the payment is processed by the gateway the school uses (such as eSewa or Khalti) and goes to the school's account. GyanMul receives the payment reference and status, never your eSewa/Khalti password, PIN or full card number
• Messages sent to and from school staff through the platform

GyanMul Prep learners and parents

• Account information: name, email address (or Google sign-in), the exam and grade you are preparing for, and, for a parent, which learner accounts are linked to you
• Learning activity: practice answers, quiz and mock-test results, study plans, streaks and XP
• Premium purchases: plan, amount, date and eSewa payment reference — never your eSewa password or PIN
• Referral and promotion entries, including any prize details we need to deliver a prize

Wallet, NFC card and location

• Wallet: balance, top-ups, payments, refunds and the merchant paid, and whether a PIN is set (the PIN itself is stored only in a protected, hashed form)
• NFC ID card: card identifiers, taps for attendance and payment, and whether a card has been blocked
• Bus tracking: the driver's phone location while a trip is active, and students' pickup points set by the school

School information

• School profile: name, address, contact details, logo, and branding
• Operational configuration: academic structure, grading scale, fee structure, class/section list
• Aggregate usage and administrative data (e.g. storage used, active accounts)

• To provide the core functionality of GyanMul: attendance, academics, fees, communication, and the features your school has enabled
• To authenticate accounts and enforce role-based access, so each person only sees the data their role permits
• To send notifications you or your school has opted into (attendance alerts, fee reminders, announcements, messages)
• To power Gurubaa features, scoped strictly to your school's own data and your role's existing permissions — see Section 8
• To maintain and improve platform reliability, security, and performance
• To comply with legal obligations and respond to lawful requests

We do not sell student, teacher, or parent personal information to third parties, and we do not use student data for behavioral advertising.

GyanMul uses Supabase Authentication to manage sign-in for all accounts. Authentication data (email address, hashed password, session tokens) is handled by Supabase's authentication infrastructure on our behalf, under the same processor obligations described in Sections 9 and 10. We do not store plaintext passwords. Sessions are managed using secure, time-limited tokens on both the web platform and the mobile apps.

The GyanMul mobile apps can send push notifications for events like attendance alerts, new homework, messages, and announcements, where your school has these features enabled and your device has notification permissions granted. You can disable push notifications at any time in your device's system settings or within the app's notification preferences. Disabling push notifications does not affect your ability to see the same information inside the app.

We use our own server and application logs to understand how GyanMul is performing and to fix issues quickly. These include technical data such as device type, app version, operating system version and error details. They are used only to keep the Service working and secure, and never to build advertising profiles. We do not currently use a third-party analytics or advertising service; if we add one, it will be listed in Section 9.

• Structured records (student, staff, academic, financial data) are stored in a managed PostgreSQL database provided by Supabase, protected by row-level security policies that enforce the same role-based access controls used throughout the platform.
• Files and documents (homework attachments, report card PDFs, certificates, profile photos) are stored in Amazon S3, in access-controlled buckets, delivered only via short-lived, signed URLs scoped to an authorized viewer.
• Backups are automated and encrypted, consistent with our Cloud Backup practices described on the platform overview.

Gurubaa features (lesson planning, question generation, report writing, performance analysis, marking written answers, study plans and the chat assistant) operate only within the data your role is allowed to see. To generate a response, the relevant text — and any photo you choose to send — is sent to our AI provider, OpenAI, which processes it on our behalf under its API terms. Your data is never used to train or fine-tune any AI model. Photos sent to Gurubaa are kept only for a limited time to answer your question. Any action Gurubaa proposes that would change data or notify someone requires your explicit confirmation before it happens.

Connecting ChatGPT or Claude (MCP)

If you choose to connect your GyanMul account to an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic), that assistant can read — and, with your confirmation, act on — the GyanMul information your own account is allowed to access. Information it reads is sent to that provider and handled under its own privacy policy. You can disconnect at any time, and every connector action is logged. Students under 18 need a parent's or guardian's permission to connect.

Content protection

To protect learning content, the mobile apps block screenshots and screen recording, and the website shows a faint watermark containing the signed-in person's name and email. The watermark is drawn on your own screen only; it is not stored or sent anywhere.

We share personal data only with service providers that help us run GyanMul, only as much as each needs, and under contract or their published terms:

• Supabase — database and sign-in (accounts, records, authentication).
• Amazon Web Services — file storage (Amazon S3) and email delivery (Amazon SES).
• Google — application hosting (Google Cloud), push notifications (Firebase Cloud Messaging), maps and arrival times for bus tracking (Google Maps Platform), and Google sign-in where you choose it.
• OpenAI — the AI models behind Gurubaa.
• Meta — publishing a school's posts to its own Facebook Page and Instagram account, when the school connects them.
• eSewa and Khalti — payment gateways for Prep Premium, school fees and Wallet top-ups. Your payment is made on their service; we receive only the payment reference and status.
• Vercel — custom domains for school websites.
• AI assistants you choose to connect yourself (such as ChatGPT by OpenAI or Claude by Anthropic) — see Section 8.

• Encryption in transit: all traffic between the web platform, mobile apps, and our servers is encrypted using TLS.
• Encryption at rest: databases and file storage are encrypted at rest by our infrastructure providers.
• Access control: row-level security and role-based permissions restrict every query to only the data a given account is authorized to see.
• Least-privilege administration: internal access to production data is limited to what is operationally necessary and logged.

We retain personal data for as long as your school maintains an active GyanMul account, plus a limited period afterward to allow for account recovery and to meet legal, financial, and academic record-keeping obligations. Academic records (results, report cards, certificates) may be retained longer where a school requests we do so to support alumni verification requests. See our Account Deletion Policy for how to request deletion (from the GyanMul website), and what happens to your data when you do.

Subject to applicable law, you (or, for a student, your school or guardian acting on your behalf) have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data, subject to the retention obligations described in Section 11
• Object to or restrict certain processing
• Request a copy of your data in a portable format

Because schools act as the data controller for student, staff, and parent records, requests are generally directed to your school first. If you are unable to reach your school, contact us at info@gyanmul.com and we will assist or route your request appropriately.

GyanMul is used by schools to manage records belonging to students, including children under the age of 13. See our dedicated Children's Privacy page for how we handle this responsibly, including the role schools and parents play in consenting to and overseeing a student's data.

GyanMul is built primarily for schools in Nepal. Where GyanMul is used by, or processes data belonging to, individuals in the European Economic Area or United Kingdom, our GDPR Compliance page describes the additional rights and safeguards that apply.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and where changes are material, we will notify school administrators directly.

For any privacy question or request, contact our privacy team at info@gyanmul.com, or write to us at Nepfex Innovations Pvt. Ltd., Nepal.