Schools hold some of the most sensitive data there is: the names, ages, contact details, and academic records of children. When you add an AI assistant to that environment, the obvious question is also the most important one — what exactly gets sent to the model, and where does it go?
Strip first, then send
Our answer is to send as little as possible. Before a tutoring request is sent to an AI provider, the platform removes or masks direct identifiers — names, roll numbers, contact details — and replaces them with neutral placeholders. The provider receives the academic substance of the question rather than the identity of the child asking it. We do this to the extent it is technically feasible, which is not the same as always: a student can type an identifying detail into free text in a way no scrubber reliably catches.
Where student records are held
The records that make up a student's profile — attendance, marks, homework, report cards — are held on cloud infrastructure that PDP Shikshya selects, operates and is responsible for; uploaded files and media may sit in managed object storage. Each school is a separate tenant whose data is logically segregated from every other school's, and we apply commercially reasonable measures to stop one school's users reaching another's. There is no cross-school pooling of student information, and the school keeps ownership of its records.
Access that matches the role
Privacy is also about who inside the school can see what. Teachers see their own departments and classes; parents see their own children; students see themselves. Student-to-student chats are visible only to the relevant department teachers, and only for safety. Every sensitive action is auditable, including a login activity log that records device, IP, and location so an administrator can spot anything unusual.
None of this is a feature we bolt on at the end. Stripping PII before the model sees it, isolating each school's data, and scoping access to roles are decisions baked into how the platform is built — because with children's data, the default has to be caution.