Privacy Policy

PDP Shikshya is operated by PDP Shikshya Pvt. Ltd., a company incorporated in Nepal. Schools subscribe to the platform under a signed Platform Subscription, Services & Data Protection Agreement. This page explains, in plain language, how data is handled for everyone who uses the platform — students, parents, teachers and school staff.

If you are a school, the signed Agreement is what legally governs your data. This page summarises it; it does not replace it.

The school retains all right, title and interest in the data it and its users put into the platform. Nothing transfers ownership of that data to us. We receive only the limited rights needed to run the service on the school's behalf, and the school remains the decision-maker about its own records.

Whatever a school and its users create in the platform: account and profile details, class and role membership, attendance, assignments and homework, marks and educational records, messages and announcements, uploaded documents and media, tutor conversations, and learning analytics derived from that activity.

Only to run the service the school subscribed to: providing the platform, authenticating users, operating the AI features, keeping the platform secure, technical support and maintenance, analytics about how the platform itself is performing, and meeting legal obligations. We do not process school or student data for unrelated commercial purposes, and we do not sell it.

Some features are powered by third-party enterprise AI providers. Before an educational prompt is sent to such a provider, the platform is designed to remove, mask or pseudonymise direct student identifiers — names, roll numbers, contact details. This is done to the extent technically feasible; complete anonymisation cannot be guaranteed in every circumstance, and we apply commercially reasonable safeguards to keep personal data to a minimum.

We do not intentionally disclose school or student data to an AI provider for the purpose of training publicly available foundation models, unless a school authorises it in writing. We may use anonymised or aggregated operational information that cannot reasonably identify a person or a school to improve the platform. The AI providers we use may change over time; where that happens we require materially comparable privacy and security protections.

The platform is hosted and managed by PDP Shikshya on cloud infrastructure we select and operate, and we are responsible for its management, updates, backups and monitoring. Uploaded files and media may be held in managed object storage rather than on the application server. Each school's data is logically segregated from every other school's, and we apply commercially reasonable measures to prevent one school's users reaching another school's data.

A school that requires its data to remain on its own infrastructure should raise that before deployment — it changes how the platform is installed and is agreed separately.

We maintain an information security programme with administrative, technical and organisational safeguards appropriate to the service. These include encrypted transmission over public networks, role-based access control, authentication controls, backups, security monitoring, vulnerability management, audit logging where technically feasible, and incident-response procedures. Staff with access to school data are authorised, bound by confidentiality obligations, and given access only to what their role requires.

No online service can promise perfect security. What we commit to is a defined programme, ongoing review, and honest handling when something goes wrong.

If we confirm an incident that materially affects a school's data, we investigate without undue delay, take reasonable steps to contain and mitigate it, notify the school as soon as reasonably practicable after confirmation, and share what we know about the nature of the incident, the systems affected, the known impact and the corrective steps taken, so far as we are legally permitted to.

School and student data is kept only as long as reasonably necessary to provide the service, meet legal obligations, resolve disputes, enforce the agreement, or maintain disaster-recovery backups. When a school's agreement ends, we make its data available for export in a commercially reasonable format on written request, and then securely delete or anonymise it within a commercially reasonable period — except where the law requires retention or where copies persist in backups during their normal retention cycle.

Your school is the first point of contact for your data. Where the law or school policy provides for it, parents and legal guardians can ask to see, correct or delete a student's data by contacting the school. Because the school owns the records and controls who may access them, we act on the school's instructions rather than going around it — and we give the school reasonable assistance to answer lawful requests.

Within the app, students and parents can view and update their own profile, and school administrators can correct or deactivate accounts.

Most people using this platform are children, and their data gets heightened protection accordingly. Obtaining any parental or guardian consent required by law is the school's responsibility, as is deciding which staff may see which records.

School data is treated as confidential. We disclose it only where it is necessary to provide the service (for example the AI and infrastructure providers described above), where the law requires it, or where the school authorises it in writing.

We may update this policy as the platform develops; material changes affecting normal operation are communicated to schools in advance where reasonably practicable. This policy is governed by the laws of Nepal.

Students and parents: please contact your school administrator first — they hold your records. Schools with a privacy or data-protection question can reach us at [email protected].