Privacy Policy

Last updated: 3 November 2026 · Applies to kivquo.com and the Kivquo mobile apps

This policy explains what information Kivquo handles when an institution uses our software, when staff, students and families sign in, and when someone visits this website. It is written in plain language on purpose.

1. Who we are

Kivquo provides school ERP software to educational institutions. In this policy, “Kivquo”, “we” and “us” refer to the Kivquo product and the people who operate it. You can reach us at kivquoschoolerp@gmail.com.

2. Scope and our role

This policy covers the Kivquo platform — the iOS and Android apps, the web build, the backend APIs and this website. It does not cover third-party sites or services we link to.

For records an institution enters about its students, staff and families, the institution is the data controller (and, under India’s Digital Personal Data Protection Act, 2023, the data fiduciary). Kivquo acts as a data processor: we store, organise and display those records only to provide the service and on the institution’s instructions. The institution decides what is collected, who can see it and how long it is kept.

For our own website visitors, business contacts and support correspondence, Kivquo is the controller of that information.

3. Information we process

The exact fields depend on how an institution configures Kivquo. The platform is capable of processing the categories below.

3.1 Account and profile details

• Name, email address, phone number, role and institution.
• Roll number, USN or employee ID, department, designation, qualification and experience.
• Profile photograph, date of birth, gender, address, city, PIN code, preferred language.
• Guardian name, relationship and email; parent phone; alternate phone; emergency contact.
• Custom profile fields an institution adds for its own roles.
• Authentication identifiers, email-verification status and password-change flags.

3.2 Institution records

• Academics — classes and sections, subjects, timetables, attendance, exams, marks, homework and exam eligibility.
• Admissions — applicant and family details, previous school, course preference, entrance-test scheduling, allocation and notes.
• Fees and expenses — fee structures, dues, receipts, payment status and expense records.
• Payroll — payee name, role, department, salary amount, frequency and schedule notes.
• Library — loans, returns, reservations, fines and payment references.
• Announcements and notices — content, audience, authorship and read status.
• Documents — files the institution or a user uploads to a student or staff profile.

3.3 Admissions and prospective students

Admissions records can include a child’s name, date of birth, gender, blood group, address, parent or guardian names and phone numbers, previous school, course preferences, entrance-test details and custom fields configured by the institution. Some applicants are children, so the institution is responsible for the notice and consent described in section 6.

3.4 Fees, payments and payroll

When online fee payment is enabled, we process order and transaction identifiers, amount and currency, payment status, the payment method reported by the gateway, refunds, receipt numbers and the role of the payer (parent or student). We store a PII-minimised subset of the gateway callback for audit — not card numbers, UPI credentials or bank details.

Payroll features keep salary schedules and payment records. Salary disbursement and statutory compliance remain the institution’s responsibility; Kivquo does not move payroll funds.

3.5 Library

Library records link a student to borrowed copies, due dates, reservations, fines and payment references. Staff can see which student holds which item.

3.6 Transport and location

Transport records include routes, stops, vehicles, the stop assigned to a student and trip start/end times. While a driver starts an active trip, the driver app broadcasts the vehicle’s location (latitude, longitude, speed and heading) so authorised staff, students and parents can see the bus. This can use background location on the driver’s device. See section 10.

3.7 Counselling and welfare records

Institutions may keep counselling records containing the student’s name and class, a concern category, severity, an action plan, whether a parent was contacted, follow-up dates and the counsellor’s identity. This is sensitive information and is described further in section 7.

3.8 Placement

Placement profiles can include a student’s name, phone, email, photograph, résumé, CGPA, school marks, active backlogs, portfolio and professional links. When a student applies to a drive, a snapshot of the profile and the résumé is shared with the institution’s placement team and, as part of the application, with the recruiting company. Application status and round progress are recorded.

3.9 Communications and notifications

We process notification content, delivery status, read status, push tokens, device name and platform, email delivery events such as bounces and complaints, and support messages you send to us.

3.10 Device, diagnostics and security data

Like most software, the platform receives technical information needed to operate: IP address, device and app version, platform, authentication events, timestamps, rate-limit data and audit logs. If crash reporting is enabled, error diagnostics may include device information, the user identifier and the state of the app at the time of the error. We do not intentionally send student records to crash reporting.

3.11 Uploaded files

Profile photographs and documents (including student documents and placement résumés) are stored with our secure file-storage provider. The platform database keeps the file’s name and download URL, not the file contents.

3.12 This website

This website does not ask you to create an account. The hosting provider keeps standard request logs (IP address, user agent, requested page, timestamp).

4. How we use information

• To provide the service — admissions, attendance, academics, fees, transport, library, payroll, placement and communication.
• To sign users in, verify email addresses and reset passwords.
• To send transactional email and push notifications, and to honour notification preferences.
• To process online fee payments, generate receipts and reconcile refunds.
• To show a bus’s live position to authorised users during an active trip.
• To share placement applications with recruiters when a student applies.
• To provide support, investigate errors and improve reliability.
• To maintain security, prevent abuse, keep audit logs and enforce access controls.
• To meet legal, tax and accounting obligations.

We do not sell personal information, and we do not use student data for advertising.

5. Legal bases

Where India’s Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of the institution’s instructions, the consent the institution obtains, the performance of our contract with the institution, our legitimate interests in operating and securing the service, and legal obligations. Where other laws apply, we rely on equivalent bases: contract, consent, legitimate interests and legal obligation.

Consent can be withdrawn at any time, but withdrawal does not affect processing that already took place and may mean an institution can no longer provide a feature.

6. Children and student data

Many students are children. Kivquo does not create student accounts directly with children and does not collect information from children through this website. Institutions create and manage student records, and they are responsible for giving the required notice and obtaining verifiable parental or guardian consent before processing a child’s data.

Parents and guardians should contact their institution first about access, correction or deletion of a student’s records. The institution can then instruct us. If you contact us directly, we may forward the request to the institution.

7. Sensitive information

Some records are more sensitive than others: counselling notes, health-related details such as blood group, financial and payroll data, location and children’s records. Access is limited by role and institution, and the institution decides which staff can see what. Institution staff must handle counselling and welfare records in line with their professional and legal duties.

8. Payments

Online fee payments are processed by our payment gateway partner through its checkout. The gateway collects and handles the payment instrument — card, UPI, netbanking or wallet details — under its own privacy policy and PCI-DSS obligations. Kivquo does not receive or store card numbers, CVV, UPI PINs or bank credentials.

The institution receives the fee; Kivquo is not a party to the fee obligation between the institution and the payer. Refunds are initiated by the institution through the platform and are processed by the gateway. Where an institution has not enabled online payments, fees are recorded by staff as settled offline.

9. Email and push notifications

Kivquo sends transactional email through a transactional email provider — for example email verification codes, password reset codes, credentials for accounts provisioned by an institution, receipts and operational notices. Institutions can configure their own verified sender identity. We record delivery events such as bounces and complaints so that undeliverable addresses are not retried indefinitely.

Push notifications are delivered through a push delivery provider, which receives the device token and the notification content. You can turn push notifications off in the app or in your device settings. We do not send marketing email to institution records.

10. Location data

The driver app requests foreground and, where permitted, background location. Location is broadcast only while a driver has an active trip running. It is used to show the bus on a map to authorised users at the institution and to the families assigned to that route. Drivers can stop a trip or revoke the permission in device settings; doing so ends live tracking for that trip.

Location is an operational aid, not a safety-certified tracking or emergency service. Accuracy depends on the device, network, battery settings and GPS conditions.

11. Who we share with

We share information with service providers that run the platform on our behalf. They are bound by their own security and data-protection commitments and may only process the information needed for their service. The categories of provider we use are:

Institutions can request the current list of providers, their roles and processing locations at kivquoschoolerp@gmail.com.

We may also disclose information:

• to authorised users at the institution, according to their role and permissions;
• to a recruiting company when a student applies to that company’s placement drive;
• when required by law, a court order or a lawful request from a public authority;
• to protect the rights, safety or security of Kivquo, an institution or a person;
• as part of a merger, acquisition or transfer of the service, subject to this policy.

12. International transfers

Our providers operate in India and other countries. Information may therefore be processed outside the country where an institution is located. We use providers with contractual and security commitments, and we take the steps required by applicable law for cross-border transfers.

13. Retention and deletion

Institution records are kept for as long as the institution’s account is active and for the period the institution instructs. Account data is kept while the account exists. Email verification and password-reset codes are short-lived and single-use; expired tokens are cleaned up. Audit, security and delivery logs are kept for a limited period for troubleshooting, abuse prevention and legal compliance.

When an institution ends its agreement, we provide a reasonable opportunity to export records and then delete them, unless a longer period is required by law or needed to resolve a dispute. Backup copies are deleted on the provider’s normal backup cycle. To request deletion or export, contact the institution administrator first, or write to us at kivquoschoolerp@gmail.com.

14. Security

We use technical and organisational measures that include:

• encryption in transit between the apps, the website and the backend;
• provider-managed encryption at rest for the database and file storage;
• strong authentication, short-lived verified-token caching and session revocation after a password change;
• role-based access control and institution-level (tenant) scoping on API requests;
• SHA-256 hashing of email-verification tokens and one-time codes, with attempt limits and resend rate limits;
• AES-256-GCM encryption of per-institution payment gateway secrets;
• rate limiting, security headers and audit events for sensitive actions;
• limited production access for the people who operate the service.

No system is perfectly secure. If you believe an account or record has been compromised, contact your institution administrator and write to us immediately.

15. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or restrict the use of your personal information, to receive a copy of it, to withdraw consent, and to nominate someone to exercise your rights. Under India’s DPDP Act, you also have the right to grievance redressal.

To make a request, write to kivquoschoolerp@gmail.com. If your account belongs to an institution, we may ask you to contact the institution so that it can authorise the request; the institution is the controller of those records. We respond within the time required by applicable law.

You can also manage push notifications in the app and in device settings, and revoke camera, photo or location permissions at any time. Revoking location permission on a driver device stops live bus tracking from that device.

16. Cookies and local storage

This website does not set advertising or analytics cookies. The platform uses essential local storage and secure device storage to keep users signed in, remember app state and protect accounts. We do not use student data for behavioural advertising.

17. Third-party links

The platform or this website may link to third-party sites. Their privacy practices are governed by their own policies, and we are not responsible for them.

18. Changes

We may update this policy as the service changes. When we do, we revise the date at the top of this page. Material changes will be communicated to institutions directly or through the platform.

19. Contact and grievances

Institutions can request a data processing agreement or ask about sub-processors at the same address.