Privacy Policy

1. Overview

This Privacy Policy describes how theALLai ("we", "us", "Opexal") collects, uses, stores, and protects personal data when you use the Opexal college ERP platform ("Service"). This policy is compliant with India's Digital Personal Data Protection (DPDP) Act, 2023.

By using Opexal, your institution ("Data Fiduciary" under DPDP) agrees to this policy. Students and parents whose data is entered into Opexal are "Data Principals" under DPDP.

2. Data We Collect

Institutional Data (collected from your institution):

• Institution name, address, registration details, and GSTIN
• Administrator names, roles, and contact information
• Teacher profiles, designations, and contact details
• Billing and payment records

Student & Parent Data (entered by your institution):

• Student names, enrollment numbers, class, and section
• Parent/guardian names and contact numbers (phone, WhatsApp)
• Attendance records and academic performance data
• Fee payment history and outstanding balances
• Address information as entered during admission

Usage Data (collected automatically):

• Login timestamps and IP addresses
• Feature usage and navigation logs (for product improvement)
• Browser type and device information

3. How We Use Your Data

• To provide and operate the Opexal service
• To send automated fee reminders via WhatsApp and SMS (only as configured by your institution)
• To operate the AI voice agent for student/parent queries (only as enabled by your institution)
• To generate reports and analytics for institutional use
• To send service updates, billing notices, and important security alerts
• To comply with legal obligations under Indian law

We do not sell your data to any third party. We do not use student data for advertising purposes.

4. Data Storage & Security

• All data is stored on servers located within India (AWS Mumbai / ap-south-1 region)
• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access to production data is restricted to authorised Opexal engineers only, with full audit logging
• Daily automated backups with 30-day retention
• Role-based access control ensures your staff can only access data relevant to their role

5. Data Retention

• Active account data is retained for the duration of your subscription
• After account termination or trial expiry, data is retained for 30 days and then permanently deleted
• You may export all data as CSV at any time before termination
• Billing records are retained for 7 years as required under Indian tax law

6. Third-Party Services

Opexal uses the following third-party services to operate the platform:

• Retell AI — Powers the Hindi + English AI voice agent. Call audio is processed per Retell AI's privacy policy.
• WhatsApp Business API — Used for fee reminders and chatbot responses. Messages are processed per Meta's privacy terms.
• AWS (Amazon Web Services) — Cloud hosting, storage, and database infrastructure.

All third-party services are bound by data processing agreements consistent with DPDP Act 2023 requirements.

7. Your Rights under DPDP Act 2023

As a Data Principal (student/parent) or Data Fiduciary (institution), you have the right to:

• Access — Request a copy of personal data held about you
• Correction — Request correction of inaccurate personal data
• Erasure — Request deletion of personal data (subject to legal retention requirements)
• Grievance Redressal — File a complaint with our Grievance Officer

To exercise these rights, contact our Grievance Officer (details in Section 9).

8. Cookies

Opexal uses essential cookies for authentication and session management. We do not use advertising or tracking cookies. Analytics data is collected in aggregate form only (no individual user tracking for marketing purposes).

9. Grievance Officer

As required under the DPDP Act 2023, our Grievance Officer is:

10. Changes to This Policy

We will notify all account administrators via email at least 15 days before any material changes to this Privacy Policy take effect. Continued use of Opexal after the effective date constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of India. Disputes shall be subject to the jurisdiction of courts in Uttar Pradesh, India.