EDHI5 Privacy Policy | WebBurst Solutions Pvt Ltd

1. Introduction

EDHI5 is a product of WebBurst Solutions Pvt Ltd. We provide a connected platform that helps educational institutions manage admissions, student records, academics, attendance, fees, communication and other school operations.

We recognise that school information includes personal records about children, families and staff. Responsible handling of this information is essential to the trust placed in us.

This Privacy Policy explains what personal information we collect, why we use it, when we share it, how we protect it and how you can raise questions or exercise your privacy rights.

2. Scope of This Policy

This policy applies to personal information processed through the EDHI5 website, platform, associated applications, support services and features that link to this policy.

It covers:

Visitors to our website and people requesting demonstrations or information.
Schools and educational institutions using EDHI5.
Trustees, principals, administrators, admission teams, accountants, teachers and other authorised staff.
Students, parents and guardians using institution-provided services.

An institution may issue its own privacy notice explaining how it collects and uses school records. Please read that notice alongside this policy.

3. Our Role and the Institution’s Role

Institution-managed information

When a school uses EDHI5, it generally determines why student, parent and staff information is collected, which modules are enabled and who may access the records. We process that information on the institution’s behalf, under its authorised instructions and our service agreement.

The institution is responsible for establishing an appropriate legal basis for its processing, providing required notices and obtaining consent where necessary. EDHI5 supports the institution in fulfilling its responsibilities within the scope of our services.

Information managed by WebBurst

For activities such as website enquiries, demonstration requests, customer relationship management, billing and support, WebBurst determines how the relevant information is used.

If your request concerns an institution’s records, please contact that institution first. We may assist it with your request or direct your enquiry to the appropriate authorised contact.

4. Information We Collect

The information processed through EDHI5 depends on the services used, the institution’s configuration and the information provided by authorised users.

Website and Business Enquiries

We may collect your name, work email address, telephone number, institution name, designation and details submitted through enquiry forms, demonstration requests or correspondence.

Student and Admission Records

An institution may provide information such as student names, dates of birth, admission numbers, photographs, class and division details, applications, supporting documents, attendance, academic results, assignments and progress records.

Parent and Guardian Information

This may include names, contact details, relationship to the student, emergency contacts, communication preferences and messages exchanged with the institution.

Staff and Teacher Information

This may include names, contact details, professional qualifications, employment details, assigned responsibilities, timetables and attendance records.

Fees and Transaction Records

Depending on the modules used, EDHI5 may process fee structures, concessions, amounts due, payment status, receipts, refunds and transaction references.

Where payments are completed through an external payment provider, that provider processes the payment information under its own terms and privacy notice.

Communication and Support Records

We may process notices, announcements, queries, complaints, attachments, support tickets and information supplied to resolve technical issues.

Technical and Usage Information

This may include IP addresses, device and browser information, login activity, access logs, feature usage and diagnostic information used to operate and protect the service.

Optional Module Information

Where enabled and lawfully authorised, additional information may be processed for functions such as transportation, staff administration or student support. This may include route and stop details, location information, health information or biometric attendance information.

Such information should be collected only when necessary for the relevant service and with the notices, permissions and safeguards required by applicable law.

5. How We Receive Information

We receive information:

Directly from you when you submit forms, communicate with us or use EDHI5.
From your institution and its authorised users.
Through institution-authorised imports, migrations and integrations.
Automatically through necessary technical logs and, where used, cookies or similar technologies.

Please provide only information relevant to the service or request. Avoid submitting unnecessary personal documents or confidential student information through general website enquiry forms.

6. How We Use Information

We use personal information for defined purposes connected with our services, including:

School administration: managing admissions, records, attendance, academics, fees and other enabled operations.
Authorised access: creating accounts and providing information and actions appropriate to each user’s responsibilities.
Communication: delivering institution-authorised notifications, reminders and messages.
Connected workflows: linking relevant records and supporting follow-ups, approvals and configured tasks.
Reporting: producing dashboards and reports for authorised institutional users.
Customer support: investigating issues and responding to enquiries.
Security and reliability: detecting misuse, troubleshooting errors and maintaining service availability.
Business administration: managing demonstrations, customer relationships, subscriptions and billing.
Legal obligations: responding to lawful requests and meeting applicable recordkeeping requirements.

Where we send promotional communications, we provide a way to unsubscribe. Essential service messages and institution-related communications are managed separately.

Where consent is required, we obtain it through the appropriate process. Reading this policy or using the service does not, by itself, replace consent required by law.

7. AI and Intelligent Features

EDHI5 may introduce or provide AI-assisted features that help authorised users retrieve information, summarise records, draft communications, identify patterns or support configured workflows.

Where an AI feature is enabled, its use of personal information must remain within the authorised purpose, the user’s permissions and applicable legal requirements.

AI-generated content may contain errors. Authorised users should review outputs before relying on them, communicating them or taking actions that affect students, families or staff. Important educational, financial and administrative decisions should remain subject to appropriate human review.

Before an AI feature uses personal information in a new way, we will provide relevant information about that processing and obtain any authorisation or consent required.

[Before publication, specify the actual AI providers, information shared, provider retention arrangements and whether institution data is used for model training. If AI features are not yet available, identify this section as applying when those features are introduced.]

8. Children’s Privacy

Protecting children’s information is a central consideration in an educational platform.

Student accounts and records are generally managed through the institution and, where appropriate, parents or guardians. Access should be limited to people with an authorised educational, administrative or caregiving responsibility.

Where applicable law requires parental or guardian consent, verification or another safeguard, the relevant process must be completed before processing begins. Any educational exemption must be assessed for the particular activity; it should not be assumed to cover every use of student information.

Children’s information must not be used for targeted advertising or unrelated commercial purposes. Attendance, academic reporting and student-support functions must remain within their authorised educational purposes and applicable legal limits.

Parents or guardians who believe a child’s information has been collected or disclosed improperly should contact the institution or our privacy contact below.

9. When We Share Information

We may share personal information in the following circumstances:

Within the institution: with authorised personnel and users according to configured permissions and legitimate responsibilities.

With service providers: with providers supporting functions such as hosting, infrastructure, communication, payment processing, diagnostics and customer support, subject to appropriate contractual safeguards.

Through authorised integrations: with external systems connected by the institution or authorised user, to the extent needed for the enabled integration.

For legal and security purposes: where disclosure is required by law or is lawfully necessary to investigate misuse, respond to a security incident or protect people’s rights and safety.

During a business transfer: where information must be transferred as part of a merger, acquisition or restructuring, subject to applicable safeguards and notification requirements.

[Confirm before publication: EDHI5 does not sell personal information or share institution-managed student records with advertisers for their independent marketing.]

10. Integrations and External Services

Institutions may connect EDHI5 with payment gateways, email, SMS, WhatsApp, accounting systems, attendance devices, transport systems or other services.

The information exchanged depends on the integration and the permissions granted. Institutions should review the provider’s privacy practices before enabling a connection.

External websites and services may process information independently under their own privacy policies. This policy describes EDHI5’s processing and does not replace those notices.

11. Cookies and Similar Technologies

Where used, cookies and similar technologies may support login sessions, security, preferences and website performance.

We will explain the categories of cookies used and provide consent choices where required by applicable law. Optional analytics or advertising technologies, if introduced, will be identified in the relevant cookie notice.

You can manage cookies through your browser settings and any available website controls. Disabling essential cookies may affect login or other functionality.

Our current use of cookies and similar technologies is as follows:

EDHI5 website (edhi5.com): The public marketing site does not use advertising cookies or third-party analytics cookies at this time. Pages may request fonts from Google Fonts; Google may receive technical data such as your IP address under its own privacy policy.
EDHI5 platform (Office and signed-in apps): We use strictly necessary httpOnly session cookies to maintain your sign-in session. In production these cookies use Secure and SameSite settings. They are not used for advertising.
Diagnostics: If error monitoring is enabled, limited technical data may be sent to Sentry to help us fix faults (see Section 10).

We do not operate a separate cookie-settings panel on the marketing website today. You can manage cookies through your browser settings. To end a platform session, sign out or clear site data for the relevant EDHI5 subdomain (for example admin.edhi5.com).

12. Storage and Security

We apply reasonable technical and organisational safeguards appropriate to the information processed and the risks involved.

[Insert verified measures, such as encryption in transit and at rest, role-based permissions, authentication controls, logging, backups, security monitoring and confidentiality obligations. Include only measures actually implemented.]

No system can guarantee absolute security. Users should protect their credentials, use available account-security settings and promptly report suspected unauthorised access.

Where a personal data breach occurs, we will take appropriate response measures and notify affected institutions, individuals or authorities as required by applicable law and our contractual obligations.

13. Data Retention and Deletion

We retain personal information for as long as necessary for the stated purpose, applicable legal requirements and relevant contractual obligations.

Institution-managed records are retained according to the institution’s authorised instructions, our service agreement and applicable retention requirements.

When a subscription ends, data export, return and deletion are handled under the agreed exit arrangements. Information may remain for a limited period in backups or where retention is required for legal obligations, dispute resolution or security purposes.

Unless a longer period is required by law or your institution’s agreement with us, we apply the following retention guidelines:

Website and demonstration enquiries (managed by WebBurst): up to 2 months after our last meaningful contact with you, then anonymised or deleted unless an active sales or contract process requires longer retention.
Customer support records: for the subscription term and up to 6 months after the related ticket or account is closed.
Security and access logs (for example API and web-server logs): typically up to 30 days for investigation and service reliability.
Institution data after termination: export and return under the agreed exit process (commonly a 30-day export window); deletion or anonymisation of production institution data within 60 days after agreed termination, unless retention is required for legal, tax, audit or dispute purposes.
Database backups: managed PostgreSQL backups on DigitalOcean are retained for approximately 7 days and rotate automatically; backups are not used for routine access and are overwritten on schedule.
Session and OTP data in Redis: short-lived (typically hours to days), not used as a long-term record store.

Deleting an account does not automatically require the deletion of every underlying school record.

14. Processing Locations

Information may be processed wherever EDHI5 and its authorised service providers operate.

EDHI5 is operated by WebBurst Solutions Pvt Ltd from India. Unless your contract states otherwise, production services are hosted as follows:

Application hosting: DigitalOcean droplets (India datacentre region).
Database: DigitalOcean managed PostgreSQL (typically Bangalore — blr1).
Files and uploads: DigitalOcean Spaces object storage (typically blr1).

Routine processing of institution student and staff records for the platform is intended to remain in India. Limited processing outside India may occur when:

an institution enables an integration whose provider processes data in another country (for example a payment gateway, email/SMS provider, or identity tool);
we use subprocessors that may process diagnostic or delivery data globally, such as MSG91 (messaging), Firebase Cloud Messaging (push notifications, where enabled), or Sentry (error monitoring, where enabled).

Where cross-border transfers apply, we use contractual safeguards and comply with restrictions required by applicable law and our agreements with institutions.

Where information is transferred across borders, we apply safeguards and comply with restrictions required by applicable law and our agreements.

15. Your Privacy Rights

Depending on applicable law and our role in processing your information, you may request:

Information about the personal data held about you and its use.
Correction or updating of inaccurate or incomplete information.
Deletion of information, subject to lawful retention requirements.
Withdrawal of consent where processing relies on consent.
Review and resolution of a privacy complaint.
Other rights, including nomination, where applicable law provides them.

For school-managed records, contact your institution first. For website enquiries or information managed directly by WebBurst, contact us using the details below.

We may need to verify your identity or authority before acting on a request. We will respond within applicable legal time limits and explain any lawful restriction that prevents us from fulfilling it.

Withdrawing consent may affect services that depend on the relevant information. It does not invalidate processing lawfully carried out before withdrawal.

16. Changes to This Policy

We may update this policy to reflect changes in our services, processing practices or applicable legal requirements.

The current version will be available on our website with its effective date. Where required, we will provide additional notice of material changes.

If a change requires fresh consent, we will seek it through the appropriate process rather than relying solely on continued use of the service.

17. Contact Us

For privacy questions, requests or complaints, please contact:

WebBurst Solutions Pvt Ltd — EDHI5
Privacy / Grievance Contact: Priyanka Nadar
Email: Sales@edhi5.com
Telephone: 7738211512
Registered office: 101, Rutu Enclave, Ghodbandar Road, Thane (West) 400615

Please describe your concern and, where relevant, identify your institution. Do not send passwords, payment credentials or unnecessary personal documents.

If your concern remains unresolved, you may use the complaint or escalation mechanism available under applicable law.