This Privacy Policy explains how personal data is handled on the My Academy Desk platform (the "Service"). It has two audiences, and they're not the same:
If you're a parent/guardian or student with a question about your own data, your first point of contact is the Academy you're enrolled with — they hold the primary relationship and can act on your request directly in the Platform. See Section 7.
On the Academy's instructions (about students and guardians):
Directly from Academy staff (owners, admins, coaches) as accountholders:
For referrals (see Section 6 and the referral terms):
Only to provide the Service: displaying records back to the Academy, computing attendance percentages and dues, sending in-app notifications, generating reports, and the coach-feedback share-link feature. We do not use Academy or student data to train machine learning models, do not use it for advertising or profiling, and do not sell or rent it.
Access within an Academy's account is scoped by role, and every request is authenticated against that specific Academy's own data — one Academy can never see another's.
Data is stored on Amazon Web Services (AWS) servers in Mumbai, India.
Only named members of the My Academy Desk team can reach the systems where data is stored. They look at an Academy's or its students' data only to give support the Academy has asked for, to investigate or fix a security incident, or where the law requires it. Each such access is recorded with its reason.
5.1 We retain Academy and student data for as long as the Academy's account is active, and for 2 years after it ends so that it can still be exported. After that it is deleted from active systems. The one exception is the record that consent was given (who gave it, for which student, when, and in what form): we keep it indefinitely as evidence of that consent, and it is not deleted with the rest of the data. Copies held in backups are removed as the backups expire on their normal rotation, which is currently 7 days.
5.2 Referral details are kept as described in Section 6: an invited academy's number until it signs up (an invite nobody uses is deleted once it is more than 90 days old), and the scrambled form of an academy owner's mobile number for as long as the Service runs, also after the academy leaves.
Invited academies. An Academy can invite another academy to My Academy Desk by typing its name and mobile number, then sending the invite link itself on WhatsApp. We use the name and number only to build that link and to show the inviting Academy its invites. We never message that number. When the invited academy signs up, the number is cleared (the academy's name stays on the used invite). An invite nobody uses is deleted once it is more than 90 days old, in our routine clean-up.
If your number was typed by someone else. If another academy typed your name and mobile number to invite you and you would like them removed, write to itzsskai@gmail.com and we will delete them. You don't need an account to ask.
Academies new to My Academy Desk. Referral credit is only for academies new to My Academy Desk. To apply that rule, we keep a scrambled (hashed) form of each academy owner's mobile number, made so that we can recognise the same number again without keeping the number itself. It is made with a secret key that we keep separately from the data, so the number can't be worked out from it without that key. It is not linked to the academy's records and we use it for nothing else, but it is still personal data. We keep it for as long as the Service runs, also after an academy leaves, only so that an academy that has used My Academy Desk before is recognised. The full rules are in the referral terms.
If you're a parent, guardian, or adult student, you can request access to, correction of, or deletion of your data, or withdraw consent, by contacting the Academy directly — they can act on this within the Platform. If the Academy is unreachable, you may contact us at itzsskai@gmail.com.
If you're an Academy staff member (owner, admin or coach), you can update your own profile details in the app, or contact us for anything you can't change yourself.
If you have a complaint about how your data is handled, write to our grievance contact, Meenal Kumari, at itzsskai@gmail.com.
Under the DPDP Act, these rights include access, correction, erasure, grievance redressal, and the right to nominate another person to exercise your rights if you die or are unable to act.
Many students on the Platform are minors. We do not knowingly collect a minor's data except as entered by the Academy with guardian consent already obtained — we do not market to, profile, or target advertising at minors.
We use industry-standard measures appropriate to the sensitivity of the data (encrypted connections, access controls, password hashing), but no system is 100% secure. Access to our source code and cloud accounts is protected with two-step sign-in.
If you turn on fingerprint sign-in, your fingerprint stays on your device. We never receive or store it, or your face or screen lock; we keep only a public key that lets us check your device's sign-in (it can't be used to sign in), and you can remove it from Settings at any time.
The Platform does not use tracking or advertising cookies; it uses browser local storage to keep you signed in.
We may update this Policy from time to time. For material changes, we will give at least 30 days' notice via email or an in-app notice before they take effect, except where a change is required by law, which takes effect when the law requires it.
Questions about this Policy, or to exercise a data right: itzsskai@gmail.com
Grievance contact: Meenal Kumari, itzsskai@gmail.com
Address: Flat 5D1, Jains Inseli Park, Rajiv Gandhi Salai, Padur, Chennai, Tamil Nadu - 603103