Xorbay Technology Private Limited (“Xorbay”, “we”, “us” or “our”) provides software and technology services for schools, coaching institutes, academies and educational organisations, including education management software, mobile applications, web applications, dashboards and related services.
This Privacy Policy explains how Xorbay collects, uses, stores, shares and protects personal data when you use our website, applications, software, products or services.
Xorbay is committed to handling personal data responsibly and in accordance with applicable Indian data protection and privacy laws, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules and regulations thereunder, as and when applicable to the relevant processing activity.
1. About Xorbay
Legal Name: Xorbay Technology Private Limited
CIN: U62011DL2026PTC470280
Support Email: support@xorbay.com
2. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed by Xorbay through:
- Xorbay’s website;
- Xorbay mobile applications;
- Xorbay web applications and dashboards;
- Xorbay software and SaaS services;
- Sales and demo requests;
- Customer support;
- Billing and subscription activities;
- Communications with Xorbay; and
- Other services that expressly link to this Privacy Policy.
This Policy does not necessarily govern the privacy practices of schools, coaching institutes, academies or other organisations that use Xorbay’s services. Such organisations may have their own privacy policies and responsibilities.
3. Xorbay’s Role in Processing Personal Data
Xorbay may process personal data in two different capacities.
3.1 Xorbay as a Data Fiduciary
Xorbay may act as a Data Fiduciary, or equivalent controller, when determining the purpose and means of processing personal data for its own activities.
Examples may include:
- Website visitors;
- Prospective customers;
- Sales enquiries;
- Xorbay account holders;
- Billing and subscription information;
- Customer support communications;
- Security and fraud prevention;
- Website analytics and technical information; and
- Business administration.
3.2 Xorbay as a Data Processor
When a school, coaching institute, academy or other customer uses Xorbay to store or manage information about its students, parents, guardians, teachers, employees or other individuals, Xorbay may process that information on the customer’s instructions.
In such circumstances, the customer generally determines:
- What personal data is collected;
- Why it is collected;
- Which individuals’ data is entered;
- How the data is used; and
- Which authorised users can access it.
The customer remains responsible for ensuring that its collection and use of personal data is lawful and that it has the necessary authority, notices and consents where required.
4. Personal Data We May Collect
Depending on how you interact with Xorbay, we may collect information such as:
4.1 Account and Contact Information
- Name;
- Email address;
- Mobile number;
- Organisation name;
- Designation or role;
- Username and account credentials;
- Communication preferences.
4.2 Business and Subscription Information
- Organisation details;
- Subscription or plan information;
- Billing information;
- Transaction-related information;
- Invoices and payment records;
- Customer support records.
4.3 Technical Information
When you access our website or services, we may receive information such as:
- IP address;
- Device information;
- Browser type;
- Operating system;
- Application version;
- Log information;
- Approximate location derived from technical information where applicable;
- Access timestamps;
- Error and diagnostic information; and
- Information relating to interactions with our services.
4.4 Customer Data
Customers may upload or otherwise provide information relating to:
- Students;
- Parents and guardians;
- Teachers;
- Employees;
- Managers;
- Administrators;
- Classes and sections;
- Attendance;
- Academic information;
- Fees and payments;
- Assignments and tasks;
- Study material;
- Examinations;
- Notices and communications; and
- Other information configured by the customer.
The exact categories of Customer Data depend on the services and features used by each customer.
4.5 Camera and Attendance Verification Data
Where the attendance verification feature is enabled by a customer, the Xorbay mobile application may access the device camera to capture a photograph of the teacher or staff member at the time of marking attendance.
This photograph is used solely for the purpose of:
- Verifying the physical presence of the teacher or staff member at the time of marking attendance;
- Creating an attendance record with photographic evidence for the customer's administrative and accountability purposes;
- Allowing authorised administrators or managers of the customer to review attendance records; and
- Preventing proxy or fraudulent attendance marking.
Important disclosures regarding camera and attendance photos:
- Camera access is requested only when the teacher or staff member actively initiates the attendance marking process;
- The photograph is captured in real time and is not stored permanently on the device;
- The photograph is transmitted securely to the Xorbay platform and stored as part of the attendance record;
- The customer (school, coaching institute or academy) determines whether the photo-based attendance verification feature is enabled;
- Xorbay does not use attendance photographs for facial recognition, biometric identification, targeted advertising or any purpose unrelated to attendance verification;
- Attendance photographs are treated as Customer Data and are subject to the same confidentiality and data protection obligations as other Customer Data; and
- The customer is responsible for ensuring that its teachers and staff members are informed about, and have provided any required consent to, the photo-based attendance verification feature.
5. Customer Data
Customer Data means information submitted, uploaded or otherwise provided to Xorbay by or on behalf of a customer through the Xorbay services.
The customer retains its rights and ownership in Customer Data.
Xorbay does not claim ownership of Customer Data merely because it is stored or processed through Xorbay’s platform.
Xorbay may process Customer Data only as reasonably necessary to:
- Provide and operate the services;
- Host and store information;
- Provide customer support;
- Troubleshoot technical problems;
- Maintain and improve platform performance;
- Protect the security of the services;
- Prevent fraud, abuse or unauthorised access;
- Comply with applicable law;
- Enforce contractual rights; and
- Perform other processing authorised by the customer agreement or applicable law.
6. Responsibility of Customers
Where Xorbay processes Customer Data on behalf of a school, coaching institute, academy or other organisation, that organisation is responsible for:
- Determining the lawful purpose for collecting the data;
- Ensuring that required notices are provided to individuals;
- Obtaining required consent or other lawful authorisation;
- Ensuring that information supplied to Xorbay is accurate and lawful;
- Determining appropriate access permissions;
- Responding to requests from individuals where the customer is responsible for doing so; and
- Complying with applicable laws relating to the data it provides to Xorbay.
Customers should not upload information to Xorbay unless they are authorised to do so.
7. Children’s Personal Data
Xorbay’s services may be used by educational institutions that process information relating to children.
Where Xorbay processes children’s personal data on behalf of a school, coaching institute or other customer, Xorbay generally acts according to the customer’s instructions.
The customer is responsible for ensuring that it has the lawful authority and required parental consent or other applicable legal basis for collecting and providing children’s personal data to Xorbay.
Where Xorbay independently determines the purpose and means of processing children’s personal data, Xorbay will comply with the requirements applicable to such processing.
Xorbay does not sell children’s personal data.
Xorbay does not intentionally use Customer Data to conduct targeted advertising directed at children.
Where applicable law restricts tracking, behavioural monitoring or other processing relating to children, Xorbay will process such data in accordance with those requirements.
8. How Xorbay Uses Personal Data
Depending on the nature of the relationship, Xorbay may use personal data to:
- Provide and operate our services;
- Create and manage accounts;
- Authenticate users;
- Process subscriptions and payments;
- Provide customer support;
- Respond to enquiries;
- Communicate service-related information;
- Send important account or security notifications;
- Maintain platform security;
- Detect and prevent fraud, abuse or unauthorised activity;
- Troubleshoot and resolve technical issues;
- Maintain and improve service performance;
- Understand product usage;
- Develop and improve our products;
- Comply with applicable legal obligations;
- Enforce our agreements and policies; and
- Protect the rights, property and security of Xorbay, customers and users.
We will not use Customer Data for purposes that are materially inconsistent with the customer’s instructions or the applicable agreement, except where required or permitted by law.
9. Consent and Other Lawful Processing
Where consent is required under applicable law, Xorbay will seek consent in an appropriate manner.
Where consent is relied upon, applicable law may require consent to be free, specific, informed, unconditional and unambiguous and provided through clear affirmative action.
Individuals may have rights to withdraw consent where applicable. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Certain processing may also be permitted or required under applicable law without separate consent.
The applicable legal basis may depend on:
- The type of personal data;
- The purpose of processing;
- Xorbay’s role;
- The customer’s role;
- The service being provided; and
- Applicable law.
10. Cookies and Similar Technologies
Xorbay may use cookies and similar technologies on its website or applications for purposes such as:
- Maintaining sessions;
- Remembering preferences;
- Authentication;
- Security;
- Understanding website usage;
- Improving user experience; and
- Measuring service performance.
Where required by law, we will provide appropriate notice or obtain consent for applicable cookies and similar technologies.
Users may also be able to control cookies through their browser or device settings. Certain functionality may not work properly if required cookies are disabled.
11. Sharing of Personal Data
Xorbay may share personal data where reasonably necessary with:
11.1 Service Providers
We may use third-party service providers that support activities such as:
- Cloud infrastructure;
- Hosting;
- Communications;
- Authentication;
- Analytics;
- Payment processing;
- Customer support;
- Security;
- Monitoring; and
- Other technology services.
Such providers may process personal data only as necessary to provide the relevant services to Xorbay or our customers and subject to applicable contractual or legal requirements.
11.2 Customers
Where Xorbay processes data on behalf of a school, coaching institute or other organisation, information may be accessible to that organisation and its authorised users according to the customer’s configuration and permissions.
11.3 Legal and Regulatory Authorities
We may disclose information where required by applicable law, legal process, court order, governmental request or regulatory requirement.
11.4 Business Transactions
Personal data may be disclosed or transferred as part of a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable law.
12. Third-Party Services
Xorbay may integrate with or depend upon third-party services.
Third-party services may have their own terms and privacy policies.
Xorbay is not responsible for the privacy practices of third parties that operate independently of Xorbay.
Where a customer chooses to connect a third-party service to Xorbay, the customer should review that provider’s applicable terms and privacy policy.
13. International Processing and Data Transfers
Depending on the infrastructure and service providers used by Xorbay, personal data may be processed or stored in India or other jurisdictions.
Where personal data is transferred outside India, Xorbay will do so subject to applicable law and any applicable contractual requirements.
Customers requiring specific data-location or residency arrangements should contact Xorbay before purchasing or deploying the relevant service.
14. Data Security
Xorbay maintains technical, organisational and administrative safeguards appropriate to the nature and scope of its services and the risks associated with processing personal data.
Depending on the service, safeguards may include:
- Access controls;
- Authentication mechanisms;
- Role-based permissions;
- Encryption or other protective measures where appropriate;
- Monitoring and logging;
- Secure development practices;
- Infrastructure controls;
- Backup and recovery measures;
- Vulnerability management; and
- Procedures for handling security incidents.
However, no internet-based service can be guaranteed to be completely secure.
Customers are responsible for maintaining the confidentiality of their account credentials and for configuring appropriate access permissions for their users.
15. Security Incidents and Personal Data Breaches
If Xorbay becomes aware of a personal data breach affecting data processed by Xorbay, Xorbay will take reasonable steps to investigate, contain and address the incident.
Where Xorbay is processing Customer Data on behalf of a customer, Xorbay will notify the customer in accordance with applicable law and the applicable customer agreement and provide reasonable assistance as appropriate.
Where Xorbay independently acts as a Data Fiduciary, Xorbay will comply with applicable statutory requirements relating to personal data breaches.
We do not promise a fixed notification period unless such period is required by applicable law or expressly agreed in a separate contract.
16. Data Retention
Xorbay retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, including:
- Providing services;
- Maintaining accounts;
- Fulfilling contractual obligations;
- Resolving disputes;
- Complying with legal requirements;
- Maintaining security;
- Preventing fraud or abuse;
- Maintaining financial and business records; and
- Enforcing agreements.
Customer Data may be retained after termination for a limited period where necessary for:
- Data export;
- Legal compliance;
- Dispute resolution;
- Security;
- Fraud prevention;
- Backup and disaster recovery; or
- Ordinary system retention cycles.
Backup copies may remain for a limited period until overwritten or securely deleted through normal backup processes.
Retention periods may differ depending on the type of information and the purpose for which it is processed.
17. Data Export and Deletion
Customers may request export or deletion of Customer Data in accordance with their agreement with Xorbay and applicable law.
Upon termination of services, Xorbay may provide reasonable mechanisms for exporting Customer Data where such functionality is available under the applicable plan or agreement.
Following the applicable retention period, Xorbay may delete or anonymise Customer Data, subject to:
- Legal requirements;
- Contractual obligations;
- Disputes;
- Security requirements;
- Fraud prevention;
- Backup systems; and
- Other legitimate operational requirements permitted by law.
Specific deletion or export commitments may be agreed separately with enterprise or custom customers.
18. Your Privacy Rights
Depending on your relationship with Xorbay and applicable law, you may have rights relating to your personal data.
These may include rights to:
- Obtain information about processing;
- Request correction or completion of inaccurate information;
- Request erasure where applicable;
- Withdraw consent where consent is the applicable basis;
- Raise a grievance; and
- Exercise other rights available under applicable law.
Where Xorbay processes your information on behalf of a school, coaching institute or other customer, you may need to contact that organisation first because it may be the entity determining the purposes of processing.
Xorbay will provide reasonable assistance where required by applicable law or agreement.
19. Identity Verification
For security and privacy reasons, Xorbay may need to verify the identity or authority of a person making a privacy request.
We may request reasonable additional information where necessary to:
- Verify identity;
- Prevent unauthorised disclosure;
- Protect accounts; or
- Prevent fraudulent requests.
We will not use verification information for unrelated purposes except where permitted or required by law.
20. Camera Access and Attendance Photo Verification
Where the attendance verification feature is enabled by a customer, the Xorbay mobile application may request access to the device camera for the purpose of teacher and staff attendance verification.
20.1 Purpose of Camera Access
Camera access is used exclusively for:
- Capturing a real-time photograph of the teacher or staff member to verify physical presence at the time of marking attendance;
- Associating the photograph with the attendance record in the Xorbay platform; and
- Enabling administrators and authorised managers of the customer to review attendance records with photographic evidence.
20.2 How Attendance Photos Are Handled
- Camera access is triggered only when the user actively initiates the attendance marking process within the application;
- Photographs are captured in real time and transmitted securely to the Xorbay platform;
- Photographs are stored as part of the attendance record and treated as Customer Data;
- Xorbay does not use attendance photographs for facial recognition, biometric profiling, targeted advertising or any purpose beyond attendance verification;
- Photographs are accessible only to the authorised administrators and managers of the relevant customer; and
- Photographs are retained in accordance with the data retention provisions of this Privacy Policy and subject to any data retention terms agreed with the customer.
20.3 Customer Responsibility
The customer is responsible for:
- Deciding whether to enable the photo-based attendance verification feature;
- Informing teachers and staff members that their photograph will be captured when marking attendance;
- Obtaining any required consent or providing any required notice to teachers and staff members as required by applicable law; and
- Ensuring that the use of photo-based attendance verification is lawful under applicable employment, privacy and data protection laws.
20. Marketing Communications
Xorbay may send communications relating to:
- Products and services;
- Product updates;
- Educational or business content;
- Events;
- Offers; and
- Other marketing communications.
Where required, we will provide appropriate mechanisms to opt out of promotional communications.
You may continue to receive essential service communications, such as security alerts, billing information, account notices and important changes to the services, even if you opt out of marketing communications.
21. Teacher, Employee and Staff Data
Xorbay may process personal data relating to teachers, employees, managers and other staff members when such information is entered into the platform by a customer.
The relevant customer is responsible for ensuring that it has the necessary authority to collect and provide such information to Xorbay.
Examples may include:
- Name;
- Contact information;
- Designation;
- Employment-related information;
- Attendance;
- Assigned classes;
- Permissions;
- Performance-related information; and
- Other information configured by the customer.
22. Student and Parent Communications
Where a customer uses Xorbay to communicate with students, parents or guardians, Xorbay may process contact information and communication-related data as necessary to provide the relevant functionality.
The customer is responsible for determining:
- Who should receive communications;
- What communications are sent;
- Whether the communication is lawful; and
- Whether required permissions or consents have been obtained.
Xorbay provides the technology for such communications and does not independently determine the educational or administrative decisions of the customer.
23. Confidentiality
Xorbay treats Customer Data as confidential and will not disclose it except:
- To authorised users;
- To service providers supporting the services;
- Where instructed by the customer;
- Where necessary to provide or secure the services;
- Where required by law; or
- As otherwise permitted under the applicable agreement or applicable law.
Separate confidentiality obligations may apply under a customer agreement, NDA or Data Processing Addendum.
24. Information Not Intended for Xorbay
Users and customers should not submit information to Xorbay that they are not authorised to provide.
Unless expressly supported by the relevant service and legally permitted, customers should avoid uploading:
- Highly sensitive information unrelated to the service;
- Passwords or authentication secrets;
- Payment card details outside supported payment mechanisms;
- Government identification documents unless specifically required; or
- Other information unnecessary for the use of the service.
If a customer believes sensitive information has been submitted accidentally, it should contact Xorbay promptly.
25. Changes to This Privacy Policy
Xorbay may update this Privacy Policy from time to time to reflect:
- Changes in our services;
- Changes in technology;
- Changes in legal requirements;
- Changes in our processing practices; or
- Other operational requirements.
When changes are made, we may update the “Last Updated” date above.
Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes.
26. Governing Law
This Privacy Policy is governed by the laws of India.
Any dispute relating to this Privacy Policy will be subject to the dispute resolution and jurisdiction provisions applicable to the relevant Xorbay service agreement, and otherwise to applicable Indian law.
27. Contact Xorbay
For questions, concerns or requests relating to this Privacy Policy or privacy practices, contact:
- Xorbay Technology Private Limited
- Registered Office: L-22/75, Gali No. 8, Jai Prakash Nagar, Garhi Mendu, Delhi – 110053, India
- Email: support@xorbay.com
For privacy requests relating to data maintained by a school, coaching institute or other Xorbay customer, we may direct you to contact that organisation first where it is the entity responsible for determining the purpose and means of processing.
Important Notice: This Privacy Policy is intended to provide a clear description of Xorbay’s privacy practices. It should be read together with Xorbay’s Terms & Conditions, applicable Customer Agreement, and, where applicable, Data Processing Addendum or other contractual documents.
Nothing in this Privacy Policy limits any rights or obligations that cannot lawfully be limited or excluded under applicable law.
Xorbay Technology Private Limited — Everything Sorted