Privacy Policy

1. Introduction & Corporate Identity

Welcome to Baryons Tech Solutions Pvt. Ltd. ("Baryons", "we", "us", or "our"), a technology and software development company incorporated under the laws of Nepal, having its primary office at Lazimpat, Kathmandu-2, Nepal (website: baryonstech.com.np).

We respect your privacy and are committed to protecting the personal data of our users, clients, educational institutions, teachers, parents, students, and business representatives. This Privacy Policy details our policies and practices regarding the collection, storage, use, synchronization, and disclosure of information when you access or use:

• School MIS (Management Information System) – Available as a responsive web portal, Android application (Google Play), and iOS application (Apple App Store).
• Mini CRM Mobile Application – A dedicated mobile application (Android and iOS; mobile-only, no web portal) operating with offline local caching and cloud database synchronization via Supabase.
• Our official corporate website (baryonstech.com.np) and related software development services.

2. Scope of Covered Applications

This Privacy Policy specifically addresses the distinct operational characteristics of our primary software products:

3. Information We Collect

The type of personal and organizational data we collect depends on the specific application, user role, and permissions granted:

3.1 Information Collected via School MIS

• Student & Parent Identity Information: Student full name, date of birth, gender, class/grade, section, roll number, admission number, home address, emergency contacts, parent/guardian full names, phone numbers, and email addresses.
• Academic & Schooling Data: Daily attendance records, examination marks, grade sheets, report cards, teacher feedback, disciplinary remarks, homework assignments, and timetable schedules.
• Administrative & Fee Records: Tuition fee invoices, payment status, scholarship allocations, receipt numbers, and bus/transportation route details. (Note: We do not process or store raw debit/credit card numbers or online banking passwords; payments are handled directly by certified third-party payment gateways such as eSewa, Khalti, or commercial banking portals).
• Media & Documents: Student ID photos, homework submissions, teacher circulars, and institutional noticeboard attachments.

3.2 Information Collected via Mini CRM Mobile App

• User Account Credentials: Registered email address, user display name, phone number, and hashed authentication credentials.
• Customer & Lead Data: Client contact names, company names, contact numbers, email addresses, lead pipeline stages, deal values, meeting notes, call logs manually recorded by the user, and follow-up schedules.
• Local Cache Data: CRM entries stored locally in an encrypted on-device SQLite database prior to synchronization with Supabase.

3.3 Automatically Collected Device & Technical Diagnostics

• Device Specifications: Smartphone or tablet device model, operating system version (Android or iOS), unique device identifiers (for push notification routing), and app build version.
• Network State & Connectivity: Real-time network reachability (detecting WiFi or mobile cellular connectivity) strictly used to determine whether the app should operate in offline mode or initiate cloud synchronization.
• Application Performance & Crash Logs: Anonymous crash logs, stack traces, and system error events to identify bugs and enhance mobile app stability.

4. Database Architecture: Supabase Cloud & Offline Sync

Our mobile architecture has been engineered with security and resilience at its core:

5. Mobile Device Permissions & Purposes

To deliver essential functionality on Android and iOS devices, our apps request specific runtime permissions. You can manage or revoke these permissions anytime via your device settings:

Permission	Application	Reason & Purpose
Camera	School MIS & Mini CRM	Capturing student/staff profile pictures, uploading homework assignments, taking photos of school receipts, or scanning business cards into CRM contacts.
Storage / Media Library	School MIS & Mini CRM	Downloading exam report cards, saving fee invoices to device storage, uploading PDF circulars, and selecting gallery photos for user profiles.
Push Notifications	School MIS & Mini CRM	Delivering timely school notices, attendance alerts to parents, examination date releases, fee payment reminders, and CRM task follow-ups.
Network State / Internet	School MIS & Mini CRM	Detecting offline/online network transitions to trigger background data synchronization with the Supabase database.

6. Children & Student Privacy (Compliance with Child Protection Standards)

Because our School MIS processes educational information pertaining to students—many of whom are minors under the age of 18—we enforce stringent child privacy and data protection principles compliant with the Children's Online Privacy Protection Act (COPPA), General Data Protection Regulation (GDPR-K), and Nepal's Individual Privacy Act, 2075:

• School Authorization & Parental Consent: The subscribing school or academic institution acts as the primary Data Controller. The institution is solely responsible for obtaining requisite consent from parents or legal guardians upon school enrollment before uploading student profiles into the system. Baryons Tech Solutions acts strictly as a secure Data Processor.
• No Commercial Profiling: We strictly prohibit behavioral advertising, profiling, or monetization of student records. Student personal data is never shared with advertising networks or third-party data brokers.
• Parental Inspection & Correction: Parents and guardians have the right to review their child's educational records, attendance, and exam grades through the dedicated parent login portal or by contacting the school administration.

7. How We Use Collected Information

We use the data we collect solely for legitimate educational, operational, and commercial purposes:

• To deliver, maintain, authenticate, and personalize the School MIS web and mobile applications.
• To enable field sales representatives and business users to organize client contacts, sales pipelines, and follow-up activities offline and online in the Mini CRM app.
• To securely synchronize offline local records with the Supabase cloud infrastructure.
• To generate student report cards, attendance summaries, billing notices, and administrative analytics for schools.
• To transmit administrative notifications, emergency alerts, and updates via push notifications, SMS, or email.
• To troubleshoot bugs, prevent fraudulent access, ensure cybersecurity, and comply with applicable statutory laws.

8. Sharing & Third-Party Disclosures

We never sell, rent, or trade your personal data. Disclosures are strictly limited to the following circumstances:

• Authorized Institutional Users: Within School MIS, authorized school staff (Principals, Teachers, Accountants) access student records in alignment with their assigned Role-Based Access Controls (RBAC).
• Cloud & Infrastructure Providers: We utilize trusted enterprise vendors including Supabase (Database, Auth & Storage), Google Firebase / Apple APNs (Push Notification dispatch), and certified cloud hosting servers. These vendors are legally bound to confidentiality and are barred from using your data for independent purposes.
• Payment Service Providers: If schools enable online fee collection, transactions are processed directly by licensed payment gateways (e.g., eSewa, Khalti, connectIPS, bank gateways). Only necessary invoice identifiers and amounts are passed to complete transactions.
• Legal & Regulatory Obligations: We may disclose information if required to do so by a court order, statutory regulation, law enforcement inquiry, or to protect the vital safety of individuals under the laws of Nepal.

9. Data Security & Tenant Isolation

Baryons Tech Solutions employs modern, defense-in-depth technical and organizational measures to protect your information:

• Multi-Tenant Data Isolation: With Row-Level Security (RLS) configured in our Supabase PostgreSQL database, each school or CRM tenant is strictly partitioned. It is architecturally impossible for one institution to query or access data belonging to another.
• Encryption Standards: Data in transit is protected using end-to-end 256-bit TLS/SSL encryption. Sensitive credentials, authentication tokens, and local offline caches are secured using platform-native encryption (Android Keystore / iOS Keychain / Encrypted DB).
• Authentication: Secure JSON Web Tokens (JWT), session expiry policies, and role-based permissions prevent unauthorized API access.
• Routine Backups: Automated encrypted database backups ensure business continuity and disaster recovery.

10. Data Retention, Account Deletion & Data Erasure

We comply fully with Apple App Store Guideline 5.1.1(v) and Google Play Store User Data Deletion policies:

• Retention Period: School MIS data is retained for the duration of the institutional contract or as mandated by educational compliance standards. Mini CRM records are retained as long as the user's account remains active.
• In-App Account Deletion: Users of our mobile applications can initiate account deletion directly from the mobile app's Settings > Profile > Delete Account menu.
• Direct Deletion Requests: You may also request the deletion of your account and associated personal data by emailing our Data Protection Team at info@baryonstech.com.np with the subject line "Account & Data Deletion Request". Upon verifying your identity, we will permanently purge or anonymize your data from our active Supabase database within thirty (30) business days, subject to mandatory legal record-keeping requirements.
• Institutional Termination: When a school terminates its service agreement, a complete export of academic records is provided to the school administration, following which the tenant data is scheduled for secure destruction.

11. Your Legal Rights

Depending on your jurisdiction and role, you have the following rights regarding your personal information:

• Access & Portability: The right to request a copy of the personal information we maintain about you.
• Rectification: The right to request correction of inaccurate, incomplete, or outdated personal or academic records.
• Withdrawal of Consent: The right to withdraw consent for push notifications or optional permissions at any time via device settings.
• Lodge a Grievance: The right to submit questions or complaints regarding data processing directly to our Grievance Officer.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect advancements in technology, product enhancements (such as new features in School MIS or Mini CRM), or legislative modifications. When revisions occur, the updated policy will be published on our website (baryonstech.com.np/privacy-policy.html) with an updated effective date. For material changes affecting student data or core permissions, notice will be displayed within the mobile applications.

13. Contact Information & Grievance Officer

If you have questions, comments, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our team: