Who we are
NepEdu is management software for learning institutions in Nepal: schools, colleges, coaching centres, language and training institutes, and academies. It is operated by NepEdu Pvt. Ltd., of Kathmandu, Nepal. In this policy, “we”, “us” and “NepEdu” mean that company.
This policy covers two different things, and the difference matters, because it decides who you should contact about your data.
- The nepedu.com website. The marketing site you are reading now. Here we decide what data is collected and why, so we are the controller of it.
- The NepEdu platform. The application your institution signs in to, on the web and in the NepEdu app for iPhone and Android. Everything inside it, from learners and guardians to staff, attendance and fees, belongs to the institution. The institution decides what goes in and who may see it; we only hold and process it on the institution’s instructions. In legal terms the institution is the controller and we are the processor.
If you are a learner, parent or guardian
Your institution is the one that decides what is recorded about you and for how long. Ask it first, because it can correct or remove records directly. If it needs us, we help it. We never sell your data, and we never use it to advertise to you.
What we collect on this website
When you use the contact form
We store what you type, meaning your name, email address, your institution’s name and your message, so that we can reply. We also record the IP address and browser user-agent the submission came from. We use those two only to filter spam and investigate abuse, not to profile you.
When you simply browse
This website uses Google Analytics to count visits and see which pages are read, and Microsoft Clarity to see where people click, scroll and get stuck. Clarity replays a visit to these public pages as movement on the page; it is not a recording of your screen, it does not follow you elsewhere, and neither tool runs inside the NepEdu application, which is where the learner records are. Between them they tell us things like “180 people read the pricing section this week”, not who you are. Neither one loads until you agree to it, and not answering counts as no. There is no advertising, no retargeting and no data brokering on this site. The Cookie Policy lists exactly what is set, and how to opt out.
Enquiries are kept while we are in touch with you and for a reasonable period afterwards as a record of the conversation. Ask us and we will delete yours.
What the platform holds for your institution
An institution uses NepEdu to run its day-to-day operations, so the platform holds the records that job requires. Exactly which fields are filled in is up to each institution. This is the full range the system can store:
| Category | What it can include |
|---|---|
| Identity & contact | Name, username, email address, phone number, and the institution and role a person belongs to. |
| Learner records | Admission or registration number and date, class, batch or section, roll number, religion, previous institution, guardian relationships, and documents the institution uploads. |
| Guardian records | Where a learner has a guardian on file: their relationship to the learner, occupation and workplace, and contact details. |
| Staff & HR records | Employee ID, designation, department, qualification, employment type, joining date, working hours, and leave. |
| Day-to-day institutional life | Attendance, homework, notices, events, the timetable, and fee invoices, payments and concessions. |
| Technical & audit | Sign-in activity, the IP address a sign-in came from (used to lock out brute-force attempts), and an audit trail of who created or changed a record. |
| Mobile app | For people who switch on notifications in the NepEdu app: the phone’s notification token, whether it is an iPhone or an Android phone, and the app version. Also which notices and updates a person has opened, so the app can show what is new. |
This includes children’s data, and we treat it accordingly
Much of what NepEdu holds is about minors. That is the reason the platform is built the way it is: every record is walled off by institution and fails closed rather than open, teachers only see the learners they actually teach, and guardians only see their own children. We do not profile learners, we do not run analytics or advertising inside the application, and we do not train any product on institution data. The Security page explains how this is enforced in the code.
Where the learners are adults, as they often are at a college, coaching centre or training institute, there may be no guardian on the record at all. Nothing above depends on one existing: the same protections apply to the learner directly, and the rights in this policy are theirs to exercise.
The NepEdu mobile app
The NepEdu app for iPhone and Android is another way into the same platform. It signs in to the same account, shows only what your institution’s permissions already allow, and what it shows or sends is part of the institution’s records, exactly as described above. The institution stays the controller and we stay the processor.
What the app sends to us
- Signing in. Your username, email address or phone number, and your password, over an encrypted connection.
- What you choose to send your institution. A leave request and its reason, a library reservation, or a report that you have paid a fee: the amount, date, method, reference and payer’s name, with a screenshot of the payment if you attach one. These become part of the institution’s records.
- Notifications, if you allow them. The phone’s notification token, whether it is an iPhone or an Android phone, and the app version, so that notices, results and other updates reach that phone. Apple delivers them to iPhones and Google’s Firebase Cloud Messaging to Android phones. Both see the token and the text of the notification, nothing else. You can turn notifications off in your phone’s settings at any time, and signing out stops them on that phone.
- What you have opened. Which notices, results and other updates you have read, so the app can mark what is new.
What stays on your phone
The app remembers that you are signed in, and the institutions you picked recently, on that phone only. Signing out removes your sign-in from the phone, and uninstalling the app removes everything it stored there. A grade sheet or receipt you download goes only where you choose to save or share it, and once it leaves the app it is in your hands.
What the app does not do
The app has no advertising and no analytics, tracking or crash-reporting tools. It does not use your phone’s advertising identifier, does not follow you across other apps or websites, and never asks for your location, contacts, camera or microphone. It opens your photos only when you pick a payment screenshot to attach.
Children using the app
Many of the people who use the app are children, some of them under 13. Their accounts are created by their institution, never by the app, so the institution handles any consent it needs from a parent or guardian. The app follows the Google Play Families Policy, and on every store it carries no ads and no tracking. The protections for children’s data described above apply in the app in full.
Deleting your account or your data
The app cannot create accounts. Your institution creates them, and it can correct or remove them, so ask your institution first. You can also write to us at hello@nepedu.com. We will confirm the request with your institution and then act on it, because we do not delete an institution’s records on an unverified request. Uninstalling the app deletes what it stored on your phone, but not your records at the institution.
Apple and Google run the App Store and Google Play under their own privacy policies. Downloading the app from them is covered by those policies, not this one.
How we use data, and why we are allowed to
- To provide the service. We run the platform your institution pays for, and send the transactional messages it generates: an account invitation, a password reset, a notice sent by the institution, or a notification to the NepEdu app.
- To keep it secure. We detect and block brute-force sign-in attempts, investigate abuse, and keep an audit trail so an institution can see who changed what.
- To support and improve it. We diagnose faults an institution reports, and learn which parts of this website people read. Support access to an institution’s live data happens only where it is genuinely needed to fix a reported problem.
- To reply to you. We answer what you send us, and we send service announcements such as planned maintenance or a change to these terms.
We process this data to perform our contract with the institution, to meet our legal obligations, and for the legitimate interest of running a secure service, consistent with Nepal’s Individual Privacy Act, 2075 (2018) and the rules made under it. Where consent is the basis, whether from an adult learner or from the parent of a child, it is the institution that collects and holds it.
What we never do
We do not sell personal data. We do not share it with advertisers or data brokers. We do not use one institution’s data to serve another. We do not use learner, guardian or staff data to train AI models.
Where the data is kept
The platform, its database and its backups run on cloud infrastructure hosted outside Nepal, and some of the providers listed above are also based outside Nepal. That means your institution’s data is transferred across borders in the course of being stored and processed.
Wherever it sits, the protections described in this policy and on the Security page follow it: encrypted in transit, access-controlled, and covered by contractual terms with our providers.
How long we keep it
- Institution data. Kept for as long as the institution’s account is active. Institutions keep learner records for years by design; that is their call, not ours.
- After an institution leaves. It has 30 days to export its data. After that window we delete it from the live system, and it is removed from our backups shortly afterwards.
- Website enquiries. Kept as a record of our correspondence, and deleted on request.
Your rights over your data
You can ask to see the personal data held about you, have it corrected if it is wrong, have it deleted where there is no reason to keep it, and object to how it is being used.
Where to send that request
If you are a learner, guardian or member of staff: go to your institution. It controls the record and can act on it immediately. If it asks us for help, we help it. But we will not change or hand over an institution’s records on a third party’s say-so, because doing that on request is exactly how data gets leaked.
If you contacted us through this website: email us and we will deal with it directly.
How we protect it
Data safety is the first thing NepEdu is built for, not a paragraph added at the end. Traffic is encrypted in transit, every record is scoped to one institution and fails closed, permissions are enforced on the server rather than hidden in the interface, sessions are revoked when a password changes, and your data is backed up automatically.
The Security page covers the principles. We keep the operational detail off the public web on purpose, but we share it with institutions who ask. If we ever suffer a breach that affects an institution’s data, we will notify that institution without undue delay.
Changes to this policy
If we change this policy we will update the date at the top of the page. If the change is significant, such as a new category of data or a new provider handling personal data, we will tell affected institutions directly rather than quietly editing the page.
Talk to us about privacy
Questions about this policy, or a request about your own data? Write to us and a person will answer. We would rather have the conversation than have you guess.