Privacy Policy

This policy applies to visitors, prospective customers, authorised institution administrators and users of Devvelocity services. For website enquiries, platform administration and Devvelocity billing, Devvelocity determines why and how relevant personal data is processed.

For student, parent, applicant, employee, faculty and other records entered into an institution workspace, the subscribing institution normally determines the purposes and means of processing. Devvelocity processes that data on the institution’s documented instructions as its technology service provider. Users should generally submit requests about institution records to their institution first.

• Identity and contact information, including name, email, phone number, designation and organisation.
• Account, authentication, role, permission and security-event information.
• Institution records configured or uploaded by authorised tenant users, depending on enabled modules.
• Subscription, invoice, transaction reference, payment status and refund information. Complete card, bank or UPI credentials are processed by the payment provider and are not stored by Devvelocity.
• Device, browser, IP address, diagnostic, audit, usage and support information.
• Communications, demonstrations, enquiries and support correspondence.

We process data to provide and secure the service, authenticate users, enforce permissions and subscriptions, operate requested workflows, deliver support, process billing, issue invoices, prevent fraud, maintain audit trails, improve reliability, communicate service information and comply with legal obligations.

Processing is based on consent where required, performance of customer agreements, compliance with law and other lawful uses recognised by applicable law. We do not sell personal data.

Each institution is responsible for having a lawful basis and giving appropriate notices before placing personal data in its workspace; configuring authorised users and retention; responding to data-principal requests; and ensuring that sensitive workflows are used consistently with education, employment and other applicable laws.

Education records may relate to children. Such information is processed only through an authorised institution relationship and according to institution instructions. Institutions are responsible for obtaining verifiable parental consent or another legally permitted basis where required and for avoiding processing that is detrimental to a child’s well-being.

Information may be shared with vetted providers supporting cloud hosting, database infrastructure, email and messaging, customer support, monitoring, file storage, analytics and payment processing. Bank-transfer or UPI payment references and supporting proof are processed to verify subscription payments and maintain billing records. We may also disclose information where required by law, to protect users and the service, during a corporate transaction subject to appropriate safeguards, or with valid authorisation.

Providers or support operations may process data outside the user’s state or country. Where cross-border processing occurs, we use contractual and technical safeguards and comply with restrictions notified under applicable Indian law.

We retain data only for the period needed for the stated purpose, the customer agreement, security, dispute resolution and legal or accounting obligations. Tenant-controlled records follow the institution’s configuration and contract. Backups may retain deleted information for a limited recovery cycle before secure expiry. Billing, tax, fraud-prevention and audit records may be retained for legally required periods.

We use reasonable administrative, technical and organisational safeguards such as tenant scoping, role-based access, authentication controls, encryption where appropriate, audit logging, monitoring, backups and controlled operational access. No internet service is completely risk-free. Customers must protect credentials, configure permissions carefully and report suspected compromise promptly.

Subject to applicable law, individuals may request information about processing, access a summary of personal data, correct inaccurate or incomplete data, request erasure where retention is no longer required, withdraw consent, seek grievance redressal and nominate another person to exercise rights in permitted circumstances.

For institution workspace data, contact the relevant institution. For Devvelocity-controlled website, billing or account data, use the contact page. We may verify identity and retain information where law or legitimate security requirements require it.

We use essential browser storage for authentication, security, tenant routing and user preferences. Optional analytics or marketing technologies, if introduced, will be described and offered with controls where legally required. Blocking essential storage may prevent sign-in or core functionality.

We investigate suspected personal-data incidents and notify affected customers or authorities when required. Privacy concerns may be submitted through the Devvelocity contact page with the subject “Privacy grievance”. Institution-data complaints should first be raised through that institution’s grievance channel. Applicable rights may also include escalation to the Data Protection Board of India according to the statutory process.

We may revise this policy when services or laws change. Material changes will be communicated through the website, service or registered contact channels. The date above identifies the current version.