Privacy Policy — HiveCampus

Who we are, and which role we play

HiveCampus is school management software — attendance, homework, fees, leave requests, timetables, report cards, announcements and an AI Analyser — built and operated by TheHiveMinds, a product engineering studio based in Chennai, Tamil Nadu, India. This policy covers the HiveCampus web portals at hivecampus.in, the HiveCampus parent and student mobile app, and this public website.

We wear two different hats, and almost everything below depends on which one applies to you.

When a school uses HiveCampus, the school is in charge of the data

A school decides what student, parent and staff information goes into HiveCampus, who in the school may see it, how long it should be kept, and when it should be deleted. In the language of the Digital Personal Data Protection Act, 2023, the school is the Data Fiduciary and we are its Data Processor. We handle that data only to run the service for the school, and only on the school's instructions. We do not decide on our own account what to do with it.

The practical consequence: if you are a parent, teacher or member of staff and you want a record corrected, exported or erased, your school is the right first stop, because the school controls the record and we act on its instruction. We will always help the school do it, and you can write to us directly at info@thehiveminds.in if the school is unresponsive.

On our own website, we are in charge

For our public marketing pages and the enquiry form on them — where a school that is not yet a customer leaves its details — we are the Data Fiduciary and answer for that data ourselves. That is covered in §12.

What information is in HiveCampus

The list below is exhaustive as of 9 September 2026. It reflects what the software actually stores, not what a school might imagine an ERP collects. Not every field is used by every school — a school that does not use the fees module has no fee records at all.

About students

Name, admission number, class and section, and academic year.
Date of birth and gender, where the school records them.
A photograph. The product has a place for one, but as of 9 September 2026 no school is using it and we hold no student photographs at all — see §07.
Daily attendance — present, absent or late, half-day sessions, and leave timings.
Homework set for the student's section, and its due dates.
Leave requests raised by a parent, and their approval status.
Exam terms, exam dates and report card marks and grades, where the school uses report cards.
Fee records: what is due, what has been paid, receipt numbers, payment method and any note the school types on a payment.

About parents, teachers, staff and administrators

Name, role in the school, and where recorded, designation.
Email address and phone number, used for signing in and for contact.
A profile photo, where uploaded.
Which students a parent is linked to, and the relation (father, mother or guardian).
For teachers and staff: leave requests, substitution assignments, timetable allocations, and a record of which teacher marked which attendance register.

Generated by using the product

Push notification device tokens, so a phone can receive a notification.
Notifications sent, and whether an announcement has been read.
Monthly aggregate summaries used by the AI Analyser (see §05), and a count of how many times a student's Analyser page was opened.
Ordinary server and security logs kept by our infrastructure providers, including IP addresses, for the limited period they retain them.

What is not here

HiveCampus does not collect biometric data, does not track location or school buses, does not read a device's contacts, photos, microphone or messages, and has no chat feature. It does not process card, UPI or bank details — see §07 of the Terms of Service for why the fees module never touches money.

Children’s data and parental consent

Most of the people HiveCampus holds records about are children, and we treat that as the defining constraint on the product rather than an edge case.

Under the Digital Personal Data Protection Act, 2023, processing a child's personal data requires verifiable consent from a parent or lawful guardian. The school holds the relationship with the family and enrols the student, so the school is responsible for obtaining that consent and for confirming that the person it links to a student really is that student's parent or guardian. Our Terms of Service make this a contractual obligation on the school, not an assumption.

The Act also prohibits certain things outright where children are concerned, and we do none of them: we do not use children's data for behavioural advertising, we do not track or profile children for any commercial purpose, and there is no advertising anywhere in HiveCampus.

A parent account in the app sees only that parent's own children. That limit is applied where the records are stored, not by what the app chooses to put on screen, so a request for another family's record returns nothing at all.

Why we process this information

Each purpose below is tied to running the service the school has asked for. We do not repurpose school data for anything else.

Running the product. Recording attendance, publishing homework, routing leave requests, issuing report cards, maintaining the fee ledger, and showing each person the part of it their role permits.
Authentication and access control. Signing users in, and deciding what a given role may read or write.
Notifying people. Sending push notifications and in-app messages for the events the school has enabled — an absence, new homework, an announcement, a leave decision, a fee reminder.
Producing the monthly summaries. The AI Analyser figures and written summaries described in §05.
Security and integrity. Detecting and investigating misuse, unauthorised access, and abuse of the service.
Support. Diagnosing a problem a school has reported to us. We access a school's live data only when it is necessary to resolve a specific reported issue or to comply with a legal obligation.
Legal and tax compliance. Keeping the invoicing and accounting records Indian law requires us to keep.

The AI Analyser, specifically

The AI Analyser gives a parent, teacher, administrator or our own estate view a monthly read on attendance and engagement. Because it is the one feature with “AI” in its name, it deserves an exact description rather than a reassuring one.

The numbers are plain arithmetic. Every figure on an Analyser page — attendance percentages, streaks, comparisons against a section average — is recalculated from the school's own records each time the page opens. No model is involved in producing them.
The written text is generated once a month, in a batch. After a month ends, an automated monthly process asks a language model to write a short summary from that month's totals, and saves it. Opening the page shows the saved text.
Nothing on these pages triggers a live model call. There is no “generate” or “ask” button, by design. A parent cannot cause their child's data to be sent to a model by tapping something.
What the model is given is deliberately thin. Aggregate monthly counts and a first name, so the sentence reads naturally. It is not given contact details, addresses, dates of birth, photographs, fee records, marks, or any free text a teacher or parent has written.
School data is not used to train models. We do not train, fine-tune or improve any model on school data, and we use the model provider on terms that exclude our inputs and outputs from their training.

A school that would rather not have the feature at all can have it switched off entirely, at which point no summaries are generated for it and the pages do not appear. Ask us and we will do it.

Read it as a prompt, not a verdict

Analyser summaries are a starting point for a conversation between a parent and a teacher. They are not an assessment of a child, and no decision about a student should be taken on their basis alone.

Messages and notifications we send

HiveCampus sends push notifications to the parent and teacher apps for events the school has enabled — attendance marked, homework set, an announcement published, a leave request decided, a fee falling due. These are service messages about the recipient's own school and child. They are not marketing.

We never use a school's parent or staff contact details to market anything, to anyone, ever — not our own products and certainly not a third party's. The contact details in a school's tenant exist to run that school's service and nothing else.

Push notifications can be turned off from the operating system's own notification settings on the device. Turning them off does not remove the record from the app; it stops the phone alerting about it.

Who else can see this data

Within a school, visibility follows role: an administrator sees their school, a teacher sees the sections they teach, a cashier sees the fee records, and a parent sees their own children. One school can never see another school's data — every record belongs to a single school, and that is enforced where the records are kept.

Outside the school, the data reaches only the infrastructure providers we need to run the service. Each is bound by its own contractual and security obligations, and each receives only what its function requires.

Provider	Why	What it receives
A managed PostgreSQL hosting provider	Holding the school's records and the accounts people sign in with	All school data held in the product
A push notification service	Delivering notifications to the parent and teacher apps	The notification text, and the code that lets a phone receive it
A file storage and delivery provider	Storing the files uploaded into the product and delivering them to the people the school shares them with	Homework attachments, school logos, announcement images and any profile photo a staff member or parent uploads
An AI language model provider	Writing the monthly AI Analyser summaries, once a month (see §05)	Monthly totals and a first name — never contact details, marks or fee records
A form delivery service	Delivering the enquiry form on our public website to our inbox	Only what a prospective customer types into that form
A meeting scheduling service	Scheduling demo calls booked from the public website	Only what the person booking enters

The last two appear on that list for completeness, but they only ever see what a prospective customer types into our public enquiry form or booking page. No student data reaches them.

Files uploaded into the product open without a login

Homework attachments, school logos and announcement images are delivered over links that open for anyone holding the link, without signing in. This is deliberate, and it is worth explaining rather than dressing up.

A homework attachment has to open for the parent, for the class teacher, for a substitute covering that class, and often for a tuition teacher the family has chosen to forward it to — on a shared family phone, on a school desktop, on a device with no app installed. Putting a login in front of it would mostly stop the people the school meant to reach.

So we would rather state the practical position than call it “secure storage”: these links are not listed, indexed or browsable anywhere, but they are not secret either. Anything uploaded should be treated as something that can be forwarded — which is, in practice, what a homework attachment is for.

Student photographs, and how to change any of this

As of 9 September 2026 the product holds no student photographs. The field exists and no school uses it.

If your school wants to use student photos, or simply wants its uploaded files placed behind a login, you only have to ask. We will put protected access in place across all of that school's files — and, where photographs are concerned, before any are uploaded rather than after. There is no charge for it and no need to justify the request.

What we will never do

We do not sell personal data. There is no arrangement under which any of it is sold, rented, bartered or licensed to anyone.
We do not share it with advertisers, data brokers or analytics networks, and the product carries no advertising, no third-party analytics scripts and no tracking pixels.
We do not use one school's data to benefit another school, or to build any aggregate product or benchmark, without that school's written agreement.
We do not train models on school data.

Legal disclosure

We may disclose data where we are legally required to — a binding order from a court or a competent authority, or where disclosure is necessary to establish or defend a legal claim, or to prevent an imminent risk to someone's safety. Where we receive such a demand about a school's data, we will tell the school before responding unless the law forbids us from doing so.

Where the data lives, and how long we keep it

A school's records are hosted in India. That is what most schools are asking when they ask this question: the register, the marks and the fee history stay in the country the school operates in.

Some of the providers listed in §07 operate worldwide, so uploaded images, notification text and public website requests are handled on their own networks. Where that happens we rely on the provider's contractual data protection commitments.

Retention

School data is retained for as long as the school's subscription is live, because an attendance or fee history is only useful across years.
A school can ask us at any time to delete specific records; we act on that instruction.
After a subscription ends, the school's data is retained for 60 days so that it can be exported or the school can change its mind, and is then deleted from live systems. A school that wants it deleted sooner can say so in writing and we will do that instead.
Backups roll off on their own schedule, and data in a backup is deleted as that backup expires — within 30 days of the deletion from live systems.
Invoices, tax records and the fact that a contract existed are kept for as long as Indian tax and company law requires, independently of the above. These contain a school's billing details, not student records.
Enquiry-form submissions from prospective customers are kept for up to 24 months and then deleted, or sooner on request.

How the data is protected

We maintain reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000. Concretely:

Permission is decided where the records are kept. Whether a person may see or change something is worked out from their school and their role at the point the records are read, not by what a screen chooses to show. Hiding a button is not a security control; refusing the request is.
Every change is re-checked. No part of the app can alter a record on its own say-so. Each change passes through a step that verifies the role of the person making it before anything is written.
Encrypted in transit and at rest. Data is encrypted while it travels and while it is stored, backups included.
Least-privileged staff access. Access to production data is limited to the founders who operate the service, is used only to resolve a reported problem or meet a legal obligation, and is protected by multi-factor authentication.
Schools are kept apart. Every record belongs to exactly one school, and that is part of how access is decided. One school's account has no route to another school's records.
Managed backups kept by our hosting provider, so a school's history survives an operational failure.

There is one deliberate exception to all of the above, and we would rather you read it here than discover it: files uploaded into the product are delivered over links that open without a login. §07 explains why, and how to have that changed for your school.

No system is perfectly secure, and we will not claim otherwise. If a personal data breach occurs, we will notify the affected school without undue delay after becoming aware of it, with what we know about what happened, what data was involved and what we are doing about it, and we will support the school in making any report it is required to make to the Data Protection Board of India or to CERT-In. Where we are the Data Fiduciary — our own website data — we will make those reports ourselves.

Found a vulnerability?

Write to info@thehiveminds.in with enough detail to reproduce it. We would much rather hear from you than not, we will not pursue anyone who reports a genuine issue in good faith without accessing or retaining other people's data, and we will tell you what we did about it.

Your rights, and how to use them

Under the Digital Personal Data Protection Act, 2023, an individual whose data is being processed has the right to obtain a summary of the data being processed about them and who it has been shared with, to have inaccurate or incomplete data corrected, updated or completed, to have data erased where it is no longer needed for the purpose it was collected for, to nominate another person to exercise these rights in the event of death or incapacity, and to a readily available means of grievance redressal.

If you are a parent, student, teacher or member of school staff

Ask your school first. The school controls the record, decides what is correct, and can make the change in HiveCampus directly — usually the same day. We will always help the school carry out a request, including exporting or deleting records where the school asks us to. Where the law requires the school to keep a record — an attendance register for a past academic year, for example — a request to erase it may be lawfully refused, and the school will tell you why.

If your school does not respond, write to us at info@thehiveminds.in and we will take it up with them and, where we are permitted to act, act on it ourselves.

If you are a school, or you contacted us through this website

Write to info@thehiveminds.in. We will respond within 30 days. We may need to verify your identity before acting on a request about personal data, which is a protection for you rather than an obstacle.

Under the Act, you are also expected to give information that is authentic and to not raise false or frivolous grievances — a duty we mention because the Act imposes it, not because it has ever been a problem.

Grievance redressal

If you are unhappy with how your data has been handled, tell us and we will fix it. We have not appointed a separate Grievance Officer as a matter of form — the founders who built and operate HiveCampus read this inbox and answer it themselves.

Contact for privacy and grievances

Entity: TheHiveMinds
Email: info@thehiveminds.in
Location: Chennai, Tamil Nadu, India
Response: Within 30 days of receipt

If we cannot resolve your complaint to your satisfaction, you may escalate it to the Data Protection Board of India.

This website, and cookies

Our public marketing pages carry no advertising, no third-party analytics, no tracking pixels and no advertising cookies. We do not build a profile of visitors and there is no consent banner because there is nothing to consent to.

The HiveCampus portals set a strictly necessary session cookie once you sign in. It exists to keep you signed in and cannot be turned off without breaking sign-in. It is not used for tracking.

If you fill in the enquiry form on this site, what you type — your name, your school, your email address, your phone number and your message — is delivered to our inbox through a form delivery service and used to reply to you and to prepare a quote. That is the one place on this site where we are the Data Fiduciary. We keep it for up to 24 months, we do not sell it, and you can ask us to delete it at any time at info@thehiveminds.in.

Our site links out to the TheHiveMinds site, to Google Play and to our scheduling page. Once you follow one of those links, that site's own privacy policy applies, not this one.

Changes to this policy

We will update this policy when the product changes in a way that affects it. When we do, the “last updated” date at the top changes with it.

For a change that materially affects how personal data is handled — a new category of data collected, a new purpose, or a new provider that receives personal data — we will notify subscribing schools by email at least 30 days before it takes effect, so a school has time to review it and, if it objects, to act. We do not make such a change quietly.

This policy is governed by the laws of India, and any dispute arising from it is subject to the exclusive jurisdiction of the courts at Chennai, Tamil Nadu, India. It should be read together with our Terms of Service, which govern the use of the service itself.

In force from 9 September 2026.

Questions about this document? Write to info@thehiveminds.in — a founder answers.

Read the Terms of Service →