Privacy Policy

Last updated: 9 October 2026

SparkLMS is a school management and learning platform made by Aharbal (“Aharbal”, “we”, “us”). It is used by schools and their staff, parents and students through the SparkLMS Android and iOS apps and the websites at sparklms.in and app.sparklms.in (together, “SparkLMS”). This policy explains what data SparkLMS collects, why, who it is shared with, how it is protected and the choices you have.

In short

Your school decides what information it keeps in SparkLMS; we store and process it for the school.
We do not sell personal data, show ads, or use it for advertising or profiling.
Data is sent over encrypted connections, stored on secure servers and kept separate for each school.
We share data only with the services needed to run SparkLMS: payments (Razorpay), WhatsApp and SMS messages (YCloud), email and hosting.
You can ask your school, or us, to see, correct or delete your data.

1. Who is responsible for your data

Each school (or school group) that uses SparkLMS decides what information about its students, parents and staff is entered and how it is used. For that information the school is responsible for it (the “data fiduciary” under the Digital Personal Data Protection Act, 2023), and Aharbal processes it on the school’s behalf and under its instructions. Questions about a school’s records are best sent to the school first; we will help them answer you.

Aharbal is directly responsible for the information we collect for our own purposes: school sign-up applications, the accounts of our own team, and the security and operation of the service.

2. Information we collect

Information you or your school provide

Who	Information
Everyone with an account	Name, mobile number, email address and/or username, password (stored only as a secure hash), role, and the school(s) you belong to.
Students	Name, date of birth, gender, photo (where the school records consent), admission and roll numbers, class and section, address, and details the school chooses to record such as blood group, mother tongue, religion, category and Aadhaar number (stored encrypted, shown masked). Academic records: attendance, homework, assignments, tests, marks, results, report cards and certificates; library loans; leave requests; RFID card or QR codes and gate entry/exit times where the school uses them.
Parents and guardians	Name, relationship to the student, mobile number, email, address and, where the school records it, occupation and annual family income.
Staff	Name, contact details, designation, roles and permissions, staff attendance and leave, and the timetable, lesson plans and other work they enter.
Fees and payments	Fee structures, amounts due, concessions, payments, refunds and receipts. When you pay online, card, UPI and bank details are entered on Razorpay’s secure checkout and are not received or stored by SparkLMS; we receive the payment reference and status.
Messages and content	Notices, messages between parents and the school, feedback, events, gallery photos and videos, documents and other files that users upload.
School sign-up	The applicant’s name, role, email, mobile number, and the school’s name, board, location, approximate number of students and chosen plan.

Information collected automatically

Sign-in and security data: one-time codes (sent by WhatsApp, SMS or email), sign-in times, sessions, the IP address and the type of device or browser, used to keep accounts secure and to record who changed what (an audit log).
Technical logs: server logs with request times, IP addresses and errors, used to run and fix the service.
On the device: the apps store your sign-in session (encrypted using the Android Keystore or the iOS Keychain) and a few settings such as the child you last selected. Web pages opened inside the app use cookies only to keep you signed in.

SparkLMS does not collect your location, contacts, call logs, or advertising identifiers, and does not include advertising or third-party analytics SDKs.

3. How we use information

To provide SparkLMS to schools, staff, parents and students: attendance, homework, exams and results, fees, timetables, notices, messages and the other features a school turns on.
To sign you in and keep accounts secure: sending one-time codes, detecting misuse, and audit logs.
To send messages the school or the service needs to send, such as absence alerts, fee reminders, receipts, notices and sign-up updates, by WhatsApp, SMS, email or in-app notification.
To process fee payments and refunds, and to issue receipts.
To review and approve school sign-ups, provide support and bill schools for their subscription.
To maintain, secure and improve the service, and to meet legal obligations.

We do not sell personal data, rent it, or use it for advertising or to build marketing profiles.

Information is visible inside SparkLMS only to people your school has given access to, according to their role (for example, a parent sees only their own children). Outside the school, we share data only with these kinds of parties, and only what they need:

Party	Purpose	Data
Razorpay (payment gateway)	Online fee payments and refunds, paid directly into the school’s account	Payer’s name, mobile and email, amount and order details; payment details you enter on Razorpay’s checkout. Razorpay may collect device information for fraud prevention under its own privacy policy.
YCloud (WhatsApp Business and SMS provider)	Sending one-time codes and messages such as absence alerts and notices	Mobile number and the message content
Hosting and email providers	Running our servers and sending email	All data stored in SparkLMS, which they host and do not use for their own purposes
Your school and its staff	Running the school	As described above, according to each person’s role
Authorities	When required by law or to protect people’s safety or rights	Only what the law requires

If Aharbal or SparkLMS is reorganised or transferred, data would move only under the same protections, and schools would be told in advance.

5. Children’s data

SparkLMS is used by schools, so it holds information about students, many of whom are under 18. Student records are created and managed by the school. Schools are responsible for obtaining any consent needed from parents or guardians, as required by law, and parents normally use SparkLMS on their child’s behalf. Older students may sign in only where their school allows it. We never use children’s data for advertising, tracking or profiling, and we process it only to provide the service to the school.

6. How we protect data

All connections use HTTPS (TLS) encryption.
Passwords are stored only as Argon2 hashes; Aadhaar numbers are encrypted in the database.
Each school’s data is kept separate by database row-level security, and access inside a school follows the roles and permissions the school sets.
Sign-in sessions on phones are encrypted with the Android Keystore or the iOS Keychain.
Important changes are recorded in an audit log, and the servers are backed up every night.

No system is completely secure. If a breach affecting personal data happens, we will inform the affected schools and, where required, the Data Protection Board and the people affected.

7. How long we keep data

School records are kept for as long as the school uses SparkLMS, so the school can keep students’ history from year to year.
When a school stops using SparkLMS, it can ask for an export of its data; we then delete it, except records we or the school must keep by law (for example, fee and tax records).
One-time codes expire within minutes; sign-in sessions end after at most 30 days without use.
Nightly backups are kept for 7 days and then overwritten.

8. Your rights and choices

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you can ask to:

see the personal data held about you and how it is used;
correct or update it (much of it you can change yourself, for example your password);
have it deleted, where it is no longer needed and the law does not require us or your school to keep it;
withdraw consent you have given, and nominate someone to exercise these rights for you;
raise a grievance with us, and then with the Data Protection Board.

For school records, contact your school first; you can also write to us at privacy@aharbal.com and we will work with your school to respond. We may need to confirm your identity before acting on a request.

9. Deleting your account and data

You can ask for your SparkLMS account and the personal data linked to it to be deleted at any time on the Delete your account page (also linked from the app’s More menu), by emailing privacy@aharbal.com, or through your school’s office. We confirm the request with you first, then delete your account within 30 days. That page lists exactly what is deleted and what is kept, and for how long.

10. The mobile apps and device permissions

The SparkLMS Android app asks only for internet access. It does not ask for location, camera, microphone, contacts or storage permissions. When you pay online, Razorpay’s checkout may open a UPI app you choose. Screens that are not yet built into the app open the SparkLMS website inside the app, already signed in; this policy covers them too. Links to other websites open in your browser and are covered by those sites’ own policies.

11. Changes to this policy

We may update this policy as SparkLMS changes. The date at the top shows the latest version. If we make significant changes, we will tell schools before they take effect.

12. Contact and grievances

For privacy questions, requests or complaints, contact our Grievance Officer at privacy@aharbal.com. We acknowledge requests within 7 days and aim to resolve them within 30 days.

Aharbal, Kashmir · sparklms.in