One platform for all your management needs

1. Information We Collect

1.1 Information you provide directly

• Account information: full name, email address, phone number, organisation name, business type, and password (stored as a salted hash — never in plain text).
• Organisation configuration: address, logo, branding colours, subscription plan, billing details.
• Member records: member names, dates of birth, contact details, emergency contacts, photographs, membership plan, batch enrolment, fee history, attendance records, notes, and any custom fields you configure.
• Staff records: staff names, roles, contact details, attendance, and salary information.
• Financial data: payment amounts, payment dates, transaction references, late fees, refunds, and expense records.
• Communications content: messages and notifications you send through the Service to members or staff.
• Uploaded files: documents, certificates, and images you upload to the Service.
• Support communications: the content of emails or messages you send to our support team.

1.2 Information collected automatically

• Usage data: pages viewed, features used, actions taken within the dashboard, session duration, and navigation paths.
• Technical data: IP address, browser type and version, operating system, device identifiers, timezone, and referring URLs.
• Log data: server-side logs including request timestamps, HTTP status codes, and error traces (used for debugging and security monitoring).
• Cookies and similar technologies: see Section 7.

1.3 Information from third parties

• Google OAuth:if you sign in with Google, we receive your name, email address, and profile photo from Google, subject to Google's own privacy policy.
• Payment providers: Razorpay provides us with payment confirmation references and masked payment details (e.g., last four digits of card). We never receive or store full card numbers.

2. How We Use Your Information

We process personal information for the following purposes:

• Service delivery: to create and manage accounts, store your data, and provide all features of the platform.
• Billing and payments: to process subscription fees, generate invoices, and manage payment failures or refunds.
• Communication: to send transactional emails (fee reminders, receipts, verification codes, password resets) and WhatsApp messages you trigger through the platform.
• Service notifications: system alerts, maintenance notices, and important policy updates.
• Support: to respond to queries, diagnose issues, and improve the quality of support we provide.
• Security and fraud prevention: to detect, investigate, and prevent unauthorised access, abuse, or fraud.
• Analytics and improvement: to understand how the Service is used in aggregate and to develop new features. We use anonymised or aggregated data for this purpose wherever possible.
• Legal compliance: to comply with applicable laws, regulations, legal processes, or enforceable government requests.
• Marketing communications: with your explicit consent, to send product updates, new feature announcements, or promotional content. You may opt out at any time.

Legal bases (GDPR): We rely on the following legal bases for processing: (a) performance of a contract — to provide the Service you have signed up for; (b) legitimate interests — analytics, security, and fraud prevention; (c) legal obligation — where required by law; and (d) consent — for optional marketing communications and cookies.

3. Data Sharing and Third-Party Services

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

3.1 Sub-processors (third-party service providers)

We engage the following sub-processors to operate the Service. Each is bound by contractual obligations that restrict their use of your data to the provision of services to us:

3.2 Legal disclosures

We may disclose personal information where required by applicable law, court order, regulatory authority, or government request. We will, where legally permitted, notify you of such a request before disclosing your data.

3.3 Business transfers

If Nxiora is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you by email and provide 30 days' notice before your data is transferred to a new entity under a different privacy policy.

4. International Data Transfers

Your data may be processed in countries outside India, including the United States and the European Union, by the sub-processors listed above. Where data is transferred outside India, we ensure appropriate safeguards are in place in accordance with the Information Technology Act, 2000 and its rules, including contractual data processing agreements with our sub-processors.

For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Cookies and Tracking Technologies

We use the following categories of cookies:

• Strictly necessary cookies: Session tokens and CSRF tokens required for authentication and security. These cannot be disabled without breaking the Service.
• Preference cookies: Store your UI preferences (e.g., dark mode, language) between sessions.
• Analytics cookies (Google Analytics): Collect anonymised aggregate usage statistics. These are only set after you accept our cookie notice.
• Cookie consent record: A cookie storing your consent choice so we do not re-prompt you on every visit.

You can manage cookie preferences via the cookie consent banner shown on your first visit, or by configuring your browser settings. Disabling analytics cookies does not affect core platform functionality.

6. Data Retention

• Active accounts: We retain your data for as long as your account remains active.
• After account cancellation: Customer Data is retained for 90 days to allow for export. After 90 days it is permanently deleted from all primary systems.
• Backups: Encrypted database backups are retained for up to 30 days on a rolling basis. Your deleted data will be purged from backups within this window.
• Financial records: Transaction records required for tax and accounting purposes may be retained for up to 7 years as required by Indian law (Companies Act, 2013; GST laws), in a form that may be de-identified.
• Support records: Support correspondence is retained for up to 2 years.
• Audit logs: Security and access audit logs are retained for 12 months.

7. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS enforced).
• Passwords are hashed with bcrypt using a unique salt per user — never stored in plain text.
• Session tokens are generated with cryptographically secure random bytes (crypto.randomBytes).
• Database credentials and API secrets are stored as environment variables — never in source code.
• Role-based access control (RBAC) limits data access to authorised users only.
• All database connections use TLS. Data at rest is encrypted by our cloud providers.
• We conduct security reviews and dependency audits regularly.
• Sentry error monitoring is in place to detect anomalies.

Despite our best efforts, no method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to security@nxiora.com.

8. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data. To exercise any of these rights, email privacy@nxiora.com. We will respond within 30 days.

• Right of access: Request a copy of the personal data we hold about you or your organisation.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your account and personal data, subject to our legal retention obligations.
• Right to data portability: Export your Customer Data (members, fees, attendance records) in CSV or JSON format. You can initiate an export directly from the dashboard at any time.
• Right to restriction of processing: Request that we pause processing of your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests, or to direct marketing at any time.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint: If you are in India, you may contact the adjudicating officer under the IT Act. If you are in the EEA, you may lodge a complaint with your local data protection authority.

9. Children's Privacy

The Service is intended for use by organisations, not individual consumers. Accounts may only be created by individuals aged 18 or over. However, we recognise that our customers (e.g., schools, coaching centres) may store records for minor members.

As the data controller for their members' information, our customers are responsible for:

• Obtaining verifiable parental or guardian consent before entering a minor's personal data into the platform.
• Complying with applicable child data protection laws in their jurisdiction.
• Responding to parental requests for access, correction, or deletion of their child's data.

We act as a data processor with respect to minor member data and process it only on the documented instructions of our customer.

10. GDPR and IT Act 2000 Compliance

IT Act, 2000 (India): We comply with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We maintain a comprehensive information security programme and publish this Privacy Policy as required.

GDPR (European Economic Area): For users in the EEA, we act as a data controller with respect to account and usage data, and as a data processor with respect to Customer Data. We provide Data Processing Agreements (DPAs) upon request. Contact privacy@nxiora.com to request a DPA.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised policy on this page with an updated "Last updated" date. For material changes, we will send an email notification to the registered administrator at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

12. Contact and Data Protection Officer

For any privacy-related questions, to exercise your rights, or to request a Data Processing Agreement, please contact:

We aim to respond to all privacy inquiries within 30 days. For urgent security matters, please indicate "URGENT" in the subject line.