Privacy Policy

1. Who We Are

LibraryStu is a digital platform designed to help libraries manage administrative operations, including administrator accounts, student records, seat allocation, fee-related information, and smart attendance tracking.

This Privacy Policy applies to the LibraryStu website, application, and related services.

For privacy-related questions, requests, or complaints, please contact us using the details provided in the Grievance and Contact section below.

2. Our Role in Processing Personal Data

Our role may differ depending on the type of personal data and the circumstances in which it is processed.

Library Administrators are responsible for ensuring that they have the lawful authority and an applicable legal basis to collect and provide Student Data to LibraryStu. Where applicable law requires consent, the Library Administrator is responsible for obtaining and maintaining the required consent.

3. Personal Data We Collect

• Administrator Data: full name, email address, securely managed authentication credentials, library name, and technical information such as IP address and security or access information where generated by the service.
• Student Data Processed on Behalf of Libraries: student name, contact number, seat allocation, residential address, monthly fee payment status, and attendance logs, to the extent entered or generated by the relevant Library Administrator or system features.
• Device Permissions and Geolocation Data: when utilizing our smart attendance features, we may collect precise GPS coordinates or location information to verify physical check-ins at the library (ensuring students can check in only when their location passes the study hall's attendance verification), and request camera access strictly to scan QR codes for attendance tracking. We do not store or capture unauthorized media or continuously track background locations outside of active check-in verification.
• Transaction Information: payment and subscription-related information made available to us by our payment provider, such as transaction identifiers, payment status, and subscription information. LibraryStu does not intentionally collect or store raw debit or credit card numbers or banking authentication credentials.
• Communications: information you provide when contacting us for support, account assistance, privacy requests, or other communications.

We do not intentionally collect personal data that is not reasonably necessary for the operation, security, and support of LibraryStu or for another purpose permitted by applicable law.

4. How We Use Personal Data

We may process personal data as necessary to:

• create and manage LibraryStu accounts;
• provide and maintain the LibraryStu service;
• process student data according to the relevant Library Administrator's instructions;
• authenticate users and secure accounts;
• prevent fraud, abuse, and unauthorized access;
• process subscriptions and payments;
• deliver OTPs and other service-related communications;
• provide technical support and troubleshoot problems;
• maintain, improve, and secure the service;
• respond to privacy requests and complaints; and
• comply with applicable legal obligations.

We do not sell personal data or use Student Data for targeted advertising or independent advertising or AI profiling.

5. Children and Student Data

LibraryStu may process Student Data relating to individuals under 18 years of age when that data is entered by a Library Administrator. The relevant Library Administrator is responsible for ensuring that it has the lawful authority and any consent or verifiable parental or guardian consent required by applicable law before providing such data to LibraryStu.

LibraryStu does not knowingly use Student Data for targeted advertising or behavioral monitoring of children. We process Student Data for the operation and administration of the relevant library's use of the LibraryStu service.

6. Service Providers and Sub-Processors

We may use service providers that process information on our behalf or provide infrastructure necessary to operate LibraryStu. These currently include:

• Supabase: provides authentication and database infrastructure used to support LibraryStu.
• Vercel: provides website and application hosting and infrastructure services.
• Resend: helps us deliver transactional and security-related emails, including OTP verification emails.
• Razorpay:processes subscription payments and payment transactions. Payment processing information is handled according to the applicable payment provider's systems and policies.

We may also disclose personal data where reasonably necessary to comply with applicable law, a valid legal process, or to protect the rights, security, property, or safety of LibraryStu, our users, or others.

Our service providers may process data in locations outside the user's state or country, subject to applicable law and the safeguards and contractual arrangements applicable to those providers.

7. Data Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, misuse, or disclosure. These measures may include encryption of data in transit, authentication controls, access controls, security monitoring, and other safeguards appropriate to the nature of the service.

However, no method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we take reasonable steps designed to protect personal data and to respond to security incidents in accordance with applicable law.

8. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the service, to comply with applicable law, to resolve disputes, and to maintain appropriate security and fraud-prevention records.

Library Administrators may use the Factory Reset functionality to initiate deletion of workspace data from our active systems. A Factory Reset may not necessarily delete the Administrator's LibraryStu account unless the account is separately deleted.

Account deletion requests may be submitted through the applicable account settings or through the account deletion process provided by LibraryStu. Where an account is deleted, associated personal data will be deleted from our active systems, except for limited information that we may retain for legitimate purposes such as security, fraud prevention, dispute resolution, transaction records, backup management, or compliance with applicable law.

Certain security and administrative logs may be retained for up to one year for security, fraud prevention, troubleshooting, dispute resolution, and compliance purposes. Data remaining in secure backups may be retained until overwritten or deleted in accordance with our backup and retention practices.

9. Data Principal and Privacy Rights

Where LibraryStu acts as the Data Fiduciary for Administrator Data, Administrators may contact us to exercise rights available under applicable law, including rights relating to access, correction, completion, updating, erasure, grievance redressal, or other rights that may apply.

For Student Data processed on behalf of a library, privacy requests should generally be directed to the relevant Library Administrator, which determines the purposes and means of processing that data. LibraryStu may provide reasonable technical assistance to the relevant library where appropriate.

We may need to verify the identity and authority of a person making a privacy request before acting on the request.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices, or applicable law. When we make changes, we will update the "Last Updated" date above and may provide additional notice where required or appropriate.

11. Grievance and Contact

If you have a privacy-related question, complaint, or grievance, please contact:

We will handle grievances and privacy requests in accordance with applicable law and within the time periods that may apply.