Privacy Policy

1. Who We Are

Aurra is a cloud-based school operating system designed for private schools across Pakistan. We provide tools for student admissions, fee management, attendance, examination records, parent communication via WhatsApp, and school analytics — all from one secure workspace.

Our platform is operated by the Aurra team. You can reach us at admin@aurraos.com or at aurraos.com.

2. Data Controller vs. Data Processor

Under this arrangement:

• Your school (the Data Controller) decides what student, parent, and staff data is entered into Aurra, how long it is kept, and who has access to it within your workspace.
• Aurra (the Data Processor) stores and processes that data solely on your school's behalf and under your instructions. We do not use your students' personal data for any purpose outside of providing the platform to you.

This means your school is responsible for ensuring that any data you enter into Aurra has been collected with appropriate consent from students and parents.

3. What Data We Collect

A. School Account Data

When a school registers on Aurra, we collect:

• School name, address, city, and contact details
• Administrator name and email address
• Phone / WhatsApp number for support and notifications
• Subscription plan and billing information

B. Student & Parent Data (entered by your school)

Your school enters and manages this data. It may include:

• Student name, date of birth, gender, class, section, and admission number
• B-Form number (child's national identity number) — collected only when required by the school
• Father's name, Father's CNIC number — collected only when required by the school
• Parent / guardian name, phone number, and WhatsApp number
• Emergency contact name and phone number
• Home address and previous school name
• Fee records, payment history, and outstanding balances
• Attendance records and exam / result data
• Health notes or special requirements (if entered by the school)
• Student photo (stored on Cloudinary CDN — see Section 5)

C. Staff Data (entered by your school)

• Teacher and staff names, subjects, and contact details
• Login credentials (passwords are hashed — we cannot read them)
• Payroll and attendance records (if the school uses those modules)

D. Usage & Technical Data

We automatically collect minimal technical data to keep the platform running:

• IP address and browser type (for security and rate-limiting)
• Pages visited and actions performed inside the dashboard — stored persistently in an Activity Log for audit and support purposes
• Login timestamps, failed login attempts, and session activity
• Error logs (these do not contain student personal data)

E. Biometric & Face Recognition Data (Optional Module)

If your school enables the Face Attendance module, the following additional data is collected:

• Facial image samples of students (JPEG/PNG files stored on Aurra's secure server disk — never uploaded to Cloudinary or any external image service)
• Face quality scores used to verify sample usability for matching
• Consent record: which staff member confirmed consent, date/time confirmed, and any notes
• Automated attendance session logs (camera source, number of faces scanned, matches found, date)

Your school must obtain explicit written consent from a parent or guardian before enrolling any student's facial data. Aurra's system includes a built-in consent flag — no face is enrolled without it being confirmed. Schools are legally responsible for maintaining consent records.

F. Marketing Enquiries

If you contact us through the website or chatbot:

• Your name, school name, city, and WhatsApp number
• Your message or enquiry text

This data is used only to respond to your enquiry and is never sold.

4. How We Use Data

We never use student or parent data for advertising, profiling, or selling to third parties.

5. Data Sharing & Third-Party Sub-Processors

We do not sell, rent, or trade your data. We share data only with the sub-processors listed below, solely to operate the platform on your behalf:

Each sub-processor is bound by their own data processing terms. Where possible, Aurra configures these services to use the minimum data necessary. WhatsApp API providers (Twilio / Meta) are only activated if your school explicitly configures an API key — by default, WhatsApp works as a manual link opened on the staff member's own device.

6. International Data Transfers

Aurra is operated for schools in Pakistan. Several of our sub-processors (Render, Neon, Cloudinary, Twilio, Meta, Google) are based in the United States or process data on servers outside Pakistan. By using Aurra, your school acknowledges and agrees that data may be transferred to, stored in, and processed in countries outside Pakistan, including the United States.

We take reasonable steps to ensure these providers maintain appropriate technical and organisational security measures, including encryption in transit (TLS) and at rest. Where providers offer Data Processing Agreements (DPAs), Aurra operates under those agreements.

As Pakistan's data protection legislation develops (including any enacted Personal Data Protection Act), Aurra will update its practices to remain compliant. Schools that operate under sector-specific regulations should review whether international transfers of their student data are permitted under those rules.

7. Storage & Security

• All data is stored on encrypted servers. Connections to Aurra use HTTPS/TLS.
• Passwords are hashed using bcrypt — neither Aurra staff nor your IT team can read them.
• Access to your school's workspace is role-based — admins, teachers, and parents each see only what they are authorised to see.
• We perform regular automated backups. Backup data is subject to the same security controls as live data.
• Aurra staff access to production data is strictly limited and logged.

No system is 100% secure. If a security incident occurs that affects your school's data, we will notify you by email within 72 hours of becoming aware of it.

8. Data Retention

You can request early deletion of your data at any time by emailing admin@aurraos.com. We will confirm deletion in writing within 7 working days.

9. WhatsApp & Parent Communications

Aurra supports two modes of WhatsApp messaging. The mode in use depends on how your school has configured the platform:

Mode 1 — Manual Link (Default)

• Aurra generates a pre-filled WhatsApp link that your staff member opens on their own device.
• The staff member presses "Send" manually — the message is sent from their personal or school WhatsApp number.
• In this mode, Aurra does not transmit the message or phone number to any external server.
• Aurra does not store sent message content or delivery receipts.

Mode 2 — WhatsApp API (Optional, must be configured by school)

• If a school configures a Twilio or Meta WhatsApp Business API key, Aurra will send messages automatically on the school's behalf.
• In this mode, the parent's phone number and message text are transmitted to Twilio or Meta's servers to deliver the message.
• Message delivery status may be returned by the API provider and logged temporarily.
• By enabling API mode, your school accepts the respective provider's terms of service (Twilio / Meta).

In both modes, parent phone numbers are stored only within your school's workspace. Your school is responsible for obtaining parent consent before sending any WhatsApp communications, regardless of delivery mode.

11. Cookies & Tracking

Aurra uses a minimal set of first-party cookies:

Google reCAPTCHA

Aurra uses Google reCAPTCHA on login and signup forms to prevent automated bot abuse. When you submit these forms, Google reCAPTCHA collects:

• Your IP address
• Browser user-agent and fingerprint information
• Cookies set by Google (may include _GRECAPTCHA)

This data is sent to Google's servers and is subject to Google's Privacy Policy. Aurra uses reCAPTCHA only for security purposes and does not use Google Analytics or other Google tracking services on the main application.

We do not use advertising cookies, tracking pixels, or social media tracking scripts on the main application. The public marketing site may use basic anonymised analytics to measure page visits — no personal data is collected for that purpose.

10. Biometric & Face Recognition Data

This section provides additional detail on Aurra's Face Attendance module, which collects biometric data. It supplements Section 3E above.

How it works

• A school admin enrolls a student's face by uploading 1–5 sample photos from the student profile page.
• Samples are stored as image files on Aurra's encrypted server disk (Render persistent disk) — they are never uploaded to Cloudinary or shared with any third party.
• When attendance is taken, a camera feed is matched against enrolled samples using local face-matching — no real-time data is sent to external services.
• The consent flag (consent_confirmed) must be set to true in the system before any face sample is used for recognition.

Your obligations as a school

• You must inform parents/guardians that facial recognition is being used for attendance.
• You must obtain explicit written consent before enrolling any student's face.
• You must store a copy of that consent record independently of Aurra.
• You must provide a non-biometric alternative (manual attendance) to any student or family that declines consent.
• You must delete a student's face samples promptly if consent is withdrawn — this can be done directly from the student's profile in the Aurra dashboard.

Deletion

Face samples are deleted immediately when a school administrator removes them from the student profile. All face samples for a school are permanently deleted when the school's account is closed. Aurra staff do not access face sample files except during a documented technical incident with the school's knowledge.

12. Your Rights

As a school administrator or user, you have the right to:

• Access — Request a copy of the data we hold about your school account.
• Correction — Ask us to correct inaccurate account-level information.
• Deletion — Request deletion of your school's data (subject to the 30-day retention period above).
• Export — Export your student, fee, attendance, and exam data from within the Aurra dashboard at any time.
• Objection — Object to any processing of your data that you believe is not covered by this policy.

To exercise any of these rights, email us at admin@aurraos.com from the school admin email address registered with Aurra. We will respond within 7 working days.

For student and parent data entered by your school, the school administrator has full control to view, edit, or delete records directly inside the Aurra dashboard.

13. Children's Data

Aurra is a platform used by schools to manage records of students, many of whom are minors. We recognise the heightened sensitivity of children's data and apply the following principles:

• Student data is entered and controlled entirely by your school (the Data Controller).
• Aurra never contacts students or parents directly for marketing or any unsolicited purpose.
• Student portal access: Aurra includes a Student role that schools may optionally activate to allow students to view their own results and attendance only. Students with portal access cannot view data of other students, modify records, or access administrative functions. Schools decide whether to enable student login.
• We do not use children's personal data for advertising, profiling, analytics, or any purpose other than providing the platform to your school.
• Biometric data of minors: If your school enables face attendance, extra caution is required. Facial data of children is particularly sensitive. Parental consent is mandatory — see Section 10 for full requirements.
• National ID numbers of minors (B-Form): These numbers should only be entered if your school has a documented legal or administrative requirement to collect them. Aurra stores them securely but your school is responsible for the decision to collect this data.

Schools are responsible for ensuring they have appropriate consent from parents or guardians before entering student data — especially sensitive categories such as national ID numbers, health information, and biometric data — into any digital system, including Aurra.

14. Pakistani Law & Regulatory Compliance

Aurra is designed for use by schools in Pakistan and we take our obligations under Pakistani law seriously.

• Prevention of Electronic Crimes Act (PECA) 2016: Aurra complies with PECA's provisions on data handling. In the event of an unauthorised access incident affecting school data, we will notify affected schools within 72 hours and cooperate fully with the Federal Investigation Agency (FIA) if required.
• Personal Data Protection (Pakistan): Pakistan has been developing a Personal Data Protection Act. Aurra monitors legislative developments and will update this policy and its practices to comply with any enacted law. Schools regulated by sector-specific bodies (e.g., provincial education departments) should ensure their use of Aurra complies with applicable directives.
• National ID Numbers (CNIC / B-Form): These numbers are regulated under NADRA's framework. Schools collecting CNIC or B-Form numbers via Aurra must have a lawful basis to do so and must safeguard them accordingly.
• Biometric data: The collection and processing of biometric data in Pakistan carries heightened legal sensitivity. Schools using Aurra's face attendance module must ensure they operate within any applicable provincial or federal guidelines on biometric data collection in educational institutions.

If you receive a legal notice or regulatory enquiry relating to data held on Aurra, contact us immediately at admin@aurraos.com. We will work with you to respond appropriately.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify school administrators by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page always reflects the most recent version.

Continued use of Aurra after a policy update constitutes acceptance of the updated terms. If you disagree with a change, you may close your account before the effective date and request deletion of your data.

16. Contact Us

For any privacy-related questions, requests, or concerns:

This Privacy Policy was written in plain English intentionally. If any part is unclear, please email us — we are happy to explain.