Privacy Policy

1. Who we are

MCK ERP is a college management app and web portal for students, faculty and administrators of Mahila College – Khamta (the “College”). It is developed and operated by Codizious Technologies, Rajkot, Gujarat, India (“Codizious”, “we”, “us”, “our”).

This policy explains what personal data the app and portal collect, why, who can see it, how we protect it, and the choices you have. By creating an account or using the app you confirm that you have read this policy. If you do not agree, please do not use the app.

Account records (such as your admission details) are created and verified by the College. In processing that data to run the app, Codizious acts on the College's behalf and under its instructions, and is responsible for keeping it secure as described here.

2. Information we collect

2.1 Information you or the College provide

• Account details: full name, username, email address, phone number, role (student / faculty / admin) and password. Passwords are never stored in readable form.
• Student profile: admission number, roll number, stream, class, date of birth, gender, address, guardian name and guardian phone number.
• Faculty profile: employee details and class / subject assignments.
• Registration details submitted through self-registration, which stay “pending” until an administrator approves them.

2.2 Academic and administrative records created while using the app

• Attendance (present / absent / leave) and leave requests with reasons and decisions.
• Fee structure, fees due, and payment records (amount, date, payment mode such as cash / online / UPI / cheque, and transaction reference). We do not collect or store card numbers, bank account details, UPI PINs or passwords for any payment. Payments are recorded by college staff.
• Exam schedules and marks, timetables and calendar entries.
• Library records (books issued, returned, due dates).
• Study materials uploaded by faculty or administrators (files or links).
• Announcements and notifications sent to you, and your notification preferences.

2.3 Documents and images you upload

Students and faculty can upload personal document images (for example an ID card or certificate). Only image files are accepted. To save storage, images are automatically resized and compressed, and embedded metadata such as EXIF (which can include GPS location) is removed during this process. Uploaded documents are visible to you and to College administrators, and are not shown to other students or faculty.

2.4 Information collected automatically

• Device and app information: device model, Android version, app version, and a push-notification identifier used to deliver notifications to your device.
• Advertising identifier and ad-related data: collected by Google AdMob to serve and measure ads (see Advertising).
• Log and security data: IP address and timestamps of requests to our servers, for example when a password reset is requested, for security and abuse prevention.
• Session information: a login token stored on your device (or a session cookie on the web portal) so you stay signed in until you log out or the session expires.

2.5 What we do not collect

• No precise or background location.
• No contacts, call logs, SMS or messages, microphone recordings or calendar data from your phone.
• No biometric data.
• No access to your photo library beyond the single image you explicitly pick.

3. How we use your information

• To create and manage your account, verify your identity and let you sign in.
• To provide the app's features: attendance, fees and receipts, leave, exams, timetable, library, study materials, documents, announcements and search.
• To send notifications you or the College have chosen to send (announcements, fee reminders, leave decisions, new study material). You control categories under Notification Settings in the app.
• To send account-related emails, such as a password reset link.
• To keep the service secure, prevent fraud and abuse, diagnose errors and improve reliability and performance.
• To show ads that help keep the app running (see Advertising).
• To comply with legal obligations and respond to lawful requests.

We do not use your data for profiling that produces legal effects, and we do not make automated decisions about you.

4. Sharing & third parties

We do not sell, rent or trade your personal information. We share it only in the limited ways below.

4.1 Within the College, based on role

• Students see only their own records.
• Faculty see information about the classes and students assigned to them and can manage their own materials and documents.
• Administrators can see and manage college-wide records, including uploaded documents, in order to run the institution.

4.2 Service providers that process data on our behalf

These providers may only use the data to perform their service and are bound by their own privacy terms: Google Privacy Policy, How Google uses data from apps that use its services, OneSignal Privacy Policy.

4.3 Legal and safety reasons

We may disclose information if required by law, court order or a valid request from a public authority, or where necessary to protect the rights, safety or property of users, the College or Codizious, or to investigate fraud or security incidents.

4.4 Business changes

If Codizious is involved in a merger, acquisition or transfer of the service, your data would remain protected by this policy or a policy no less protective, and we would notify you of any material change.

5. Advertising

The app shows ads served by Google AdMob. AdMob may use your device's advertising ID and other technical information to deliver and measure ads, and to limit how often you see the same ad. We do not give AdMob your name, email, phone number, academic records, fee data or uploaded documents.

• To reset your advertising ID or opt out of ad personalization on Android, go to Settings → Privacy → Ads (the exact path varies by device) and choose Delete advertising ID or Opt out of Ads Personalization.
• You can learn more or manage Google ad settings at adssettings.google.com.

Ads are never targeted using your academic, fee, or uploaded-document data.

6. App permissions

Choosing an image from your gallery uses Android's system photo picker, which gives the app access only to the image(s) you select — not your whole library.

7. How we protect your data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, including:

• Encrypted transmission: data between the app / browser and our servers is sent over HTTPS (TLS).
• Password protection: passwords are stored as salted one-way hashes (bcrypt) and cannot be read by us or anyone else.
• Role-based access control: every request is authenticated, and users can only reach data allowed for their role.
• Session security: login tokens expire, and all active sessions are signed out when a password is reset.
• Secure file handling: uploaded files are validated (type and content), stored in per-user folders, and the upload area is configured so uploaded files cannot be executed as code.
• Reset links: password reset tokens are single-use, expire after 1 hour, and only a hash of the token is stored.
• Least privilege: secrets such as database credentials and third-party API keys are kept on the server, never inside the app.

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify the College and affected users and the relevant authorities as required by applicable law.

8. How long we keep data

• Account and profile data: kept while your account is active and you remain associated with the College.
• Academic and fee records: kept for as long as needed to run the institution and to meet the College's legal, audit and accounting obligations.
• Uploaded documents: kept until you delete them, or your account is deleted.
• Password reset tokens: expire after 1 hour and are removed with the account.
• Push notification delivery logs: kept only for troubleshooting and periodically cleared.

When data is no longer needed, or you validly request deletion, we delete or anonymise it as described below.

9. Your rights

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000), you may:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (many details can be updated in My Account; others through the College office).
• Delete your data (see below).
• Withdraw consent for optional processing, such as notifications (turn off in app or system settings) or camera use (revoke in system settings).
• Raise a grievance with our Grievance Officer (see Contact).

You can also delete individual uploaded documents yourself at any time from My Documents in the app or web portal.

10. Data deletion on request

You can ask us to delete your account and the personal data associated with it at any time, free of charge. This section is the account and data deletion page for the MCK ERP app.

How to request deletion

1. Send an email to info@codizious.com with the subject “Data Deletion Request – MCK ERP”, or call / WhatsApp +91 8160519719.
2. Include your full name, username, registered email or phone number, and your role (student / faculty). Send the request from your registered email address where possible, so we can verify it is you.
3. You may alternatively make the request through the College administration office, which will forward it to us.

Request deletion by email Call +91 8160519719

What happens next

• We may ask a question to confirm your identity before acting, to prevent someone else deleting your account.
• We will confirm receipt within 7 days and complete the deletion within 30 days of a verified request.
• We will confirm to you by email once it is done.

What is deleted

• Your account and login credentials, profile details (contact information, address, date of birth, guardian details).
• All documents and images you uploaded, including the files stored on our servers.
• Your notification history and preferences, and any pending password reset tokens.
• Your device / push identifier association with OneSignal, so you stop receiving notifications.

What we may need to keep

Some records may have to be retained, in reduced or anonymised form, where the law or the College's legitimate record-keeping requires it – for example fee receipts and payment records for accounting and audit, and academic results. We keep only what is required, for as long as it is required, and restrict its use to that purpose. Data held in routine backups is overwritten on the normal backup cycle (within 90 days).

Deleting only some data

• Delete individual documents yourself in My Documents.
• Turn off notifications in the app's Notification Settings or in Android system settings.
• Ask us to remove specific information without deleting your whole account by using the same email address above.

Uninstalling the app removes the app and locally stored login data from your device but does not by itself delete your account data on our servers — please use the request process above for that.

11. Children's privacy

MCK ERP is intended for college students, faculty and administrators. It is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Students who are under 18 use the app through their College, which manages their enrolment and is responsible for obtaining any required parent or guardian consent. If you believe a child under 13 has provided us data, contact us and we will delete it promptly.

Ads shown in the app are configured for a general audience and we do not knowingly show personalised ads based on the data of children.

12. Cookies (web portal)

The web portal uses a small session cookie that keeps you logged in and protects your session. It is essential to the service and is removed when you log out or the session ends. We do not use third-party advertising or tracking cookies on the web portal.

13. International processing

Our primary servers are operated for us in India or by our hosting provider. Some third-party services we use, such as Google AdMob and OneSignal, may process limited technical data on servers located outside India. Where this happens, it is limited to the data described in Section 4 and is subject to those providers' safeguards.

14. Changes to this policy

We may update this policy from time to time, for example when we add a feature or when the law changes. The “Last updated” date at the top shows the latest version. For material changes we will notify you in the app or by email. Continued use after an update means you accept the revised policy.

15. Contact & grievance officer

For any question about this policy, your data, or to exercise your rights, contact:

If you are not satisfied with our response, you may also have the right to approach the relevant data protection authority under applicable law.