Privacy Policy
1. Introduction
This Privacy Policy explains how Atomos Education Private Limited ("Company", "we", "us", "our"), a company incorporated under the Companies Act, 2013 with CIN U80902MH2017PTC291472, having its registered office at 51, Patelwadi, Korit Road, Nandurbar, Maharashtra 425412 and principal place of business at Plot No. 02, Sai Vihar Apartment, Main Road, Nashik, Maharashtra 422008, collects, uses, stores, and protects information through its software product ClassTotal (Registered Trademark No. 4218870) accessible at classtotal.com ("Platform").
2. Information We Collect
We collect information that you voluntarily provide when registering and using the Platform:
- Account Information: Institute name, administrator name, email address, phone number, city, pincode, and password (stored in hashed form).
- Institute Data: Staff records, student records, batch details, admission records, attendance records, fee records, inquiry records, timetable data, and related documents uploaded by you.
- Platform Configuration Data: Per-institute operational settings maintained by the Company's platform administrators, including resource limits (Max Limits for students, staff, batches, admissions per batch, and inquiries per batch), subscription plan tier, usage counters (student admissions this period, storage bytes used), and institute-level preferences (dashboard layout, notification toggles, quick time settings, auto-capitalisation, etc.).
- Usage Data: Login timestamps, feature usage patterns, browser type, device information, and IP addresses collected automatically for service improvement and security.
- Notification Data: Email addresses and phone numbers used for sending transactional notifications (admission confirmations, fee receipts, timetable updates).
- Atomos Connect Data: For users who access applets via QR codes printed on Atomos Education physical study materials, we collect: phone number (for OTP verification), name, class/standard, city, school name (for new registrations), scan timestamps, IP address, and browser/device information. This data is collected independently of any ClassTotal institute account.
3. How We Use Your Information
- To provide and maintain the ClassTotal Platform and its features.
- To send transactional notifications (email, SMS, push) related to your institute's operations.
- To process Notification Wallet top-up payments and maintain transaction records for billing and tax compliance.
- To enforce per-institute resource limits (Max Limits) and prevent over-usage in accordance with the institute's subscription plan and any custom limits set by the Company's platform administrators.
- To provide customer support and respond to your requests.
- To detect, prevent, and address technical issues and security threats.
- To comply with legal obligations under applicable Indian law, including GST invoicing requirements.
We do not sell, rent, trade, or share your personal data or your institute's data with any third party for marketing or advertising purposes.
4. Data Isolation & Security
Each institute's data is completely isolated using institute-level scoping (InstituteScope). No institute can access, view, or modify another institute's data. We employ the following security measures:
- HTTPS/TLS encryption for all data in transit.
- Passwords hashed using bcrypt (never stored in plain text).
- UUID-based primary keys to prevent sequential enumeration.
- Soft-delete architecture — deleted records are retained for 30 days for recovery, then permanently purged.
- Role-based access control (RBAC) with granular per-user permissions.
5. Third-Party Services
We use the following third-party services to deliver Platform functionality:
- Brevo (Sendinblue): For transactional email delivery. Processes recipient email addresses only.
- MSG91: For SMS delivery and OTP verification. Processes recipient phone numbers only.
- Web Push (VAPID): For browser push notifications. No personal data is shared — only anonymous subscription endpoints.
- MilesWeb: Web hosting provider. Servers located in India.
- Cloudflare R2: For document and file storage. Files are encrypted at rest.
- Razorpay: For processing Notification Wallet top-up payments. Razorpay processes payment instrument details (card, UPI, netbanking) directly — the Company does not store card numbers or payment credentials. Razorpay is PCI-DSS compliant.
- Google Analytics: On our public marketing pages (classtotal.com) only, we use Google Analytics 4 to understand aggregate visitor traffic and improve the website. IP addresses are anonymised and the data is not used for advertising. Analytics is not loaded inside the logged-in application, the Student Portal, or institute mini-websites.
These services process limited data solely for the purpose of delivery and are bound by their own privacy policies.
5A. Payment & Billing Data
When you pay the Company for any service — Notification Wallet top-up or annual Subscription Plan — the following data is collected and retained:
- Wallet Transaction Records: For each wallet top-up — payment amount, Razorpay payment ID, order ID, timestamp, and wallet balance after each transaction.
- Subscription Payment Records: For each Subscription Plan purchase or upgrade — plan tier, amount paid (in paise), Razorpay payment ID, order ID, signature, snapshotted billing details (institute name, state, address, GSTIN if provided), invoice number, invoice date, subtotal, GST type (CGST+SGST or IGST), GST rate, SAC code, and payment status.
- Plan Tier Tracking: Current plan tier (free / pro / pro_max / ultra_pro_max), plan activation date, plan expiry date, grace period markers, and cached usage counters (student admissions this period, storage bytes used).
- Notification Usage Records: Each notification sent is logged with the channel (email, SMS, push), notification type, charge amount, and deduction timestamp. These are retained for billing transparency and dispute resolution.
- GST Tax Invoices: Generated automatically for each wallet top-up and each Subscription Plan payment with your institute details, GSTIN of the Company (27AAPCA2088J1Z8), taxable value, and GST breakdown. Wallet invoices use SAC 998431; subscription invoices use SAC 998411. Invoices are available for download indefinitely from your Notification Wallet or Subscriptions page.
- Retention: All payment transaction records, invoice data, and usage records are retained indefinitely for accounting and tax compliance (Income Tax Act, 1961; CGST Act, 2017) as required by Indian law.
Payment instrument details (card numbers, UPI IDs, bank credentials) are processed entirely by Razorpay and are never stored on ClassTotal servers.
5B. Atomos Connect — QR Code Applet Platform
Atomos Connect is an educational applet platform operated by Atomos Education Pvt. Ltd. under the ClassTotal umbrella, accessible at classtotal.com/connect/{applet-slug}. It connects physical printed study materials (Atomos Education textbooks, workbooks, study notes) with digital interactive applets (simulators, quizzes, virtual labs, etc.) via QR codes printed on those materials.
Data Collected at Applet Scan
- Phone Number: Required for one-time password (OTP) verification before an applet can be accessed. OTP is sent via SMS through MSG91 (DLT-registered).
- Student Registration Info (new users only): Name, class/standard, city, and school name. Stored in the
public_studentstable with approval workflow. - Scan Logs: Applet ID, phone number, IP address, user agent (browser/OS), and timestamp for each scan. Retained for analytics and abuse prevention.
- Session Data: Encrypted 64-character session token stored as a cookie on the scanning device, valid for up to 90 days. Each phone can have only one active session at a time — a new scan on a different device logs out the previous one.
Approval Workflow
To prevent spam and misuse, new public student registrations require admin approval. An applicant's status may be Pending, Approved, Denied, or Blacklisted.
Relation to ClassTotal Institute Accounts
If a scanning student's phone number matches a registered student in any ClassTotal institute, scan access is automatically granted without separate registration and the scan is associated with that student's institute record. Institute-admin visibility is strictly limited to an institute's own students.
User Rights (Atomos Connect)
Scanned users may request removal of their Atomos Connect data by contacting support@classtotal.com with their phone number. Removal will take effect within 30 days. Blacklisted users may appeal in writing.
6. Data Retention
- Active account data is retained as long as your account exists.
- Soft-deleted records are permanently purged after 30 days.
- Notification logs are retained for 90 days after being read.
- Upon account deletion, all associated data is permanently removed within 30 days.
7. Your Rights
As a user, you have the right to:
- Access and view all data stored in your institute account.
- Export your data in standard formats (PDF reports, CSV exports).
- Correct or update your personal information at any time.
- Request deletion of your account and all associated data.
- Withdraw consent for optional notifications via Settings.
8. Cookies
The Platform uses essential session cookies for authentication and CSRF protection. On our public marketing pages (classtotal.com) we additionally use Google Analytics 4, which sets first-party analytics cookies to measure aggregate, anonymised visitor traffic. We do not use advertising or cross-site tracking cookies, and no analytics scripts are loaded inside the logged-in application, the Student Portal, or institute mini-websites. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on or your browser's cookie controls.
9. Children's Privacy
The Platform is intended for use by educational institutes and their administrators. Student data is entered by authorised institute administrators, not by students directly (except through the Student Portal with institute-approved access).
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Platform after changes constitutes acceptance of the revised policy.
11. Grievance Officer
For any privacy-related concerns or complaints, contact:
Shahid Fakaruddin Mansuri, Director
Email: support@classtotal.com
Address: Plot No. 02, Sai Vihar Apartment, Main Road, Nashik, Maharashtra 422008
12. Governing Law & Jurisdiction
This Privacy Policy is governed by the laws of India. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts in Nashik, Maharashtra.