Privacy Policy

1. Introduction

ClickTake Technologies ("we", "us", or "our") operates AcademyPro, a cloud-based Software-as-a-Service (SaaS) academy management platform designed for educational institutions, coaching centers, and training academies. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use our platform as an academy administrator, teacher, student, parent, visitor, or any other authorized user.

By creating an account, registering as a user, or accessing AcademyPro, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use our platform. Each academy tenant ("Academy Owner") is independently responsible for how they configure and use AcademyPro within their organization, and we encourage all tenants to adopt complementary internal privacy policies for their own staff and students.

2. Information We Collect

We collect several categories of information to deliver and improve the AcademyPro platform. The specific data collected depends on your role and the features activated by your academy administrator.

2.1 Account Registration Data

• Academy Administrators: Business name, owner full name, email address, phone number, password (bcrypt-hashed), and chosen subdomain during the self-service signup process.
• Teachers, Staff, and Workers: Full name, login ID, email address (optional), phone number, department, designation, profile photograph, and emergency contact information as entered by the academy administrator.
• Students: Full name, parent/guardian name, parent contact number, parent email, date of birth, gender, address, class/section assignment, admission number, and profile photograph as entered by the academy administrator.
• Parents: Name, phone number, email address, and relationship to the student as provided during registration.
• Visitors: Full name, phone number, purpose of visit, host name, visiting department, and check-in/check-out timestamps captured at the gate.

2.2 Attendance & Biometric Data

• Face Recognition Data: When face recognition attendance is enabled, facial embeddings (mathematical vector representations, not raw photographs) are generated from device cameras to verify identity. These embeddings are stored securely and used solely for attendance verification purposes.
• QR Code Data: Unique QR codes assigned to students and staff contain an encrypted identifier used for quick check-in/check-out. The QR code itself does not contain personal data.
• Check-In/Check-Out Records: Timestamps, method used (face, QR, GPS, or manual), device fingerprint, and location coordinates for each attendance event.

2.3 GPS & Location Data

• Geofenced Attendance: GPS coordinates are captured during check-in to verify the user is within the academy's defined geofence radius (typically 50–200 meters). Coordinates are used for validation only and are not stored permanently beyond the attendance record.
• Field Trip & Transport Tracking: When enabled, real-time GPS coordinates of staff or students during authorized field trips or bus transport may be collected and shared with authorized parents and administrators for safety purposes.

2.4 Academic & Financial Data

• Academic Records: Marks, grades, GPA, exam results, class rankings, attendance percentages, and report card data as entered by teachers or imported by administrators.
• Fee & Billing Data: Invoice amounts, payment status, payment method (Stripe, PayPal, bank transfer, cash), transaction IDs, due dates, and billing history. Credit card numbers are never stored on our servers — all card processing is handled directly by PCI-DSS compliant payment gateways (Stripe, PayPal).
• Salary & HR Data: Staff salary structures, leave balances, leave request history, department assignments, and payslip data as managed by authorized academy administrators.

2.5 Platform Usage Data

• Device & Browser Info: IP address, browser type, operating system, device type, screen resolution, and language preferences collected automatically for security and optimization purposes.
• Activity Logs: Login/logout times, pages accessed, features used, and administrative actions performed. These logs are accessible only to the academy administrator and Super Admin.
• Cookies & Local Storage: We use essential cookies for authentication (JWT tokens) and session management. We do not use tracking cookies for advertising purposes.

2.6 Communication Data

• Email Communications: Notification emails, fee reminders, attendance alerts, leave approvals, and system announcements sent via our email service provider. Email content is generated automatically based on platform events.
• WhatsApp/SMS Notifications: When configured by the academy, SMS or WhatsApp messages may be sent for critical alerts (attendance notifications, emergency announcements). Message content is limited to essential information only.
• Contact Form Inquiries: Name, email, academy name (optional), mobile (optional), and message content submitted through the Contact Us form on our marketing website.

3. How We Use Your Information

We use the information collected to provide, maintain, and improve the AcademyPro platform and related services. Specifically:

• Core Service Delivery: To process attendance, manage student and staff records, generate timetables, calculate salaries, issue invoices, track visitors, and provide dashboard analytics — all core functions of the academy management platform.
• Authentication & Security: To verify user identity, enforce role-based access control (RBAC), detect unauthorized access attempts, and maintain audit trails of administrative actions.
• Communication: To send attendance notifications to parents, fee reminders to guardians, system alerts to administrators, and respond to support inquiries.
• Biometric Verification: To match face recognition embeddings against registered profiles for automated attendance marking, with 99.5% accuracy.
• GPS Validation: To verify that attendance check-ins originate from within the academy's defined geofence, preventing proxy or remote attendance fraud.
• Payment Processing: To generate invoices, process subscription payments via third-party gateways, and maintain billing records. We never store credit card numbers.
• Platform Improvement: To analyze usage patterns, identify performance bottlenecks, fix bugs, and develop new features based on aggregated, anonymized usage data.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

4. Data Storage & Security

We take data security seriously and implement multiple layers of protection:

• Database: All tenant data is stored in Supabase (PostgreSQL), a SOC 2 Type II compliant database provider. Data is encrypted at rest using AES-256 encryption.
• Authentication: Passwords are hashed using bcrypt (10 rounds) and never stored in plain text. JWT tokens are used for session management with configurable expiration.
• Multi-Tenant Isolation: Each academy operates in a strictly isolated data namespace. Tenant A's administrator cannot access Tenant B's data under any circumstances. Row-Level Security (RLS) policies enforce this at the database level.
• File Storage: Profile photographs, uploaded documents, and media files are stored in Cloudinary with secure signed URLs and access controls.
• HTTPS: All data in transit is encrypted using TLS 1.2+ via HTTPS. Our platform does not support unencrypted HTTP connections.
• Access Control: Role-Based Access Control (RBAC) with 7 distinct roles (Super Admin, Academy Owner, Branch Manager, Teacher, Accountant, Parent, Student) ensures each user sees only the data relevant to their role.
• Audit Logging: All administrative actions (data modifications, user creation, permission changes) are logged with timestamp, user ID, and action description.

5. Attendance & Biometric Data

The face recognition attendance system operates as follows: when a user attempts to check in, their live facial image is captured by the device camera, converted into a mathematical vector embedding, and compared against registered embeddings stored in the database. If the similarity score exceeds the configured threshold, attendance is marked automatically.

• Raw facial images are never stored — only the mathematical embeddings are retained.
• Face embeddings are stored per-tenant and are not shared across academies.
• Users (or their guardians) may request deletion of their biometric data at any time by contacting their academy administrator or emailing amp@clicktaketech.com.
• When face recognition is disabled by the academy administrator, all associated embeddings for that tenant are permanently deleted.

6. GPS & Location Data

GPS coordinates are collected only when the geofenced attendance feature is enabled by the academy administrator. Location data is used exclusively to validate that a check-in occurs within the approved geofence boundary. We do not track users' continuous location or create movement profiles.

• GPS coordinates are attached to the attendance record for that session only.
• Location history is accessible only to the academy administrator and is automatically purged after the configurable retention period (default: 90 days).
• Users can disable GPS permissions on their device at any time, which will fall back to alternative attendance methods (QR code, manual entry).

7. Payment & Billing Data

AcademyPro integrates with third-party payment processors for subscription billing and fee collection:

• Stripe: Credit/debit card payments are processed directly on Stripe's PCI-DSS compliant infrastructure. AcademyPro never receives or stores card numbers. We retain only a masked token reference for reconciliation.
• PayPal: PayPal payments are processed through PayPal's secure checkout. We store only the transaction ID and payer email for record-keeping.
• Bank Transfer & Cash: For manual payment methods, the academy administrator records the transaction details. No financial credentials are processed through our platform for these methods.

Billing history, invoice PDFs, and payment status are stored in the tenant's isolated database and are accessible only to authorized roles (Admin, Accountant, and the affected student/parent).

8. Third-Party Services

AcademyPro integrates with the following third-party services to deliver platform functionality:

• Supabase: Primary database and authentication backend (SOC 2 Type II compliant). Stores all tenant, user, attendance, academic, and billing data.
• Cloudinary: Cloud media storage for profile photos, document uploads, and branded invoice logos. Files are encrypted at rest and served via signed URLs.
• Stripe & PayPal: Payment processing for subscription billing and fee collection. These providers have their own privacy policies governing financial data.
• Email/SMTP Providers: Transactional email delivery for notifications, reminders, and system alerts. Email content is generated on our servers; the provider only handles delivery.
• Firebase Hosting: Static file hosting and CDN for the platform's frontend. Firebase may collect standard CDN access logs.
• Render: Backend API server hosting. Render may collect server access logs for operational purposes.

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes. All third-party integrations are strictly functional and necessary for platform operation.

9. Data Retention

Data retention periods vary based on the type of data and the tenant's configuration:

• Active Tenant Data: All data is retained for as long as the tenant account is active (status: active or trial).
• GPS Coordinates: Purged after 90 days (configurable by the academy administrator).
• Audit Logs: Retained for 12 months from the date of the logged action.
• Deleted Accounts: When a tenant cancels and their account expires, all tenant data including user records, attendance history, academic records, and uploaded files are permanently deleted within 30 days of account termination.
• Suspended Accounts: Data is preserved for the duration of the grace period (default: 3 days) and then permanently deleted.
• Face Embeddings: Permanently deleted when face recognition is disabled or when the user requests deletion.

10. Your Rights

As a user of AcademyPro, you have the following rights regarding your personal data:

• Right to Access: You may request a copy of all personal data we hold about you by contacting your academy administrator or emailing amp@clicktaketech.com.
• Right to Correction: You may request correction of inaccurate personal data (name, contact details, etc.) through your academy administrator or by contacting us directly.
• Right to Deletion: You may request deletion of your personal data and account. Upon verified request, your data will be permanently removed within 30 days, except where retention is required for legal or billing purposes.
• Right to Data Portability: You may request your data in a structured, machine-readable format (JSON or CSV) for export to another service.
• Right to Withdraw Biometric Consent: You may opt out of face recognition attendance at any time. Your academy administrator can disable biometric verification for your account, and all associated facial embeddings will be permanently deleted.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, such as when the accuracy of the data is contested.

To exercise any of these rights, contact your academy administrator first. If your request is not resolved, email amp@clicktaketech.com with your full name, academy name, and the specific right you wish to exercise. We will respond within 30 days.

11. Children's Privacy

AcademyPro is designed for use by educational institutions that may include minors (students under 18). The platform collects student data solely at the direction and responsibility of the enrolling academy and the student's parent or legal guardian. By registering a student, the parent or guardian consents to the collection and processing of the student's data as described in this policy.

• We do not directly collect data from children without verifiable parental consent.
• Parents may access, correct, or request deletion of their child's data through the academy administrator or by contacting us directly.
• Face recognition for minors is enabled only with explicit academy administrator approval and parental consent during the enrollment process.
• We do not use student data for any purpose other than providing the academy management services described in this policy.

12. Data Breach Notification

In the unlikely event of a data breach that affects your personal data, we will:

• Notify affected users and academy administrators within 72 hours of becoming aware of the breach, as required by applicable data protection laws.
• Provide a description of the nature of the breach, the categories of data affected, and the steps we have taken to mitigate the impact.
• Report the breach to relevant supervisory authorities where legally required.
• Implement additional security measures to prevent recurrence.

Security incident notifications will be sent via email to the academy administrator's registered email address and posted as a platform-wide announcement for all affected tenants.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or platform features. When we make material changes, we will:

• Update the "Effective Date" at the top of this page.
• Notify all academy administrators via email at least 30 days before the changes take effect.
• Display a platform-wide notification banner for all users upon their next login.

Continued use of AcademyPro after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically for updates.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: