Draft · before legal review · last updated 16 October 2026

Privacy policy

1. Whose data, who is responsible

An institution keeps the data of its students, guardians and staff in Praangon; the institution owns and controls it. Praangon keeps and processes it on the institution's behalf, only to provide the service.

2. What is kept

• Students: name, photo, class, roll, date of birth, address, birth registration, health notes (as the institution provides).
• Guardians: name, relationship, mobile number, NID (as the institution provides).
• Staff and users: name, mobile or email, role; passwords are stored only as a hash no one can read.
• Fees, collections, receipts, attendance, message records, and a log of who changed what and when.
• The website's trial form: name, institution, phone, district, student count; the IP address, hashed, to stop abuse.

3. How it is protected

• Each institution's data is separated in the database itself; no institution can see another's.
• Birth registration, guardian NID and health details are encrypted and shown only to permitted users.
• Every connection uses HTTPS; two-step sign-in is required for platform administrators.
• Encrypted backups every night, kept 30 days.
• Praangon staff can see data only as needed for support and billing, limited by role.

4. Where it lives, and who helps

• Database: Neon (PostgreSQL), in a Singapore data centre.
• Website and servers: Vercel, Singapore region.
• Encrypted nightly backups: GitHub (unreadable without the key).
• AI help (where switched on): Google Gemini. On the free tier no personal data (names, phones, addresses…) is sent.
• WhatsApp messages are sent from the institution's own phone; Praangon only prepares them. If SMS is switched on, the number and the message go to the SMS company.

We never sell data, use it for advertising, or give it to third parties for marketing.

5. Cookies and browser storage

One secure cookie keeps you signed in. Theme and language choices stay in your browser. No advertising or tracking cookies.

6. How long it is kept

• For as long as the institution uses the service; the institution can edit its data or download all of it.
• After it leaves: 5 years read-only, exported on request, then deleted with notice.
• Backups delete themselves after 30 days.

7. Your rights

Students, guardians and staff should first contact their institution to see, correct or delete their data, because the institution controls it. We help the institution where needed.

8. Contact

Phone and WhatsApp: +880 1751-891196