✦ The Founding 50Pro free for a year —claim your place →

Privacy Policy

Last updated: 6 July 2026 · Applies to nuhaos.com and the NUHA platform.

NUHA is a school operating system built and operated by Horfay Taqnia Private Limited ("Horfay", "we"), Floor 2nd, Block A, STPI, SIDCO, Rangreth, Srinagar — 191132, Jammu & Kashmir, India. Our founding promise is simple and non-negotiable: we refuse to profile children.

The roles, plainly

  • Your school is the data fiduciary (controller). It decides what data enters NUHA and holds the relationship — and the consent — with parents and guardians.
  • Horfay is the data processor. We process data only on the school's documented instructions, to run the service described on this site.

What we collect

  • School staff and parents: name, email, phone, role, and login credentials (passwords are stored only as salted hashes).
  • Students: name, roll number, date of birth, class, attendance records, homework submissions, marks, and teacher remarks — the objective academic record a school register has always held, in digital form.
  • Admissions applicants: the details a parent submits on a school's application form.
  • Technical: standard server logs and privacy-friendly, cookie-less page analytics. We do not use advertising trackers.

What we never do

  • No behavioural, emotional or psychological profiling of minors — under the Digital Personal Data Protection Act, 2023 (§9) and under our own rules, which are stricter.
  • No advertising, no ad-tech, no sale or sharing of personal data with data brokers. Ever.
  • No AI decisions about children. Our AI features draft text (lesson plans, report-card remarks, messages) from objective data, and a human teacher or administrator always reviews before anything is shared. Our AI never scores, ranks, selects or evaluates a child or an applicant.

Where data lives and how it's protected

  • Data is stored on managed cloud infrastructure with encryption in transit (TLS) and at rest, automated backups and point-in-time recovery.
  • Every school's data is isolated at both the application layer and the database layer (row-level security). One school can never read another's records.
  • Payment card/UPI details are handled entirely by our payment gateway (Razorpay); we never see or store them.

Your rights

Parents exercise rights through their school (the fiduciary): access, correction, and erasure requests are honoured through the school's administrator. Schools may request a full export or deletion of their data at any time by writing to [email protected]. Students who leave a school are archived, not traded — their records remain the school's, subject to its retention obligations.

Retention

We retain data for as long as the school maintains its account, plus a short grace period for accidental-deletion recovery. On verified deletion requests, data is removed from live systems promptly and from backups on their rotation schedule.

Grievances

Grievance officer: Horfay Taqnia Pvt Ltd, at [email protected]. We respond to every privacy inquiry, usually the same day. You may also approach the Data Protection Board of India.