Privacy Policy
This Privacy Policy explains how the VTUSync team collects, uses, protects, and discloses information when you use the VTUSync desktop application, the website at vtusync.in, and related services (together, the "Services").
Last updated: October 2026
We are committed to protecting your privacy and handling your information responsibly, in accordance with applicable law — in particular the Digital Personal Data Protection Act, 2023 (the "DPDP Act") of India, to the extent it applies. This policy forms part of our Terms of Service. It also covers the commitments previously described in our former "Data Protection (DPDP)" page.
In plain English
Here is the short version in plain English:
- The VTUSync desktop app fetches student results and analyzes them on your own device. We do not receive or upload your student result files or reports.
- The information we do collect is limited to what is needed to run the product — your name, email, purchase/plan details, licensing data, and basic usage/technical data.
- We do not sell your personal information.
- You have rights over your data — you can ask for a summary, correct it, request deletion, or withdraw consent.
- If you have any concern, email support@vtusync.in.
The essentials
The purpose of VTUSync is to help VTU-affiliated teachers fetch, analyze, and report on student results more easily. A key design decision is that this happens on your computer, not on our servers. The student result data you process never needs to be sent to us for the app to work. Because of that design, the personal information we actually handle is much smaller and more limited than you might expect from an online service.
Important — your students' data stays with you
Student result files and generated reports are processed locally on your device. We do not receive, store, or upload your students' result data. You remain the data fiduciary for that data and are responsible for how you handle, store, and share it.
1. How the DPDP Act applies (roles)
It helps to understand two terms used by the DPDP Act:
- A Data Fiduciary decides why and how personal data is processed. This can be an organisation or a person.
- A Data Principal is the person the data is about — the individual whose personal data is being processed.
When you use VTUSync, you are a Data Principal (we process your account and payment data as the fiduciary). At the same time, with respect to the student results you handle, you act as a Data Fiduciary — you decide how to process that data. This policy covers both sides: how we act as a responsible fiduciary toward you, and how you can act responsibly toward your students.
2. Information we collect
a. Information you provide to us
- Account information — your name, email address, phone number, college, department, and designation when you register. To keep accounts teacher-only, registration also requires a faculty identity document, which our team verifies manually and stores for as long as needed to validate your account.
- Email verification data — one-time codes used to verify your email address (codes are short-lived and are not reused).
- Purchase information — the plan you choose, the amount paid (including any convenience fee), and a payment confirmation reference.
- Support communications — the content of any messages you send us and your contact details.
- Optional details — information you provide when you submit an institutional pricing request (for example, phone, institution, department, and approximate teacher counts).
b. Information collected automatically
- Usage and technical data — such as your IP address, browser type, device identifiers, the version of the Software you use, and pages visited, collected through cookies and similar technologies.
- Licensing data — details needed to validate and manage your license key (such as a device identifier) to prevent misuse and to keep activated keys within your plan's device limit.
c. Data we do not collect
We do not intentionally collect, upload, or store the student result data that you process with the Software. This data is processed locally on your device and remains under your control. We also do not knowingly collect data from, or direct the Services at, children under 18.
3. Why we collect this information (purposes)
We collect only what we need, and we use it only for clear purposes. We use information to:
- Provide, operate, and maintain the Services and your account.
- Verify that registrants are genuine faculty, to prevent fraudulent or student-created accounts.
- Process payments, generate and deliver license keys, and manage your subscription.
- Validate licenses and protect against unauthorised use.
- Respond to your requests and provide customer support.
- Send transactional messages (for example, order and license confirmations).
- Improve the Services and keep them and our systems secure.
- Comply with legal and regulatory obligations.
We do not send promotional or marketing communications without your consent. Messages you receive from us are transactional — for example, to deliver your license key.
4. Legal basis and your consent
Where the DPDP Act or other applicable law requires consent, we process your personal data on the basis of consent you provide when you register and use the Services. Where consent is required, we:
- Provide clear, specific, and informed notice of what data is collected, the purpose of processing, and how it will be used, before or at the time of collection.
- Seek your free, specific, informed, unconditional, and unambiguous consent with a clear affirmative action.
- Honour your right to withdraw consent, subject to legal requirements, just as easily as you provided it.
Where consent is not required, we process information where necessary to perform our agreement with you (the Terms of Service), to comply with legal obligations, and for our legitimate interests in operating and securing the Services.
5. How we share information (no selling)
We do not sell your personal information. We share information only in these limited circumstances:
- Service providers — with third parties that help us operate the Services, only to the extent necessary and under appropriate safeguards. See the vendor list in section 6.
- Legal compliance — when required by law, regulation, legal process, or governmental request, or to protect our or others' rights, safety, or property.
- Institution reporting — where a registration used fake identity documents or impersonation, we may report the matter to the concerned institution as described in our Terms of Service.
- Business transfers — in connection with a merger, acquisition, or sale of assets, where your information may be transferred subject to limits consistent with this policy.
- With your consent — otherwise, only with your consent.
6. Vendors and sub-processors
To run the Services we rely on a small number of specialized providers. Each processes only the categories of data needed for its function:
| Provider | What it does for us | Data involved |
|---|---|---|
| Razorpay | Payment processing and order handling | Amount, order reference, and payment status; card and UPI details are handled by Razorpay, not by us |
| Email provider | Delivery of transactional email (license keys, OTP codes, approvals, invoices) | Recipient email address and message content |
| Cloud database & storage host (MongoDB Atlas) | Hosting of account, licensing, and configuration data; storage of verification documents | Account, purchase, licensing, and verification-document data |
| Hosting & download infrastructure | Hosting of the Website and serving secured installer downloads (single-use tickets) | IP address and standard web-server logs |
| Microsoft Store | Optional distribution of the desktop app | Microsoft account and store data is governed by Microsoft's own terms; we receive nothing |
| Cloudflare and similar edge/anti-abuse services | Security, bot protection, and verification challenges | IP address and technical traffic data |
We keep this list under review. Where a provider changes, we ensure the replacement offers equivalent safeguards before we switch.
7. Data security
We use reasonable administrative, technical, and organisational safeguards appropriate to the nature of the information we handle, to protect it from unauthorised access, loss, misuse, or alteration. In practice this includes:
- Encryption of data in transit (HTTPS/TLS) including at rest at our providers.
- Strict access control — administrative access to personal data is limited to what is needed to operate the Service.
- Rate limiting and abuse protection on authentication, registration, and licensing endpoints.
- Single-use, expiring tickets for installer downloads so links cannot be shared or reused.
- Passwords stored only in cryptographically hashed form, never in plain text.
Because most of the student result data you process is stored only on your own device, the security of that data depends significantly on the security of your device, your account credentials, and your license key. You are responsible for protecting these.
8. Data retention
We keep different kinds of data for different periods:
| Data | How long we keep it | Why |
|---|---|---|
| Account details (name, email, college, designation) | For as long as your account is active, and for up to 2 years afterwards | To operate your account and handle disputes or lawful requests |
| Faculty verification documents | For as long as the account is active, and for a reasonable audit period afterwards | To validate the account against the mandatory faculty-verification requirement |
| Payment records and invoices | As required by Indian tax and accounting law (typically 8 years) | Legal compliance and dispute resolution |
| License and device identifiers | For as long as the license is active, plus a short grace period | License validation and device-limit enforcement |
| Support communications | Until the issue is resolved, plus a reasonable window | Service quality and dispute history |
| Technical logs (IP, traffic) | Short-lived (days to weeks depending on the system) | Security, debugging, and abuse prevention |
We delete or anonymise personal data when it is no longer needed for these purposes.
9. International transfers
Most of the personal data we collect is stored in India. Where a provider processes data from outside India, we entrust the data to that provider under a contract with appropriate safeguards, consistent with the requirements of the DPDP Act once its rules on transfers are fully in force. We do not otherwise send your personal data abroad.
10. Your rights (data principal rights)
To the extent provided by the DPDP Act and applicable law, you have the right to:
- Know — obtain a summary of the personal data we hold about you and how it is processed.
- Correct — request correction of inaccurate or incomplete personal data.
- Erase — request erasure of your personal data, subject to lawful grounds for retention.
- Portability — request access to the personal data you provided, in a structured format.
- Withdraw consent where processing is based on consent.
- Grieve — access grievance redressal, as described below.
To exercise these rights, email support@vtusync.in. We may take reasonable steps to verify your identity before acting on a request, and we aim to respond within a reasonable time. If you are not satisfied with our response, you may also make a complaint to the Data Protection Board of India, in accordance with the DPDP Act.
11. Children's data
VTUSync and the Website are not directed at children, and we do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us personal data, please contact us at support@vtusync.in so we can take appropriate action, including deletion.
12. Breach handling and DPDP accountability
If a personal data breach affects data in our control, we will contain it, assess the impact, and notify affected data principals and the Data Protection Board of India as and to the extent required under the DPDP Act. Because student data is processed on your device rather than stored with us, breaches most commonly involve data in your control — the DPDP Act places the notification duty for that data on you as the fiduciary, and we will help you understand those obligations if you contact us.
The DPDP Act provides for significant penalties for non-compliance — up to ₹250 crore for certain breaches — and we treat compliance seriously. Our safeguards and practices are kept under review as the DPDP rules and obligations come fully into force in phases, and this policy will be revised as those obligations crystallise.
13. Grievance Officer
Under the DPDP Act, we are required to publish contact details for a person who can answer questions about data and consent. You may contact our designated Grievance Officer at:
- Grievance Officer: Rahul (developer of VTUSync) — support@vtusync.in
We acknowledge grievances within 48 hours and make reasonable efforts to resolve them within a reasonable period, in accordance with the DPDP Act.
14. Cookies and similar technologies
We use cookies and similar technologies to operate and improve the Website, as described in our Cookie Policy. You can manage cookies through your browser settings.
15. Changes to this policy
We may update this Privacy Policy from time to time, including as DPDP obligations come into force. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you. Your continued use of the Services after changes take effect means you accept the revised policy.
16. Common questions
Does VTUSync store my students' marks or reports?
No. The app analyzes results on your device. The result files, documents, and reports you generate stay on your machine and are not uploaded to our servers.
What do you actually store about me?
We store your account details (name, email, institution), your plan and payment confirmation, licensing data used to validate your key, your faculty verification document, and basic usage and technical data from the Website.
Do you sell or share my data with third parties?
No. We do not sell personal data. We share information only with the service providers needed to operate the product (listed in section 6), when required by law, or with your consent.
Do I need to be a data protection expert to use VTUSync?
No. The app keeps student data on your device, which reduces risk. But as the person processing student data, you should follow good practices: use data only for legitimate academic purposes, keep your device and account secure, and share reports only with authorised people.
What happens if there is a data breach?
Since student data mostly stays on your device, a "breach" would most likely involve data in your control, not ours. The DPDP Act places an obligation on the Data Fiduciary (which, for student data, is you) to notify the relevant people and, where required, the authorities. We will help you understand these obligations if you contact us. For data in our control, we will notify affected users and the Data Protection Board of India as required.
Who do I contact for a grievance about my data?
Email our Grievance Officer at support@vtusync.in (see section 13). We acknowledge grievances within 48 hours and work to resolve them within a reasonable period.
How do I delete my data?
Email us at support@vtusync.in and we will help you exercise your rights, including a request to erase your personal data where lawful.
17. Contact us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at support@vtusync.in or through our Contact page. Bengaluru, Karnataka 560084
A note on local data
Because the Software analyzes student results on your device rather than on our servers, the largest part of your processing activity involves data we never receive. For specific questions about how data moves through the Software, please contact support at support@vtusync.in.