← Guardian
Built privacy-first, for Indian schools.
A safety system that collects more than it needs becomes a liability the school carries. This page is what we collect, where it sits, how long it stays and what we will not build.
Principles
How we handle data
- The school is the data fiduciary
- Under the Digital Personal Data Protection Act, 2023, the school determines why and how student data is processed. Omacle is a data processor acting on your instruction. Our contract states this explicitly, and it means retention, access and disclosure are your decisions, not ours.
- Children's data carries a higher bar
- Section 9 of the Act requires verifiable parental consent before processing a child's personal data, and prohibits tracking and behavioural monitoring of anyone under 18. That prohibition applies even where a parent has consented. We build to that line rather than to the edge of it. Digital Personal Data Protection Act, 2023, section 9
- Processing happens on your campus
- Camera analytics run on a server inside your building. Video does not leave your network for processing. What reaches us is limited to system health data and the alert records you choose to share for support.
- Retention is short and written down
- Every data type has a stated retention period, listed per capability. Nothing is kept indefinitely because it might be useful later.
- You can get your data out, and get it deleted
- Export in an open format on request. On contract end we delete what we hold and confirm it in writing within 30 days.
- No third-party sharing
- We do not sell, rent or share school or student data with advertisers, insurers, data brokers or analytics providers. There is no such clause in the contract because there is no such product.
Limits
What we will not build
These are not features awaiting demand. We will decline the request.
- Facial recognition of students.
- Emotion, attention or behaviour scoring in classrooms.
- Any profile that follows a child across days or across cameras.
- Location tracking of a child outside the bus journey.
- Ranking or automated disciplinary action against students or staff.
Retention
Everything we keep, and for how long
Bus and route safety
- Boarding and alighting events per child
- 1 academic year, then deleted
- Vehicle position traces
- 90 days
- Deviation alerts and their resolutions
- 1 academic year
- Driver and attendant duty records
- As your HR policy requires
Campus AI cameras
- Alert events with a single still frame
- 90 days
- Camera health and uptime records
- 1 academic year
- Acknowledgement and action logs
- 1 academic year
- Continuous CCTV footage
- Per your DVR policy — CBSE requires at least 15 days
Network layer security
- Device inventory and firmware versions
- Life of the contract
- Network flow metadata between segments
- 30 days
- Patch and configuration change history
- Life of the contract
- Security incident records
- 3 years
AI lab setup
- Lab machine inventory and images
- Life of the contract
- Student work, stored on school-owned machines
- Controlled entirely by the school
- Support tickets
- 3 years
Bring your data protection questions to the assessment.
We will go through retention, access and the contract wording with your IT head before anything is installed.