Privacy Policy.

Who We Are

Polynexus Technologies Private Limited ("Polynexus", "we", "us", "our"; CIN U62012MH2025PTC448054) is a software company based in Nagpur, Maharashtra, India. Our roles under the DPDP Act, 2023 are:

• polynexus.in (this website): Polynexus is the Data Fiduciary for enquiries and emails you send us, and for website analytics.
• Vidyam and CampusNexus: the school, college or university that subscribes is the Data Fiduciary for its students', parents' and staff's data. Polynexus acts as a Data Processor, processing that data only on the institution's behalf and on its instructions — regardless of which domain a user signs in through (campusnexus.in or vidyam.co.in).
• PolyMX and the logistics platform: the subscribing organisation is the Data Fiduciary for its users', drivers' and customers' data, and Polynexus acts as its Data Processor.

We build and operate our products ourselves. Hosting is provided by cloud infrastructure providers acting on our instructions (see "How We Share Information").

Scope of This Policy

This policy covers:

• polynexus.in itself — this marketing website and its contact form.
• The Pench application, which has its own dedicated notice — see the Pench app privacy policy.
• Every logged-in product we operate: CampusNexus, Vidyam, PolyMX, and our logistics & dispatch platform.
• Any custom engineering engagement (digital transformation, AI automation, cloud security, or bespoke development work) where Polynexus processes a client's data under a separate contract.

Where a specific product presents its own sign-up or consent screen (for example, a school administrator accepting terms on vidyam.co.in, or a parent giving consent for a student account), that screen governs consent for that specific action, and the institution remains the Data Fiduciary for that data, with Polynexus as its Data Processor. If a product-specific notice ever conflicts with this policy on a material point, the more specific, product-level notice controls for that product.

Information Collected on This Website

polynexus.in itself is a static marketing site. We do not run advertising pixels or retargeting trackers on it. We do use Google Analytics 4 to understand which pages are read and which links are used, in aggregate. The only personal data this site collects is what you actively submit:

• Contact / project enquiry form: full name, email address, company or organisation name, and your message, submitted when you use the "Start project" or "Get in touch" forms.
• Direct email: anything you send to admin@polynexus.in.
• Website analytics: Google Analytics 4 records the page you viewed, the page title and address, and whether you used a demo enquiry, contact, phone, email, WhatsApp or download link — together with the technical and approximate-location data Google collects by default, such as browser, device type and country or region. We do not send your name, email address, phone number or anything you type into a form to Google Analytics, and we do not use it to build advertising audiences.

This data is used solely to respond to your enquiry, scope potential work, and follow up about our products or services. We do not sell it or use it for advertising.

Our Products & What They Collect

Each product below is a separate application with its own login and its own users. Polynexus operates the infrastructure for all of them, as a Data Processor for the institution or organisation that subscribes. What each one processes follows from what it actually does:

CampusNexus — University & College ERP

Offered to colleges and universities. As Data Processor, we process on behalf of the subscribing institution (the Data Fiduciary):

• Student and faculty account and profile data (name, contact details, role, registrar records).
• Attendance data, including facial recognition check-ins and check-in location (see Biometric, Health & Children's Data).
• Payroll, salary, and fee/accounts-ledger records for staff and students.
• Bus route and live-location data for the transit module.
• Institution-issued email accounts and associated mail metadata.

Vidyam — School ERP

Offered to K-12 schools. As Data Processor, we process on behalf of the subscribing school (the Data Fiduciary). Because Vidyam's users include students who are minors, this is the product where we handle the most sensitive categories of data:

• Student, parent/guardian, and staff profile data.
• Face-recognition attendance records, captured with a teacher's phone camera — Vidyam uses no separate biometric device.
• Phone-based bus location data, used for transport tracking and parent notifications.
• Academic records: grades, report cards, and digital transfer certificates.
• Medical and allergy information entered by the school for emergency-response purposes.
• Fee and payment records.
• Parental consent logs, recorded to meet DPDP Act 2023 requirements for processing a child's personal data.

PolyMX — Secure Workspace Suite

Offered to organisations as an email, storage, calendar, and video-meeting workspace. As Data Processor for the subscribing organisation (the Data Fiduciary), we process:

• Account and authentication data for each user seat.
• Email content and metadata, files stored in PolyMX Drive, calendar entries, and documents created in Collaborative Office.
• Meeting metadata for PolyMX Meet (video/audio content is not stored by default; it is transmitted peer-to-peer wherever possible).

This content belongs to the subscribing organisation and its users. Our administrators do not access mailbox or drive content except where necessary for security, legal compliance, or at the organisation administrator's direction.

Logistics & Dispatch Platform

Offered to logistics and delivery businesses. The subscribing business is the Data Fiduciary for its own drivers' and customers' data, and Polynexus acts as a Data Processor operating the platform on that business's behalf. Data processed includes:

• Driver identity, zone assignment, and live GPS location while on shift.
• Customer names, delivery addresses, and subscription/order details, as entered by the subscribing business.
• Geotagged proof-of-delivery photographs and timestamps.
• Dispatch-operator action logs, for audit purposes.

Each subscribing business's data is held in isolated, region-segregated database schemas and is not shared across businesses.

Biometric, Health & Children's Data

Some of our products process sensitive personal data. We call these out specifically because they carry stricter obligations under the DPDP Act 2023 than ordinary contact or account data.

Biometric data

CampusNexus and Vidyam use facial recognition strictly for attendance verification. In Vidyam, faces are recognised with a teacher's phone camera; no separate biometric device is used. Facial data is processed to generate a match result for check-in purposes; it is not used for any other purpose (such as advertising, profiling, or sale to third parties) and is not shared outside the subscribing institution without a separate legal basis.

Health data

Vidyam's infirmary module stores medical conditions and allergy information that a school chooses to record for a student, so that staff can respond correctly in an emergency. Access to this data is restricted to authorised school staff (teachers, nurses, administrators) within that school's account.

Children's data

Vidyam's users include students who are minors. In line with the DPDP Act 2023, processing a child's personal data requires verifiable consent from a parent or lawful guardian, and we do not permit behavioural monitoring, tracking, or targeted advertising directed at children through Vidyam. Vidyam's consent-logging engine exists specifically to record and evidence that parental consent. Parents or guardians who want to review, correct, or withdraw consent for a student's data should contact the school first (as the Data Fiduciary for that data) or reach us directly using the contact details in Grievance Officer & Contact below.

How We Use Information

• To provide, operate, and maintain the product a user or organisation has signed up for.
• To authenticate accounts and secure access (including audit logging for administrative actions).
• To respond to enquiries submitted through this website or by email.
• To bill and administer subscriptions for paid products.
• To comply with legal obligations, including responding to lawful requests from authorities.
• To detect, investigate, and prevent security incidents, fraud, or abuse of our platforms.

We do not use personal data collected through our products for advertising, and we do not sell personal data to third parties.

How We Share Information

We do not sell personal data. We share it only in the following circumstances:

• Within the product's own account: data you submit to CampusNexus, Vidyam, PolyMX, or the logistics platform is visible to the subscribing institution/organisation and the staff it authorises — that's how the product works.
• Infrastructure providers: we host our platforms with cloud infrastructure providers that process data on our instructions, under contractual confidentiality and security obligations.
• Legal compliance: where required by applicable law, regulation, or a valid order from a court or government authority.
• Business transfers: if Polynexus is ever involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this policy's protections continuing to apply.

Data Retention

We retain personal data for as long as the associated account or subscription is active, and afterwards only as long as needed to comply with legal, accounting, or regulatory obligations, resolve disputes, and enforce our agreements. Academic, financial, and payroll records processed through CampusNexus and Vidyam are typically retained in line with the retention periods the subscribing institution is legally required to observe. When an institution or organisation closes its account, we work with them on data export and deletion timelines rather than deleting records unilaterally, since the institution — as Data Fiduciary, not Polynexus — is responsible for its own regulatory retention duties.

Data Security

Consistent with our engineering principles, security is built into every product, not added afterward:

• Data is transmitted over encrypted (HTTPS) connections.
• Role-based access control with audit trails on administrative actions.
• Tenant-level data isolation between institutions and organisations — one institution's data is not accessible from another's account.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected account holders and relevant authorities as required by applicable law.

Cookies & Tracking

polynexus.in does not use advertising or retargeting cookies. It does run Google Analytics 4, which sets its own cookies to tell repeat visits apart and to measure how the site is used; the events we record are listed under Information Collected on This Website above, and none of them carry your name, email address, phone number or form contents. You can block these cookies in your browser, or install Google’s opt-out add-on, without affecting how the site works. Our logged-in products (CampusNexus, Vidyam, PolyMX, and the logistics platform) use strictly necessary session cookies or local storage to keep you signed in and to remember your session — these are essential to the product functioning and are not used to track you across other websites. If this changes, we will update this policy accordingly.

Your Rights

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or update inaccurate or incomplete personal data.
• Erasure of personal data that is no longer necessary for the purpose it was collected for, subject to our legal retention obligations.
• Withdraw consent for processing that relies on consent, at any time (without affecting processing that already took place lawfully before withdrawal).
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Grievance redressal — raise a complaint with our Grievance Officer and, if unresolved, escalate to the Data Protection Board of India.

If you're a student, parent, employee, or customer of an institution or business using one of our products, the fastest path is usually to raise the request with that institution or business directly, since it is the Data Fiduciary for your data and Polynexus processes it on its behalf. You can also contact us directly using the details below and we will route the request appropriately.

Where Data Is Stored

Polynexus is based in India and our products are built primarily for Indian institutions and businesses. Data is hosted on cloud infrastructure that may be located in India or other regions depending on the specific deployment (including dedicated or self-hosted Enterprise deployments, which can be pinned to a specific region on request). Where data is processed outside India, we take steps to ensure it remains protected to a standard consistent with this policy.

Changes to This Policy

We may update this policy as our products evolve. We'll update the "Last updated" date at the top of this page when we do, and for material changes affecting how we handle sensitive or children's data, we will take reasonable steps to notify affected institutions or organisations directly.

Grievance Officer & Contact

For any question about this policy, or to exercise your rights above, contact our Grievance Officer: