Privacy Policy.

Who We Are

Polynexus ("Polynexus", "we", "us", "our") is a software engineering company based in Nagpur, Maharashtra, India. Polynexus is the data controller for the personal data described in this policy, including the data processed through the products listed below — regardless of which domain a user signs in through (polynexus.in, campusnexus.in, vidyam.co.in, or a client-branded logistics or PolyMX deployment). We build, host, and operate the infrastructure behind every product ourselves; we do not outsource data handling to unrelated third parties.

Scope of This Policy

This policy covers:

• polynexus.in itself — this marketing website and its contact form.
• The Pench application, which has its own dedicated notice — see the Pench app privacy policy.
• Every logged-in product we operate: CampusNexus, Vidyam, PolyMX, and our logistics & dispatch platform.
• Any custom engineering engagement (digital transformation, AI automation, cloud security, or bespoke development work) where Polynexus processes a client's data under a separate contract.

Where a specific product presents its own sign-up or consent screen (for example, a school administrator accepting terms on vidyam.co.in, or a parent giving consent for a student account), that screen governs consent for that specific action, but Polynexus remains the entity responsible for the data under this policy. If a product-specific notice ever conflicts with this policy on a material point, the more specific, product-level notice controls for that product.

Information Collected on This Website

polynexus.in itself is a static marketing site. We do not run analytics scripts, advertising pixels, or tracking cookies on it. The only personal data this site collects is what you actively submit:

• Contact / project enquiry form: full name, email address, company or organisation name, and your message, submitted when you use the "Start project" or "Get in touch" forms.
• Direct email: anything you send to hello@polynexus.in.

This data is used solely to respond to your enquiry, scope potential work, and follow up about our products or services. We do not sell it or use it for advertising.

Our Products & What They Collect

Each product below is a separate application with its own login and its own users, but Polynexus operates the infrastructure and controls the data for all of them. What each one collects follows from what it actually does:

CampusNexus — University & College ERP

Used by colleges and universities under a paid subscription. We process, on behalf of the subscribing institution:

• Student and faculty account and profile data (name, contact details, role, registrar records).
• Attendance data, including facial recognition check-ins and check-in location (see Biometric, Health & Children's Data).
• Payroll, salary, and fee/accounts-ledger records for staff and students.
• Bus route and live-location data for the transit module.
• Institution-issued email accounts and associated mail metadata.

Vidyam — School Operating System

Used by K-12 schools under a paid subscription, on behalf of the subscribing school. Because Vidyam's users include students who are minors, this is the product where we handle the most sensitive categories of data:

• Student, parent/guardian, and staff profile data.
• Facial recognition and RFID attendance records, and GPS bus-tracking data used for parent notifications.
• Academic records: grades, report cards, and digital transfer certificates.
• Medical and allergy information entered by the school for emergency-response purposes.
• Fee and payment records.
• Parental consent logs, recorded to meet DPDP Act 2023 requirements for processing a child's personal data.

PolyMX — Secure Workspace Suite

Used by organisations as an email, storage, calendar, and video-meeting workspace. We process:

• Account and authentication data for each user seat.
• Email content and metadata, files stored in PolyMX Drive, calendar entries, and documents created in Collaborative Office.
• Meeting metadata for PolyMX Meet (video/audio content is not stored by default; it is transmitted peer-to-peer wherever possible).

This content belongs to the subscribing organisation and its users. Our administrators do not access mailbox or drive content except where necessary for security, legal compliance, or at the organisation administrator's direction.

Logistics & Dispatch Platform

Used by logistics and delivery businesses (for example, our client Pench Foods). For this product, the subscribing business is typically the data controller for its own drivers' and customers' data, and Polynexus acts as a data processor operating the platform on that business's behalf. Data processed includes:

• Driver identity, zone assignment, and live GPS location while on shift.
• Customer names, delivery addresses, and subscription/order details, as entered by the subscribing business.
• Geotagged proof-of-delivery photographs and timestamps.
• Dispatch-operator action logs, for audit purposes.

Each subscribing business's data is held in isolated, region-segregated database schemas and is not shared across businesses.

Biometric, Health & Children's Data

Some of our products process sensitive personal data. We call these out specifically because they carry stricter obligations under the DPDP Act 2023 than ordinary contact or account data.

Biometric data

CampusNexus and Vidyam use facial recognition and, in Vidyam's case, RFID, strictly for attendance verification and campus/classroom access. Facial data is processed to generate a match result for check-in purposes; it is not used for any other purpose (such as advertising, profiling, or sale to third parties) and is not shared outside the subscribing institution without a separate legal basis.

Health data

Vidyam's infirmary module stores medical conditions and allergy information that a school chooses to record for a student, so that staff can respond correctly in an emergency. Access to this data is restricted to authorised school staff (teachers, nurses, administrators) within that school's account.

Children's data

Vidyam is used by students who are minors. In line with the DPDP Act 2023, processing a child's personal data requires verifiable consent from a parent or lawful guardian, and we do not permit behavioural monitoring, tracking, or targeted advertising directed at children through Vidyam. Vidyam's consent-logging engine exists specifically to record and evidence that parental consent. Parents or guardians who want to review, correct, or withdraw consent for a student's data should contact the school first (as the day-to-day account holder) or reach us directly using the contact details in Grievance Officer & Contact below.

How We Use Information

• To provide, operate, and maintain the product a user or organisation has signed up for.
• To authenticate accounts and secure access (including audit logging for administrative actions).
• To respond to enquiries submitted through this website or by email.
• To bill and administer subscriptions for paid products.
• To comply with legal obligations, including responding to lawful requests from authorities.
• To detect, investigate, and prevent security incidents, fraud, or abuse of our platforms.

We do not use personal data collected through our products for advertising, and we do not sell personal data to third parties.

How We Share Information

We do not sell personal data. We share it only in the following circumstances:

• Within the product's own account: data you submit to CampusNexus, Vidyam, PolyMX, or the logistics platform is visible to the subscribing institution/organisation and the staff it authorises — that's how the product works.
• Infrastructure providers: we host our platforms on cloud and server infrastructure (including AWS) that processes data on our instructions, under contractual confidentiality and security obligations.
• Legal compliance: where required by applicable law, regulation, or a valid order from a court or government authority.
• Business transfers: if Polynexus is ever involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this policy's protections continuing to apply.

Data Retention

We retain personal data for as long as the associated account or subscription is active, and afterwards only as long as needed to comply with legal, accounting, or regulatory obligations, resolve disputes, and enforce our agreements. Academic, financial, and payroll records processed through CampusNexus and Vidyam are typically retained in line with the retention periods the subscribing institution is legally required to observe. When an institution or organisation closes its account, we work with them on data export and deletion timelines rather than deleting records unilaterally, since the institution — not Polynexus — is usually the responsible party for its own regulatory retention duties.

Data Security

Consistent with our engineering principles, security is built into every product, not added afterward:

• AES-256 encryption at rest and in transit.
• Role-based access control with audit trails on administrative actions.
• Tenant-level data isolation between institutions, organisations, and logistics clients — one customer's data is not accessible from another's account.
• Zero-trust API gateways and, where applicable, multi-factor authentication.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected account holders and relevant authorities as required by applicable law.

Cookies & Tracking

polynexus.in does not use tracking or advertising cookies, and we do not currently run analytics scripts on this site. Our logged-in products (CampusNexus, Vidyam, PolyMX, and the logistics platform) use strictly necessary session cookies or local storage to keep you signed in and to remember your session — these are essential to the product functioning and are not used to track you across other websites. If this changes, we will update this policy accordingly.

Your Rights

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or update inaccurate or incomplete personal data.
• Erasure of personal data that is no longer necessary for the purpose it was collected for, subject to our legal retention obligations.
• Withdraw consent for processing that relies on consent, at any time (without affecting processing that already took place lawfully before withdrawal).
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Grievance redressal — raise a complaint with our Grievance Officer and, if unresolved, escalate to the Data Protection Board of India.

If you're a student, parent, employee, or customer of an institution or business using one of our products, the fastest path is usually to raise the request with that institution or business directly, since they administer your account. You can also contact us directly using the details below and we will route the request appropriately.

Where Data Is Stored

Polynexus is based in India and our products are built primarily for Indian institutions and businesses. Data is hosted on cloud infrastructure that may be located in India or other regions depending on the specific deployment (including dedicated/self-hosted instances for Enterprise customers, which can be pinned to a specific region on request). Where data is processed outside India, we take steps to ensure it remains protected to a standard consistent with this policy.

Changes to This Policy

We may update this policy as our products evolve. We'll update the "Last updated" date at the top of this page when we do, and for material changes affecting how we handle sensitive or children's data, we will take reasonable steps to notify affected institutions or organisations directly.

Grievance Officer & Contact

For any question about this policy, or to exercise your rights above, contact our Grievance Officer:

Note: the DPDP Act 2023 expects a named individual to be published here. Replace the line above with your designated Grievance Officer's name once appointed.