Privacy Policy

This policy explains how the Blue Lotus mobile app and its companion web dashboard handle personal information.

Prejee Innovations builds Blue Lotus, a school management platform licensed to schools. When a school uses Blue Lotus, that school is the data controllerfor its students’ and staff records and we are its data processor. Each school-branded app has its own policy naming that school; this page describes the platform’s own practices.

Accounts are issued by the School. There is no public sign-up: you can only use the app if the School has created an account for you as a member of staff, a student, or a parent or guardian.

We collect only what the app needs to do its job. We do not sell personal information, and we do not use it for advertising or for building advertising profiles.

Location is one of the more sensitive things this app touches, so it is worth being precise about it.

• Staff attendance.When a member of staff taps check in or check out, the app reads the device’s location once, at that moment, to confirm the person is on campus. The School sees whether the check-in was inside or outside the campus boundary it configured.
• School bus tracking.On a device that the School has designated as a bus device, and only while a trip is running, the app reports the vehicle’s position so that the parents of children on that route can see where the bus is. Tracking stops when the trip ends.
• Automatic check-in (background location). Staff may be offered an optional geofenced auto check-in, which needs location access while the app is closed or not in use. It is off unless you turn it on, it is offered only to staff, and never to students or parents. When it is on, the app performs the campus boundary check in the background and marks attendance for you; a persistent notification is shown the whole time it is active. You can turn it off inside the app, or revoke the permission in Android settings, at any time. Background location is used only for this feature — never for tracking where staff go outside school, and never for advertising.

Location history is retained as attendance and trip records belonging to the School, and is visible only to School administrators — not to other staff, and not to us except as needed to run the service.

Where a student is a minor, the record is created and controlled by the School under its own arrangements with the parent or guardian, and the parent or guardian linked to that student can see it in the app. We do not knowingly collect information directly from a child outside that relationship, we show no advertising to anyone, and we do not use any student’s information to build a profile for any purpose other than the School’s own records.

If you believe a child’s information has been recorded in error, contact the School at apps@prejee.com and it will be corrected or removed.

• Location — attendance check-in and bus tracking, as described above. Denying it means you cannot use location-verified check-in; the rest of the app works.
• Camera — the check-in selfie, and attaching a photo to a record. Only used when you open the camera yourself.
• Notifications — school notices, attendance confirmations, fee reminders and messages.
• Storage / files — saving a report or ID card you have chosen to download, and attaching a file you have chosen.
• Background location and foreground service — only if you have turned on automatic check-in. The app also asks to be exempt from battery optimisation so the geofence is not silently stopped by the system.

Every one of these is requested at the moment it is first needed, with an explanation, and every one can be revoked in Android settings.

Information is visible to the School’s own authorised users according to their role, and to the parents or guardians linked to a student. Beyond that, it goes only to the service providers that make the app work:

• Google Firebase Cloud Messaging — delivering push notifications.
• Razorpay — processing fee payments. Card and bank details are handled entirely by Razorpay.
• Cloud hosting, database and file storage providers — running the service and storing the School’s data.
• SMS and email delivery providers — sending the notices and reminders the School sends.

These providers may process information only to provide their service to us. We do not sell personal information, we do not share it with data brokers, and we do not share it with advertisers. We may disclose information where the law requires it, or to protect someone’s safety.

Each School’s data is isolated from every other School’s at the database level, so one school can never read another’s records.

• All traffic between the app and our servers is encrypted in transit (HTTPS/TLS).
• Data is encrypted at rest by our hosting and storage providers.
• Sign-in tokens are kept in the device's encrypted secure storage, not in ordinary app files.
• Access is enforced per role and per school in the database itself, so a request can only ever reach the records that account is entitled to.
• Passwords are stored only as salted hashes and are never readable by us.

No system can promise perfect security, but if a breach affects your information we will notify the School and, where the law requires it, the relevant authority and the people affected.

School records are kept for as long as the School needs them — attendance and academic records are typically retained for the student’s time at the School and for a period afterwards, as the School’s own policy and Indian record-keeping rules require. When the School ends its contract with us, its data is exported to the School and deleted from our systems within 90 days. Device push tokens are deleted when you sign out or uninstall the app.

You can ask to see the information held about you, to have it corrected, or to have it deleted. Because the School is the controller, these requests are handled by the School — write to apps@prejee.com. If you contact us instead, we will pass your request to the School and support it in responding. Under India’s Digital Personal Data Protection Act, 2023 you also have the right to nominate someone to act for you and to complain to the Data Protection Board of India.

On deletion, your account and sign-in credentials are removed, your device push tokens and any stored location and check-in photos are deleted, and you can no longer sign in. Academic records the School is legally obliged to retain — such as enrolment, examination results and fee receipts — may be kept by the School in its own records for the statutory period, after which they are deleted. Signing out or uninstalling the app clears the data held on your device but does not by itself delete your account.

If this policy changes materially we will update the date at the top of this page and, where the change affects how your information is used, notify you in the app.

Controller and operator: Prejee Innovations
Bihar, India
apps@prejee.com
prejee.com

See also the Terms of Service.

Each school that runs Blue Lotus has its own app and its own policy naming that school as the data controller:

• Gurukul Vidyapeeth, Hajipur (Gurukul Vidyapeeth)
• Vision World School (Vision World School)