Privacy policy

FeeDesk is fee-management software for coaching institutes, provided by Codeworth, a business run by Swayam Bhalotia and Keshav Mishra as partners (not yet registered), West Bengal, India (“Codeworth”, “we”). This policy explains what personal data we handle, why, and your rights under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its Rules.

Data an institute puts into FeeDesk (its students, parents and guardians, staff, fees, payments, attendance and messages): the institute decides what is collected and why, so the institute is the Data Fiduciary. Codeworth processes it only on the institute’s behalf, as its Data Processor, under our data processing agreement. If you are a student, parent or guardian, please contact your institute first about your data; we help them answer you.

Our own data: the accounts of institute owners and staff (name, email, sign-in security), billing details for FeeDesk subscriptions, what you send us when you contact us, and this website. For these, Codeworth is the Data Fiduciary.

• Students: name, date of birth, gender, photo (optional), admission number, batches, documents the institute uploads.
• Parents and guardians: name, relationship, phone number, their consent to data use and to WhatsApp messages (and when it was given).
• Fees: plans, charges, discounts, payments, receipts; attendance; messages sent to guardians and their replies.
• Staff: name, email, role and branches, and a log of what they change.

Most students are children. The DPDP Act requires the verifiable consent of a parent or guardian before a child’s data is processed; the institute obtains it, and FeeDesk records that consent with each guardian. FeeDesk never tracks, profiles or advertises to children.

• Owner and staff accounts: name, email, a hashed password, two-factor settings, sign-in history and the devices signed in. To let you sign in securely and to protect the account.
• Subscriptions: the institute’s name, address and GSTIN, invoices and payments. To bill for FeeDesk and to keep the records tax law requires.
• Support: messages you send us on WhatsApp or email. To help you.
• This website: visits are counted by Cloudflare Web Analytics, which uses no cookies and does not identify you. The website has no forms and sets no cookies.

FeeDesk itself uses only the cookies it needs to work: those that keep you signed in securely, and two that remember the branch you chose and whether the sidebar is collapsed. There are no advertising or tracking cookies.

We use these companies to run FeeDesk (our sub-processors):

• Hetzner Online GmbH (Germany / Finland): Servers that run FeeDesk and hold its database and uploaded files.
• Cloudflare, Inc. (Global network): Stores the nightly backups (encrypted before they leave our server, with a key only Codeworth holds); hosts this website and counts its visits without cookies.
• Resend, Inc. (United States): Sends FeeDesk’s emails: sign-in and invitation codes, security notices, invoices.
• Have I Been Pwned (Troy Hunt) (Global): Checks new passwords against known data breaches. Only the first 5 characters of a hash of the password are sent; never the password or who it belongs to.

An institute may also connect its own accounts with these services; they then process data for the institute, under its agreements with them:

• Meta Platforms (WhatsApp Business Platform): Fee reminders, receipts and absence alerts on WhatsApp.
• MSG91 (Walkover Web Solutions Pvt Ltd): SMS reminders and alerts.
• Razorpay Software Pvt Ltd: Online fee payments, paid into the institute’s own account.

FeeDesk’s servers are in Germany or Finland. The DPDP Act allows personal data to be processed outside India except in countries the Government of India restricts; neither is restricted. We do not sell or rent personal data to anyone.

• An institute’s data is kept while its account is open. When the owner closes the account, everything is deleted 30 days later.
• Messages keep their contents (names, amounts, links, replies) for 180 days; after that only who, when, which template and whether it was delivered remain.
• Report PDFs and full exports are deleted 24 hours after they are made. Sign-in sessions end after 7 days without use.
• Encrypted backups are kept for up to 6 months, then deleted. A backup is only ever restored to recover the whole service from a failure.
• Invoices and payment records are kept as long as tax law requires.

Each institute’s records are kept apart by the database itself; everything travels over HTTPS; passwords are stored only as salted hashes; owners must use two-factor sign-in; payment and messaging keys are encrypted; every change is written to an audit log that cannot be edited; parents’ numbers are hidden from teachers; backups are encrypted before they leave the server. Only Codeworth’s two partners can reach the servers. The full list is in Annex A of the data processing agreement.

If a breach affects an institute’s data, we tell the institute within 24 hours of learning of it, with what we know, so it can inform the Data Protection Board and the people affected as the law requires.

Under the DPDP Act you may ask:

• what personal data is held about you and who it has been shared with;
• to correct, complete or update it, or to erase it;
• to withdraw consent you gave (this does not undo what was done before);
• to nominate someone to act for you if you die or cannot act yourself;
• to have a grievance answered.

Students, parents and guardians: ask your institute. It can correct records, remove a guardian’s consent for WhatsApp, export a student’s data and anonymise a student who has left, and we help it respond. Owners and staff, or anyone about our own data: write to us.

Swayam Bhalotia, Codeworth, West Bengal, India. codeworth.official@gmail.com · WhatsApp +91 98329 00366. We reply within 7 days and aim to resolve a grievance within 30. If you are not satisfied, you may complain to the Data Protection Board of India.

FeeDesk accounts are for adults (18 or older) working at or running an institute. Children’s data enters FeeDesk only through their institute, with a parent’s or guardian’s consent.

We will email institute owners at least 15 days before any change that affects how their data is handled, and update the date at the top of this page.