Privacy Policy

Institra is a learning and wellbeing platform for colleges and universities. It is built and operated by Institra Private Limited, a company incorporated in India with its office in Bengaluru, Karnataka (“Institra”, “we”, “us”). This policy explains what personal data we handle, why, where it is kept and what you can do about it. It covers the Institra web app at app.institra.in, the Institra Desktop exam client, and this website.

Most people who use Institra do so because their institute has adopted it. In that case the institute decides what the platform is used for and who is enrolled; under India’s Digital Personal Data Protection Act, 2023 the institute is the data fiduciary and Institra is its data processor, acting on the institute’s instructions under a written agreement. Where you deal with us directly — an enquiry on this website, or an individual professor account — we are the fiduciary for that data.

Account data. Name, email address, institute, department and role (student, professor, counsellor, administrator or other staff), a password (stored only as a hash by our authentication provider) and, if you sign in with Google or Microsoft, the name and verified email address that provider returns. We do not receive your Google or Microsoft password.

Academic data. Courses, enrolments, assignments, submissions, exam answers, grades, attendance and feedback. Uploaded files are stored so they can be graded and returned.

Proctoring data (proctored exams only). During a proctored exam your browser captures webcam frames locally and looks for an absent face, a second person, a phone and sustained looking away; window and tab switching is recorded. Small periodic snapshots and, if your institute enables it, a webcam recording are stored so a professor can review a flag. Face detection runs on your device; no facial biometric template is stored or matched. Institra Desktop additionally reports the security posture of the machine (for example a second display, a virtual machine or a screen recorder) and proves to the server that it is the genuine client. It does not record keystrokes.

Wellbeing data (only if your institute switches the wellbeing module on). Daily check-ins, standard screener responses and scores (GAD-7, PHQ-9), notes and messages you share with your institute’s counselling team, appointment bookings and, if you record one, a voice note. This is sensitive personal data and is handled as described under Wellbeing data.

Live classes. Audio and video while you are in a live class; a recording if the professor records the session; the pages of the board if the professor teaches on it; and, while the professor has class notes switched on, a transcript of the professor’s own microphone. Students’ microphones are never transcribed.

Enquiries. If you use the form on this website: your name, email, institute and message. We use these only to reply.

Technical data. Sign-in and session records, the IP address and browser of a request, error reports, and logs needed to run and secure the service. Requests to the enquiry form are rate-limited by IP address.

We do not collect payment card details; institute fees are invoiced separately.

• To run teaching, assessment and, where enabled, counselling for your institute — the purpose the institute engaged us for.
• To keep exams fair: proctoring signals exist so that a human at your institute can review them. Institra never issues an automatic verdict of misconduct, and grading and exam outcomes are computed on the server so a score cannot be altered by the student.
• To secure the service and its accounts, and to investigate incidents.
• To send the emails the service needs: invitations, a welcome message, course announcements and counselling notifications. We do not send marketing email to students or staff.
• To reply to enquiries you send us.

We do not sell personal data, share it with advertisers, or use institute data for anything other than running the service. We do not use your data to train AI models.

Institra uses OpenAI’s models for optional features a professor chooses to use: generating questions from a topic or a file, drafting rubrics, suggesting a grade for a long answer, and the setup assistant. When a professor uses these, the text of the question, rubric or answer being worked on is sent to OpenAI. We do not send a student’s name or account details with it. Every AI grade is a suggestion the professor confirms or changes; the professor is always the one who grades.

In the wellbeing module, a voice note you choose to record may be transcribed by OpenAI so your counsellor can read it. Nothing is sent unless you record one.

In live classes, two features send the professor’s voice to OpenAI to be turned into text, and never a student’s. The board’s spoken instructions send a few seconds of audio each time the professor taps the microphone. Class notes transcribe the professor’s microphone in four-minute pieces while notes are on, so students get the class’s words beside the recording, searchable, with each line jumping to its moment. Notes are on when a professor joins a class, shown on the professor’s screen as NOTES, and can be paused with one click; the choice is remembered on that device. The audio pieces and the transcript are stored in India. OpenAI receives each piece only to convert it to text and, under its API terms, does not use it to train its models and deletes it within 30 days.

The database, authentication and file storage run on Supabase in the AWS Mumbai region. The application runs on Vercel in Mumbai. Student and staff data is stored in India.

A small number of services outside India receive only what they need to do their job:

• OpenAI — the text described under AI features, voice notes for transcription, and the professor’s microphone during live classes for the board’s spoken instructions and class notes, as described there.
• JDoodle — the code a student runs for a coding question, until Institra moves that sandbox onto its own servers.
• LiveKit — live class audio and video while a class is running.
• Brevo — delivers the emails the service sends, and therefore sees the recipient’s name and address and the message.
• Google and Microsoft — only if you choose to sign in with them. They see the sign-in and return your name and verified address.
• Sentry — error reports, with request bodies, cookies and headers stripped before anything is sent.

This website loads its styling from Tailwind’s CDN and its font from Google Fonts, so those servers see your browser’s request for the file. The website sets no tracking or advertising cookies.

Access is enforced inside the database, row by row, not only in the application.

• A professor sees their own courses and the students enrolled in them.
• A student sees their own work and grades.
• An institute administrator sees membership and settings, not the inside of courses.
• A counsellor sees wellbeing data and never academic data.
• A professor never sees wellbeing data. Screener scores are never shown to professors.

Institra staff access production data only to operate the service or to investigate a problem you or your institute have reported.

The wellbeing module is off by default and is switched on by the institute. Its data lives in a separate database schema with its own access rules and its own audit log. Every time a counsellor opens a student’s wellbeing record, the access is logged, and the student can see that log.

Because a wellbeing record is part of a safeguard, students cannot delete their own records from inside the app. Erasure requests go through the institute (see Your rights). Staff who use the same check-in have the same protections: their records are private from their institute’s management.

Institra is not a medical or emergency service. If you are in immediate danger, contact local emergency services; in India, Tele-MANAS at 14416 is free and available around the clock.

• Proctoring snapshots and recordings of attempts with no flags are deleted automatically after 30 days. Flagged attempts are kept until the institute asks for their removal, because they are what a grievance panel may need.
• Academic and account data is kept for as long as the institute’s agreement with us runs, and then returned or deleted at the institute’s instruction.
• Live class recordings, board pages and transcripts are academic data and kept the same way, under the institute’s retention instructions.
• Wellbeing data is kept under the institute’s retention instructions, given the safeguarding purpose above.
• Enquiries are kept only as long as needed to reply and follow up.
• Logs and backups are kept for a limited period for security and recovery and then expire.

• Data is encrypted in transit. Passwords are never stored in clear; sessions are signed tokens.
• Every access rule is enforced in the database itself, so a bug in a page cannot expose another person’s data.
• Every code change is checked automatically before it can be deployed, and the production build refuses to start if a security setting is missing.
• The desktop client proves it is genuine on every request, and outdated versions are refused.
• Backups are taken before every release and exam day.

No system is perfectly secure. If we learn of a breach affecting your data we will inform the affected institute without undue delay and, where the law requires, the Data Protection Board of India and the affected individuals.

You can ask to see the personal data we hold about you, to have it corrected, or to have it erased, and you can withdraw a consent you gave. Because your institute is the fiduciary for your data, the quickest route is your institute’s administrator or data-protection contact; we honour their instruction within the timelines the DPDP Act sets. You can also write to us directly at contact@institra.in and we will route the request.

Some data cannot be erased on request: exam records an institute must keep, and wellbeing records that are part of a safeguard. When that applies, we will tell you why.

Under-18s. Where a student is under 18, the institute is responsible for obtaining the consent the law requires from a parent or guardian before enrolling them. Institra does not knowingly collect data from children outside an institute’s programme.

The Institra app uses cookies only to keep you signed in and to protect your session. This website uses no cookies of its own and no analytics or advertising trackers.

When we change this policy we update the date at the top. If a change affects what we collect or how we use it, we tell institutes in advance so they can inform their students and staff.

Questions, requests and grievances about personal data: contact@institra.in or +91 74780 44999. Please put “Privacy” in the subject line. We reply within one working day and aim to resolve grievances within the period the DPDP Act allows.

Institra Private Limited · Bengaluru, Karnataka, India.