NIKSHA OS — Third-Party Services & Sub-processors
Operator: NIKSHA Technologies ("NIKSHA OS", "we", "us").
This page lists the third-party services NIKSHA OS uses, what each does, what data reaches it, and whether it processes data outside India. It supports the Privacy Policy and the Institution Agreement, which gives Institutions 30 days' notice of a new sub-processor.
Basis for this version. Re-verified against the codebase on 7 October 2026 (see LEGAL_REVIEW_2026-10-07.md). Version 3.0 said WhatsApp was link-only and that Cloudflare R2 held one pilot Institution's files; both had stopped being true. It also omitted Hostinger and the OpenStreetMap services. Version 4.1 (26 October 2026) records that from app version 1.0.26 maps come from NIKSHA OS's own map server and the app makes no request to OpenStreetMap (MAP-002).
1. How to read this list
- Active — integrated and in use to deliver the Service today.
- Active, opt-in per school — deployed and working, but sends nothing for a school until that school has switched it on.
- Integrated, not currently active — built and wired, but switched off or unconfigured in production, so no data is being sent.
- Optional / off by default — disabled unless the operator deliberately configures and enables it. While off, no data is sent.
- Planned — not deployed. No data flow exists.
A sub-processor processes personal data only on our instructions and only to provide its specific function.
2. Hosting & core infrastructure
| Service | Function | Data handled | Location | Status |
|---|---|---|---|---|
| Supabase Cloud (managed database) | Primary production database | All core service data at rest | India — Mumbai (ap-south-1) | Active since 8 August 2026 |
| Hostinger (rented virtual server, operated by us) | Runs the API/edge functions, gateway, face-inference service, scheduled jobs and local encrypted backups | All service data in transit; backups | India (Mumbai) | Active |
Cloudflare R2 (object storage, bucket niksha-storage) | Storage for uploaded files, documents and photographs — default for all Institutions since 8 September 2026 | Uploaded files, documents, photographs, export files | Asia-Pacific (Cloudflare location hint, best effort) — Cloudflare applies location hints on a best-effort basis only; India-only storage is not guaranteed. | Active |
| Face inference service (our own software, on the Hostinger server) | Converts a staff face crop into a numeric embedding | Face crop, in memory only — never written to disk, never logged. (Separately, one small staging photo may be kept in our own database while a face setup awaits approval — Privacy Policy §3.5; it never leaves our infrastructure.) | Same server as above | Active — not a third party. No facial image is sent to any external provider. |
| PostgreSQL (self-hosted) | Former primary database, retained read-only as a rollback | Service data as at the 8 August 2026 cutover | Same server as above | Retained, read-only |
3. Active sub-processors (third parties)
| Service | Provider | Function | Personal data shared | Outside India? | Status |
|---|---|---|---|---|---|
| Fast2SMS | Fast2SMS (India) | Login one-time passwords (OTP) by SMS, and other school alerts where switched on | Mobile number + the message text | See §3.1 — the route used is an international gateway | Active — current SMS provider |
| WhatsApp Business Platform (Cloud API) | Meta Platforms | School notifications by WhatsApp, from one NIKSHA business number, only for schools that have switched WhatsApp on and only to numbers recorded as opted in | Mobile number; template name and contents (e.g. student name, class, attendance, fee amount, receipt number, marks, infirmary visit, staff net pay, pickup time); replies (free text discarded unless an opt-in/opt-out keyword); delivery status | Yes | Active, opt-in per school. Off by default at platform, school and message-type level. Bulk/marketing sending is off. WhatsApp login OTP is not active. Meta states that for the Cloud API it "acts as a data processor/service provider on behalf of the business", keeps messages for a maximum of 30 days, and does not automatically use them for ads. |
| Firebase Cloud Messaging (FCM) | Google (USA) | Push notifications | Device push token + notification title/body | Yes — USA | Active |
| Firebase Crashlytics | Google (USA) | Crash reporting from the released app, to find and fix faults | Scrubbed error text and code location, app version, device model, OS version and device condition, Firebase installation identifier, an opaque internal user number. Name, phone number, email, student data, messages and documents are not attached; phone numbers and email addresses found in error text are removed before the report is sent. Retained 90 days by Firebase | Yes — USA | Active in the released app (added 17 October 2026). Collection is off in test builds. See Privacy Policy §3.2 |
| Google OAuth (service account) | Google (USA) | Mints short-lived tokens so our server can call FCM | Server-to-server only; no user data | Yes — USA | Active (supports FCM) |
| Anthropic (Claude) | Anthropic (USA) | AI features — staff assistant fallback, parent insights, summaries, drafting | The text submitted and the school data needed to answer it; may include student data. Anthropic's published commercial terms bar training on API content; inputs and outputs are deleted within 30 days (flagged content up to 2 years). Owner-confirm the keys sit on a commercial API account with no differing agreement | Yes — USA or other countries; no India storage option | Active — default AI provider, enabled by default per school |
| OpenStreetMap tiles and Nominatim | OpenStreetMap Foundation (UK) | Map tiles in transport and location screens; place search when setting a school location | Device IP address, map area requested, place names typed | Yes | App versions before 1.0.26 only. From 1.0.26 the app makes no request to OpenStreetMap tiles or Nominatim; OpenStreetMap stays the source of the map data (© OpenStreetMap contributors, ODbL). This row is removed once versions before 1.0.26 are no longer supported. |
NIKSHA OS map server (maps.nikshaos.in) | NIKSHA OS, on the Hostinger server above | Offline map packs (public map files by area) downloaded to the phone | Device IP address only; no user, child or school data | India (Mumbai) (same server as Hostinger above) | Active from app version 1.0.26 |
WhatsApp deep-links (wa.me) | Meta | Opens a pre-filled WhatsApp chat on the user's own device when a user taps "contact on WhatsApp" | None sent by us — the user sends the message themselves | User-initiated | Active |
3.1 SMS delivery — provider, route, and DLT status
The provider is Fast2SMS. "Quick SMS" is Fast2SMS's own name for one of its delivery routes (route=q), not a separate company.
The route in use is an international (ILDO) gateway. Consequently:
- Data leaves India in transit. The message and the destination number are carried by an international operator before terminating on the recipient's Indian network.
- TRAI DLT registration is not in place, and per Fast2SMS's documentation the international route falls outside the DLT framework. There is no DLT Principal Entity registration, approved sender header or approved template, which is why messages arrive from a generic sender. Owner action: have this routing position confirmed under TRAI's current regulations; moving to a domestic DLT route would end the international transfer.
Provider changes. The active SMS provider is configurable by the platform operator without an app update. If it changes, this document and the Privacy Policy must be updated before the new provider carries live traffic. Twilio is implemented and is not active.
3.2 Not sub-processors, but worth knowing
- Google ML Kit (face detection, text recognition) and other on-device models run on the phone; images are not sent to Google by these features.
- Google Play (and Apple's App Store) deliver the app and its updates under their own terms.
4. Integrated but not currently active
No data is currently sent to these.
| Service | Provider | Function | Outside India? | Notes |
|---|---|---|---|---|
| Razorpay | Razorpay (India) | Online fee payment | India-based (card networks may be international) | Stub mode is on by default and no live credentials are configured. A fee payment recorded in the app does not contact the gateway or move money. Card details would be entered in Razorpay's own checkout and never received or stored by us. |
| Cloudflare R2 (off-site database backups) | Cloudflare | Off-site copy of encrypted database backups (separate bucket) | Not confirmed | Built, not switched on; backups stay on our own server. |
5. Optional integrations (disabled by default)
Off unless the operator configures credentials and enables them. While off, they send no data.
| Service | Provider | Function | Outside India? |
|---|---|---|---|
| OpenRouter | OpenRouter (USA) | Alternative AI routing | Yes — USA |
| OpenAI | OpenAI (USA) | Alternative AI provider; poster-image generation | Yes — USA |
| Stability AI | Stability AI (UK) | Poster-image generation | Yes |
| Voyage AI | Voyage AI (USA) | Text embeddings (AI answer cache, support knowledge base) | Yes — USA |
| Twilio | Twilio (USA) | Alternative SMS | Yes — USA |
| SendGrid | Twilio/SendGrid (USA) | Transactional email | Yes — USA |
| MSG91 / Gupshup | MSG91, Gupshup (India) | Older per-school WhatsApp route (superseded by the Cloud API above) | India-based |
| Meta Graph API (Facebook / Instagram) | Meta (USA) | Publishing approved school posts to a school's own account | Yes — USA |
6. Live classes — our own media server, not a third party
| Service | Function | Status |
|---|---|---|
| LiveKit (open-source real-time audio/video server software) | Live classroom audio/video, and class recordings where a teacher records | Live classes: available where an Institution uses them. We run the LiveKit server software ourselves on our application server (§2), so class audio and video are not sent to LiveKit's company or another third party. Recording: where available, kept recordings are stored in our file storage (§2). See Privacy Policy §3.7A. |
7. What we do NOT use
- ❌ No advertising or ad-network SDKs, and no advertising anywhere in the app.
- ❌ No third-party analytics or behavioural-tracking SDKs — no Google Analytics, no Firebase Analytics — in the app, the web app or the public website.
- ❌ No telemetry or analytics SDK — no Sentry. (Crash reporting is used: Firebase Crashlytics, listed in §3, receives crash reports only.)
- ❌ No data brokers, and no sale of personal data.
- ❌ No collection of advertising ID, IMEI, MAC address or SIM serial.
- ❌ No third-party service ever receives a facial image.
Firebase is used for Cloud Messaging (push) and Crashlytics (crash reports). No other Firebase product is used.
8. International transfers
Where a provider processes data outside India — currently Meta (WhatsApp), Google (FCM), Anthropic, the OpenStreetMap Foundation (app versions before 1.0.26 only) and the international SMS route, and possibly Cloudflare R2, whose Asia-Pacific location hint is applied on a best-effort basis only (Hostinger's server is in India) — we send only the minimum necessary data, under contractual safeguards, and not to any country restricted by the Central Government under section 16 of the DPDP Act.
9. Changes to sub-processors
We keep this list current. Additions or changes are recorded in the CHANGELOG, and Institutions get 30 days' notice of a new sub-processor that will receive their personal data. Institutions may contact support@nikshaos.in to ask about sub-processors, or to object as provided in the Institution Agreement Part B5.