Privacy Policy
Last updated 15 October 2026.
This policy explains what personal data Quansail Technologies (“Brigaly”) collects, why, who can see it, and the rights you have under the Digital Personal Data Protection Act, 2023 and other Indian law.
1. In short
- We collect what is needed to run your institute's campus and your account — not to advertise to you.
- We do not sell personal data, and we do not show ads.
- Inside a campus, people see only what their role allows. A parent sees only their own child.
- Children's data is used only with a parent's or guardian's consent, and never for tracking or targeted advertising.
2. Who decides how your data is used
There are two cases:
- Your Brigaly account — your name, sign-in details, profile, follows and settings. Brigaly is the Data Fiduciary: we decide how this is used, as set out here.
- Your institute's records — rosters, classes, notices, fee records and other campus data an institute puts on Brigaly. The institute decides why this data is used; we process it on its behalf and on its instructions. For questions about that data, you can contact the institute or us, and we will help.
3. What we collect
You give us
- Name, email address, and a password if you choose to set one.
- Your phone number, if you verify it — used to match you to your institute's roster.
- Profile details you add: photo, pronouns, city, bio, skills, education history and documents.
- What you post or send: notices, messages, replies, event registrations, applications and uploaded files.
Your institute gives us
- Roster records: names, classes and sections, enrolment numbers, and parents' and staff contact details.
- Campus records it chooses to keep here, such as fee records, timetables and resources.
Collected as you use Brigaly
- Sign-in sessions, device and browser type, IP address and basic logs, to keep accounts secure and the service running.
- Whether you have read a notice (read receipts), shown to the institute that sent it.
- A push notification token, if you allow notifications.
From Google
If you sign in with Google, we receive your name, email address and profile photo from Google. See Google user data.
4. Google user data
You can sign in to Brigaly with your Google account, on the website or in the app. This section explains exactly what we get from Google and what we do with it.
What we access
When you choose “Continue with Google”, Google asks your permission to share your basic profile with us, and we receive only:
- your name;
- your email address, and whether Google has verified it;
- your profile photo;
- a Google account identifier, so we recognise you the next time you sign in.
We ask only for the openid, email and profile permissions. We do not access your Gmail, Contacts, Drive, Calendar, YouTube or any other Google data, and we cannot post or act on your behalf.
How we use it
- To create your Brigaly account and sign you in.
- To fill in your name and photo on your profile, which you can change at any time in Settings.
- To match your email address to your institute's roster, so you join the right campus.
- To send you sign-in and service emails at that address.
We do not use Google user data for advertising, for building advertising profiles, for selling, or for training general-purpose AI models.
How we store and protect it
This data is stored with the rest of your account in our database (MongoDB Atlas). It is encrypted in transit and at rest, and only the few people who run Brigaly can reach it, under the controls described in Security.
Who we share it with
We do not sell or rent Google user data. We share it only with the service providers listed in Service providers, and only so they can run Brigaly for us, or when the law requires it. Your name and photo are shown to others as described in Who sees what. No person at Brigaly reads this data unless you ask us to, it is needed for security or to investigate abuse, or the law requires it.
How long we keep it, and how to remove it
We keep it while your account is open. You can stop Brigaly receiving your Google data at any time at myaccount.google.com/permissions. To have the data we already hold deleted, close your account in Settings › Account and write to help@brigaly.com: we delete it within 30 days, except what the law requires us to keep.
Limited Use
Brigaly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. How we use it
- To create your account, sign you in and keep it secure.
- To connect you to your institutes: matching you to rosters, putting you in the right classes and groups, and delivering notices and messages.
- To show an institute's public page and Explore listings.
- To send you codes, notifications and important updates about the service.
- To detect abuse, fix problems and improve Brigaly using aggregated information.
- To meet legal obligations.
We rely on your consent, given when you sign up or when your institute adds you, and on the legitimate uses the law allows, such as complying with a legal duty. You can withdraw consent at any time; see your rights.
6. Who sees what
| Information | Who can see it |
|---|---|
| Public posts and an institute's page | Anyone, including search engines |
| Campus notices, groups and resources | Members of that institute the post was meant for |
| A student's records | The student, their linked parents, and the institute's authorised staff |
| Your profile | As you set it in Settings › Profile & privacy |
| Your phone number and email | Your institute's admins; never shown to other members |
There are no direct messages between members: messages go between a member and the institute.
7. Children's data
Under Indian law anyone under 18 is a child. We process a child's personal data only with the verifiable consent of a parent or lawful guardian. In most cases this consent is collected by the child's institute when it adds the child to its roster, or by the parent who links themselves to the child.
We do not track children's behaviour, profile them for advertising, or show them targeted ads. A child's profile is not visible to the public. A parent can ask us or the institute to see, correct or delete their child's data.
8. Service providers
We share data only with providers who help run Brigaly, under contracts that limit their use of it to that purpose:
| Provider | What for |
|---|---|
| Vercel | Hosting the website and storing uploaded files |
| MongoDB Atlas | Database |
| Resend | Sending emails, such as sign-in codes |
| Sign in with Google, and push notifications (Firebase Cloud Messaging) | |
| SMS provider | Sending verification codes to phone numbers |
Some of these providers may store data outside India, in countries the Government of India has not restricted. We also disclose data when the law requires it, or to protect someone from serious harm.
9. How long we keep it
We keep your account data while your account is open. Closing your account in Settings › Account signs you out everywhere and removes you from your institutes; we keep the account for a while so it can be restored if you change your mind. To have your personal data erased, write to help@brigaly.com: we erase it, or anonymise what an institute's records must keep (for example, your name on a notice you sent), except what we are required by law to retain.
Campus records stay for as long as the institute keeps them on Brigaly, and are deleted when the institute asks us to. Backups are overwritten on a rolling basis.
10. Security
Data is encrypted in transit, access is limited to people who need it, and every admin action on a campus is recorded in an audit log. See Security. If a personal data breach affects you, we will tell you and the Data Protection Board as the law requires.
11. Your rights
You can:
- ask for a summary of the personal data we hold about you and how we use it;
- correct, complete or update it — much of it directly in Settings;
- ask us to erase it (closing your account in Settings › Account stops it being used, and an erasure request removes it);
- withdraw your consent, which stops future processing but does not undo what was lawful before;
- nominate someone to exercise these rights if you die or cannot act;
- raise a grievance with us, and then with the Data Protection Board of India.
Write to help@brigaly.com. For data your institute controls, we may pass your request to the institute and help it respond.
12. Grievances
You can reach our Grievance Officer at help@brigaly.com. We acknowledge complaints within 24 hours and resolve them within 15 days. See Grievance redressal. If you are not satisfied, you may complain to the Data Protection Board of India.
13. Changes
We will update this policy as Brigaly changes, and tell you in advance about any change that matters. The date at the top shows the latest version.
14. Contact us
Brigaly is run by Quansail Technologies, Chennai, Tamil Nadu, India. For anything about this policy or your personal data, write to help@brigaly.com.