Privacy Policy

Two organisations are involved, and the difference between them decides who you ask for what.

Your institute

The school or academy you enrolled with or work for — currently Pumo Technovation and Monz Creative School. Your institute decides what is recorded about you, who at the institute may see it, and how long it is kept. In data-protection terms it is the data fiduciary, or controller.

Logic2Byte

The company that builds and operates LDesk (logic2byte.com). We store and process the data on the institute's instruction and for no purpose of our own. In data-protection terms we are the data processor.

There is no sign-up. You cannot create an account in either app, and neither app asks you to.

1. 1You are admitted to a course, or hired, by an institute. The institute enters your details into its own console.
2. 2Once admission and payment are complete, the institute emails you a link to the app.
3. 3You open the app and enter the email address the institute holds for you. We email you a six-digit sign-in code, valid for ten minutes.
4. 4You enter the code and you are in. You may set a password afterwards if you want one; you are never required to.

Because the account is created by the institute from records it already holds, the apps ask you for almost nothing at sign-in — an email address, and a code sent to it. We never ask for a password you use elsewhere, and we offer no social or third-party login.

The two apps are not the same, and the difference matters: only the trainer app uses the camera and location, and only because attendance is punched through it.

We also keep ordinary server logs — the date and time of a request, the endpoint, the response code, and the network address it came from — for security and for diagnosing faults. They are not used to build a profile of you and are not combined with your academic record.

This section applies to LDesk Hub, the app for trainers and other institute employees. LDesk neither asks for nor uses either permission.

Camera

Used at one moment only: when you tap Check In or Check Out, the app takes a selfie and attaches it to that punch, so your institute can verify that the person marking the attendance is you. The camera is not opened at any other time, is never used in the background, and no video or audio is ever recorded.

Location

Read at the same single moment: the coordinates at the instant of the punch are stored alongside it, so your institute can see whether you checked in at your branch. Location is requested only while the app is open and in use. There is no background location, no continuous tracking, and no location history beyond the individual punches.

Photo library

Read only if you choose an existing picture as your profile photo. Nothing else in your library is looked at.

Coordinates from a punch may be sent to OpenStreetMap's public geocoding service to turn them into a readable street name for the attendance screen. Only the coordinates are sent — never your name, your email, or anything else identifying you. Your institute can switch this lookup off entirely, in which case only the raw coordinates are stored.

• To deliver the course you enrolled in — your timetable, the topics covered, your attendance and your progress.
• To run the institute's own operations — staff attendance, leave, payroll inputs, and the fee ledger.
• To let you and your institute talk — chat, announcements and notifications.
• To keep the account secure — sign-in codes, session tokens, rate limiting, and the logs that let us investigate abuse.
• To meet legal obligations — tax invoices and financial records that Indian law requires be kept for a fixed period.

The lawful basis is the contract between you and your institute — your enrollment, or your employment — together with the institute's legitimate interest in running its own operations, and, for the records the law requires, legal obligation. Where consent is the basis, as it is for the camera, location and notification permissions, you may withdraw it at any time in your device settings.

Inside your institute, access follows role. A trainer sees the students allocated to them, and nothing about anyone's fees. A branch administrator sees their own branch. A student sees only their own record.

Outside your institute, the platform relies on the service providers below. They process data only to provide their service to us, under contract, and none of them may use it for their own purposes.

We will also disclose data where a court, a regulator or the law compels us to, and we will tell your institute when that happens unless we are forbidden from doing so.

• All traffic between the apps and the servers is encrypted with TLS. Release builds refuse plain HTTP.
• Passwords, where you have chosen to set one, are stored as bcrypt hashes. Nobody — including us — can read them back.
• Sign-in codes expire in ten minutes, are single-use, and lock out after a small number of wrong guesses.
• Sessions are short-lived tokens. Signing out everywhere invalidates every session on every device immediately.
• The database is not reachable from the internet at all; it sits on a private network behind the application.
• Files are held in private object storage and served only through short-lived signed links.
• Backups are taken nightly and stored encrypted.

If a breach affects your data, we will notify your institute without undue delay and support its notification to you and to the regulator, as the law requires.

Your institute sets the retention period, because the record is its record. The defaults the platform ships with are:

What happens when you leave, and what you can ask to have deleted, is set out in full in Data & Account Deletion.

You may ask to see the data held about you, to have it corrected, to have it erased where no legal obligation requires us to keep it, and to receive a copy in a portable form. You may also complain to the relevant data-protection authority.

Send the request to your institute, or to us at support@logic2byte.com and we will route it. We answer within 30 days. Data & Account Deletion explains the deletion route step by step.

Neither app is directed at children, and neither is designed for a child to use on their own. Where an institute enrolls a student under 18, the enrollment — and with it the consent to process that student's data — is given by a parent or guardian at admission, as part of the institute's own admission process.

No profiling, behavioural advertising or tracking of any kind is performed on any account, minor or otherwise. A parent or guardian may exercise every right in section 9 on the student's behalf by writing to the institute.

The mobile apps use no cookies at all. The web console sets exactly one — a session cookie that keeps a signed-in administrator signed in. It is httpOnly, marked Secure, and scoped to this site. There is no analytics cookie, no advertising cookie and no third-party cookie anywhere on this domain.

When this policy changes, the date at the top changes with it and the new version replaces this one at the same address. Where a change materially affects what is collected or why, your institute will tell you before it takes effect.

Email

support@logic2byte.com — one address for support, privacy, data access, deletion requests and grievances alike.

Grievance Officer

TODO — Grievance Officer name, reachable at the same address.

Postal address

Logic2Byte, TODO — registered office address, city, state, PIN, India