Privacy Policy
This policy explains how YAI Library Manager handles information during its controlled pilot for study-library operators in India. A participating library controls the student and operational records it enters. The service processes that information to provide the library-management tools described below.
Information handled by the service
- Accounts and libraries: owner or manager email, account credentials handled by the authentication service, display name, role, invitation and active-membership status, and library name, phone, address, state and district or city.
- Students and memberships: student name, phone and, where entered, email and address; admission, joining and due dates; plans, fees, status, notes and membership history.
- Library operations: attendance or check-in records, seat and locker assignments, payments, charges, dues, payment method or reference, deposits, refunds or forfeits, expenses, and related operational notes.
- Security and audit records: authentication, authorization, administrative and activity records needed to protect accounts and trace important operations.
- Browser information: the current sign-in session, selected workspace and limited interface preferences may be stored in the browser. A library logo may also be kept locally in the browser.
The current application does not ask for a student's date of birth. Libraries should enter only information genuinely needed for their operations.
Why information is used
Information is used to authenticate users, manage libraries and staff access, maintain memberships, attendance, seats, lockers, fees and payments, support the pilot, prevent misuse, diagnose errors, keep recovery backups and meet legitimate security or legal needs. Tenant business data is not used for advertising.
Library responsibilities
Each library is responsible for ensuring that the student information it enters is accurate, relevant and collected lawfully. The library must provide any notice and obtain any consent or other authority required for its use of the data, especially when a student is a child. Users must not upload unnecessary sensitive information in free-text notes.
Infrastructure and sharing
The service uses specialist infrastructure providers at a high level: Supabase for hosted database and authentication services, Cloudflare Pages for delivery of the web application, and GitHub for source-code and uptime-monitoring workflows. These providers process technical information as needed to operate their services. Tenant business records are not intentionally stored in the source-code repository or public monitoring output.
If an operator chooses the WhatsApp reminder option, the operator decides what phone number and message to send, and WhatsApp's own terms and privacy practices then apply to that transfer. Information may also be disclosed where required by law or reasonably necessary to protect users, the service or others.
Access and security
Access is restricted through authenticated roles such as Owner and Manager and through database access controls. Users must protect their credentials and sign out of shared devices. Reasonable safeguards, backups and monitoring are used, but no internet service can promise perfect security, uninterrupted availability or zero risk of data loss.
Retention, deletion and user requests
Records are retained while needed to provide the pilot, protect the service and support recovery. Manual library deactivation does not delete tenant data. Subscription suspension also does not delete data. Account or library deletion requires an explicit, verified request and process. Recovery backups may retain copies for a limited recovery cycle after operational deletion.
The exact operational and backup retention periods have not yet been finalized and are an owner policy decision required before wider commercial launch. See the Data Retention & Deletion page for the current process. A library may request access, correction, export or deletion through the pilot coordinator while the permanent support channel is being finalized. Identity and authority to act for the library may be verified before a request is completed.
Policy updates
This policy may be updated as the pilot, legal requirements or service providers change. The date at the top will be revised when material changes are made. Participating libraries should review significant updates communicated during the pilot.