The short version: Your data is yours. We never sell it, share it for advertising, or use it to train AI models for other companies. You can export everything to CSV anytime, and request full deletion within 24 hours.
1. Who we are
mlibrary.in (operated by Mlibrary Technologies, based in Bhavnagar, Gujarat, India) provides library management software to Indian study halls and reading libraries. This Privacy Policy explains how we collect and process information when you use our service.
2. Information we collect
From library owners (you)
- Account info: Name, email, phone, library name, address, password (hashed with argon2id).
- Payment info: Razorpay handles all payment data; we store only payment IDs and amounts (never card numbers or CVV).
- Usage data: IP address, browser, pages visited, actions taken (for security audit logs).
From your students (uploaded by you)
- Name, phone, WhatsApp number, optional photo, optional ID document images, attendance records, fees paid.
- You are the data controller for student data; we are the data processor. You must obtain consent from students before adding their data.
3. How we use your data
- To provide and maintain the service (login, dashboards, messaging, reports).
- To send transactional emails (password resets, receipts, trial reminders).
- To respond to support requests.
- To improve the product (aggregated, anonymized usage only).
- To comply with Indian law (audit logs, tax filings).
4. What we DO NOT do
- We do not sell your data to anyone.
- We do not share student data with third parties for marketing.
- We do not use your data to train AI models for other companies.
- We do not show ads inside the app.
- We do not access your data unless you explicitly request support.
5. Third-party services
We use these vetted Indian / global services:
- Razorpay — payment processing (PCI-DSS Level 1 certified, RBI-approved).
- Hostinger Business / AWS Mumbai — application + database hosting (data stored in India).
- Resend / SMTP — transactional email delivery.
- Sentry — error tracking (only stack traces, no personal data).
- Razorpay Webhook — automated payment status updates.
6. Data security
- Encryption in transit: All traffic uses TLS 1.3.
- Encryption at rest: Database and uploaded files are encrypted on disk.
- Authentication: Argon2id password hashing, secure server-side sessions, one active session per user.
- Access control: Role-based permissions (owner / staff / super-admin) with per-module gates.
- File access: Aadhaar/photo files are auth-gated and scoped to the owning tenant.
- Backups: Daily automated DB backups, retained for 30 days.
- Audit logs: All sensitive actions are logged with IP and user ID.
7. Your rights (DPDPA 2023)
Under India's Digital Personal Data Protection Act, you have the right to:
- Access your data — log in any time, export to CSV.
- Correct inaccurate data — directly editable in the app.
- Delete your account and all associated data — email
hello@mlibrary.in; we delete within 24 hours and confirm. - Withdraw consent — cancel your subscription and request deletion.
- Grievance redressal — contact our Data Protection Officer at
hello@mlibrary.in; we respond within 7 days.
8. Children's data
Our service is for Indian study libraries. Library owners frequently store data of students 18 years and older. For minors (students under 18), the library owner must obtain parental consent before adding their data. Students under 13 should not be added without explicit parental authorization in writing.
9. Cookies & local storage
We use a secure session cookie to keep you logged in and a small cookie to remember your theme. Branch selection is kept in your server session. We do not use third-party tracking cookies, Google Analytics, or advertising pixels.
10. Data retention
- Active accounts: Data retained as long as your account is active.
- Cancelled accounts: Data retained for 30 days for recovery, then permanently deleted.
- Audit logs: Retained for 12 months for security and compliance.
- Tax records: Retained for 8 years per Indian tax law.
11. International transfers
Your primary data is stored in India (Mumbai region). Some operational tools (Sentry, Resend) may briefly process data outside India under standard contractual clauses. We never store student PII outside India.
12. Changes to this policy
We will notify you by email at least 30 days before any material change to this policy. Continued use after the effective date constitutes acceptance.
13. Contact us
Email: hello@mlibrary.in
WhatsApp: +91 90239 96642
Address: Bhavnagar, Gujarat, India