Privacy Policy

1. Introduction

Aerish Academy ("Aerish", "we") is a school operations platform developed by Anselia. Aerish provides academic, finance/e-wallet, attendance, new-student admission, point-of-sale, and HR services for many schools (multi-tenant) through web and mobile apps. This Privacy Policy explains how we process your personal data.

In many cases, the school/institution where you are enrolled acts as the Data Controller of its students’, guardians’, and employees’ data, while Aerish acts as a Data Processor processing data on the school’s behalf. For account and platform-usage data, Aerish may act as Controller.

2. Data We Collect

a. Identity & Account

• Full name, username, email, phone number, profile photo;
• National student number (NISN), national ID (NIK), family card number, place & date of birth, gender, religion, address;
• Education details (previous school, level, class).

b. Parent/Guardian Data

• Name, national ID, family card number, birth place/date, address, occupation, income, and education of the father/mother/guardian.

c. Employee Data

• Employment details, department, position, and payroll data for users with staff roles.

d. Financial Data

• Savings/wallet balance, bills (e.g. tuition), transaction history, top-ups, Virtual Account numbers, and payment details;
• Transaction PIN is stored as a hash (never stored as plaintext).

e. Attendance & Biometric Data

• For attendance features we may process a selfie photo, face-matching results, and location (GPS) data at check-in, plus device identifiers, solely to verify attendance.

f. Academic & Health Data

• Grades, report cards, rankings, memorization records, discipline/point notes, and student health records entered by the school.

g. Admission (PSB) Data

• Applicant data and uploaded documents (e.g. family card, national ID, birth certificate, diploma/report card).

h. Device & Technical Data

• Push notification tokens, device/platform type, IP address, and activity/audit logs for security.

3. Legal Basis & Consent

We process personal data under Indonesia’s Law No. 27 of 2022 on Personal Data Protection (PDP Law). Bases include your consent, performance of the service agreement, compliance with legal obligations, and balanced legitimate interests. Consent may be withdrawn at any time without affecting prior lawful processing.

4. Purposes of Use

• Provide and manage academic, finance, attendance, admission, and HR services;
• Process payments, top-ups, and bills;
• Send account, payment, and school-activity notifications;
• Maintain security, prevent misuse, and meet legal obligations;
• Improve service quality.

5. Sharing with Third Parties

We do not sell your personal data. We share data as necessary with service providers that support the platform:

• Payment gateways (e.g. Duitku, iPaymu, DOKU, Xendit) to process payments/top-ups;
• File storage on cloud object storage (Alibaba Cloud OSS) for photos and documents;
• Notifications & analytics (Expo Push, Firebase) for push notifications and diagnostics;
• Messaging channels (WhatsApp, Telegram, email/SMTP) for communications;
• IoT devices (e.g. RFID card machines) via MQTT for related features;
• Authorities where required by law.

6. Storage & Location

Data is stored in our databases and cloud object storage. Some file storage uses cloud providers whose data centers may be located abroad; such transfers use reasonable safeguards.

7. Security

We apply reasonable technical and organizational measures, including transport encryption (HTTPS/TLS), token-based authentication (JWT), hashed passwords and PINs, PIN attempt limits, role-based access control, and activity logging.

8. Retention & Deletion

We retain data while the account is active and as needed for processing purposes or legal/financial/audit obligations. Deletion uses soft delete first, then may be permanently removed per our retention policy. See the Account & Data Deletion Policy.

9. Your Rights

Under the PDP Law you may access, correct, update, and delete data, restrict/object to certain processing, withdraw consent, and lodge complaints. Some requests may be facilitated through your school as Data Controller.

10. Children’s Data

The service is used by students, some of whom are minors. Processing of children’s data relies on the consent and/or authority of parents/guardians and the school. Parents/guardians may contact the school or us regarding a child’s data.

11. Cookies

We use cookies/local storage for sessions and preferences. See the Cookie Policy.

12. Changes

We may update this Privacy Policy. Material changes will be notified via the app or website.

13. Contact

WhatsApp +62 899-4237-764 · Email [email protected].

This document is part of the Aerish Academy service and may be updated from time to time. It does not constitute legal advice. For questions, contact us via WhatsApp +62 899-4237-764 or email [email protected]. Effective as of August 29, 2026.