What we collect & why
1 Scope
This policy covers the IDCraft website and the workspace application, operated by IT On Company. By creating an account or uploading records you agree to it.
2 Information we collect
- Account — username, email, phone number, a hashed password, and an optional profile photo.
- Organization — school / college / company name, address, logo, and contact person.
- Records you upload — student and staff names, roll or employee numbers, class / section / designation, date of birth, gender, photos, guardian or contact details, and any custom fields your ID-card or marksheet template uses.
- Payment — the eSewa transaction reference and the payment screenshot you submit. We never see or store card or bank-account details.
- Technical — IP address, browser type, pages visited, and the session cookie that keeps you signed in.
3 How we use it
To generate and print ID cards and marksheets, run your workspace, provide support, verify and record your subscription payment, and keep the service secure. We do not use your records for advertising or profiling.
4 Your authority & consent
You upload records on behalf of your institution and confirm you are authorized to do so and have obtained any consent required — including from parents or guardians where the record belongs to a minor.
5 Sharing
- We do not sell your data.
- Limited sharing with our hosting and infrastructure provider, and with eSewa to confirm a payment.
- Disclosure to authorities only where required by law.
- No third-party advertising or analytics networks.
6 Storage & security
Data is held on secured servers. Passwords are hashed, transport is over HTTPS, and access is limited to authorized staff. No system is completely secure, so we cannot guarantee absolute protection.
7 Retention
Records are kept while your subscription is active. On a written request we remove an organization's records within 30 days, except where the law requires us to keep something longer (for example, payment records).
8 Your rights
You can request a copy, a correction, or deletion of your data, and you can export your records at any time from the Data Center. Contact us to close your account.
9 Children's data
Student records, including those of individuals under 18, are processed only on behalf of the institution, which is responsible for guardian consent. Individuals under 18 may not create their own accounts.
10 Cookies
Only essential session and CSRF cookies are used. There are no tracking or advertising cookies. Your theme preference is stored locally in your browser and never sent to us.
11 Changes
We may update this policy. Material changes will be announced in the app or by email, and continued use after an update means you accept the revised policy.
12 Contact
Questions or data requests: [email protected] · 9862788996 · Jeetpusimara Sub-Metropolitancity-5, Bakuliya Bhawanipur, Bara, Nepal