Skip to content
TroviX Education

TroviX Privacy Policy

How TroviX handles personal data on the website and web application.

Effective date: 1 December 2026
Last updated: 1 December 2026

1. Who we are

The planned operator is TroviX Education (Pvt) Ltd, whose company registration is pending. This draft does not represent it as an incorporated entity. [[FINAL_OPERATOR_AND_CONTRACTING_ENTITY_PENDING_REGISTRATION]] The proposed published address is "Senavila", R.L.B Track 1, Saliya Ashokapura. [[CONFIRM_COMPLETE_POSTAL_ADDRESS_CITY_POSTAL_CODE_COUNTRY]] Contact: support@trovix-edu.com.

  • Privacy contact: support@trovix-edu.com
  • No Data Protection Officer has been formally appointed. [[COUNSEL_CONFIRM_DPO_REQUIREMENT_PDPA_APPLICABILITY_AND_SCALE]]

This policy explains what personal data we handle when you use our website (https://trovix-edu.com) and our web application (https://app.trovix-edu.com), together called the "Service".

2. What TroviX is

TroviX is a browser-based platform for tuition-institute operations, including students, teachers, classes, schedules, attendance, tuition records, payout records and in-app communication. It records institute tuition and payout information; it does not collect parent tuition money or transfer teacher payouts. Assessment and invoice/statement capabilities exist in the reviewed implementation, but their deployed availability is pending confirmation. [[VERIFY_DEPLOYED_ASSESSMENTS_AND_INVOICE_STATEMENT_AVAILABILITY]]

3. Our role and the institute's role

Two kinds of data flow through TroviX, and responsibility is different for each:

Institute-managed records. For student, guardian, attendance and educational records, the institute generally determines the purpose of processing, and TroviX processes those records to provide the Service. This proposed controller/processor allocation is subject to final legal review. [[COUNSEL_CONFIRM_CONTROLLER_PROCESSOR_ROLES]]

This means:

  • the institute is responsible for having a lawful basis to collect the data, telling students and parents how it is used, and getting consent from a parent or guardian where needed;
  • requests about this data (for example, a parent asking to see or correct a child's record) should normally go to the institute first. If you contact us, we will pass the request to the institute or help it respond.

TroviX operational records. TroviX acts as controller for its own account-management, subscription, security, support and platform-operational data, subject to final counsel confirmation of these classifications.

4. How accounts and organizations work

  • Each person has one TroviX login (a user account), which can belong to one or more organizations.
  • Inside each organization, a person has a role, such as organization owner, admin, teacher or parent. TroviX platform staff also have a platform administration role.
  • Organization context. Access is designed to depend on the selected organization and the user's role, using authorization and organization-context checks. These controls do not amount to a guarantee that unauthorized access can never occur.

5. Personal data we handle

5.1 Account data

Account information may include name, email address, phone number, profile details, organization access, role and preferences. Login uses email and password; invitations allow invited users to activate access and set a password. Passwords are stored in hashed form. Google login, phone OTP, magic-link and general OAuth user login are not currently offered.

5.2 Organization data

Institute name, contact details, addresses of teaching classrooms, subscription plan, trial status, enabled features, and details provided during public onboarding (for example, the person who signed the organization up).

5.3 Student, parent and teacher data (entered by the organization)

  • Students: name, date of birth, student reference, optional photo, status and student-card information; linked guardians, classes, subjects and enrollments; and internally maintained identifiers, QR references and timestamps.
  • Parents/guardians: name, contact details and the students they are linked to.
  • Teachers: name, contact details, subjects and classes taught, schedules, and payout records.

5.4 Attendance data

Attendance records identify the student, selected session/class, attendance status, recording time, recording user and any optional note. Related audit records may contain an IP address and browser User-Agent; an IP address does not establish an exact physical location. In the reviewed QR flow, the camera decodes the QR locally: images/frames are not uploaded or persisted, and GPS location is not collected.

5.5 Fees, payments and ledger data

Institute tuition records may include amounts, payment status, payment history and payout records. These records are separate from fees paid to TroviX for a platform subscription. Where subscription billing uses an enabled hosted payment provider, that provider handles card entry. The reviewed integration does not persist full card numbers or CVV; retained metadata may include provider references, card brand, last four digits, expiry and an encrypted reusable provider token where applicable. PayHere integration exists, but live production activation is unverified. [[VERIFY_PRODUCTION_SUBSCRIPTION_PROVIDER_AND_PAYMENT_DATA]]

5.6 Messages and notifications

The Service supports in-app messages and notifications. Organization invitation email is available when SMTP is configured. Selected payment success/failure, due-soon/overdue and schedule update/cancellation events support SMS when enabled; production SMS availability remains unconfirmed. Push notifications are not implemented. [[VERIFY_PRODUCTION_SMS_AND_INVITATION_EMAIL_CONFIGURATION]]

5.7 Technical, log and device data

Selected technical and audit records may include IP address, browser User-Agent, action timestamps, errors and security-related activity. Broader deployed logging, collection and monitoring must be confirmed. [[VERIFY_DEPLOYED_LOGGING_AND_OTHER_DATA_PROCESSING]]

5.8 Cookies and similar technologies

Cookies and browser storage support login/session state, selected organization, preferences and local theme settings. Blocking necessary storage may affect the Service. No third-party visitor analytics or advertising tracking integration was found in the reviewed source; this does not establish that deployed hosting adds no tracking. [[VERIFY_PRODUCTION_ANALYTICS_AND_INJECTED_TRACKING]]

5.9 Support and communications

Information you provide when emailing support, requesting a demo or asking for help. Individual account closure may be requested at support@trovix-edu.com and may be handled manually by authorized TroviX personnel.

6. Children and students who are minors

For this draft, the privacy-law child threshold is under 16, distinct from the minimum independent account-registration age of 18. [[COUNSEL_CONFIRM_CHILD_THRESHOLD_AND_PDPA_APPLICABILITY]]

  • Students' records are normally created and managed by the institute, and parents or guardians may view or manage information about their own children where the institute allows it.
  • The institute is responsible for getting any consent required from a parent or guardian before adding a minor's data, and for only adding data it actually needs.
  • Students do not currently have dedicated TroviX login accounts. Independent account registration is restricted to people aged 18 or over; institutes and linked parents/guardians handle student information.
  • The proposed restriction on using children's data for advertising or marketing profiles requires confirmation before publication. [[CONFIRM_OTHER_PROCESSING_MARKETING_AND_SHARING_PRACTICES]]
  • If you believe a child's data has been added without proper authority, contact the institute or us at support@trovix-edu.com.

7. Why we use personal data

We use personal data to:

  1. Provide the Service — create accounts, let organizations manage their operations, show the right data to the right roles, and send operational notifications.
  2. Run subscriptions and billing — manage trials, plans and entitlements, issue invoices, and record payments.
  3. Keep the Service secure — authenticate users, prevent fraud and misuse, investigate incidents, and keep audit logs.
  4. Support you — answer questions and fix problems.
  5. Improve the Service — understand how features are used, mostly with aggregated or de-identified data.
  6. Communicate with you — send service updates and, where you have agreed, product news. You can opt out of marketing at any time.
  7. Meet legal obligations — for example, tax, accounting and lawful requests from authorities.

The lawful basis must be determined for each processing purpose under applicable law. Contract, legal obligations, consent and other available grounds must not be treated as interchangeable or automatically applicable. [[COUNSEL_CONFIRM_PURPOSE_SPECIFIC_LAWFUL_BASES]]

No-sale, advertising and significant automated-decision statements require owner and counsel confirmation before publication. [[CONFIRM_OTHER_PROCESSING_MARKETING_AND_SHARING_PRACTICES]]

8. Who we share data with

We share personal data only as needed:

  • Within your organization, according to roles (for example, teachers see their classes; parents see their own children's information as the institute allows).
  • Service providers. TroviX may use providers for hosting, database infrastructure, communications and subscription billing. The actual production provider list and contractual restrictions remain to be verified. [[VERIFY_FINAL_PRODUCTION_PROVIDER_LIST_AND_CONTRACTS]]
  • Professional advisers such as lawyers, auditors and accountants, under confidentiality.
  • Authorities, where required by Sri Lankan law or a valid legal process.
  • A buyer or successor, if TroviX's business is reorganized, merged or sold, subject to this policy.

9. Data stored outside Sri Lanka

Hosting and service providers may process data outside Sri Lanka. Actual providers, processing locations and applicable transfer safeguards must be verified before publication; this draft does not certify a cross-border compliance mechanism. [[VERIFY_PRODUCTION_DATA_REGIONS]] [[COUNSEL_CONFIRM_CROSS_BORDER_TRANSFER_MECHANISM]]

10. How long we keep data

The periods below are approved policy targets. Production procedures to enforce deletion, anonymization and retention must be verified before publication. [[VERIFY_RETENTION_AND_DELETION_PROCEDURES]]

  • Individual account data: retained for 30 days after account closure, then deleted or anonymized unless a longer period is legally required.
  • Organization data: retained for 90 days after subscription access ends following cancellation or expiry, then deleted or anonymized except records that must be retained by law. Cancelling future renewal does not start this period while paid subscription access continues. Available data may be provided on reasonable request where operationally supported; no full self-service export is promised.
  • Billing and invoice records: retained for the legally required period. [[COUNSEL_CONFIRM_STATUTORY_BILLING_RETENTION_AND_TAX_STATUS]]
  • Security and audit logs: retained for 12 months. Backup retention, coverage and restoration remain unresolved. [[VERIFY_BACKUP_RETENTION_COVERAGE_AND_RESTORATION]]

11. How we protect data

The reviewed implementation includes password hashing, signed authentication, role-based authorization, organization-context checks, selected audit logging, HTTPS-oriented configuration and encryption of reusable payment-provider tokens where applicable. Actual deployed controls must be verified; no claim is made here of complete encryption at rest, comprehensive monitoring or guaranteed backups. [[VERIFY_DEPLOYED_SECURITY_CONTROLS]]

No system is completely secure. TroviX will notify the relevant authority and/or affected individuals where required, within the timeframe required by applicable law and binding regulatory rules. [[COUNSEL_CONFIRM_APPLICABLE_BREACH_NOTIFICATION_RULES]]

You are responsible for keeping your password safe and for logging out of shared devices.

12. Your rights

Subject to the PDPA and its conditions and exceptions, you may have the right to:

  • access the personal data held about you;
  • correct data that is inaccurate or incomplete;
  • delete data, or have it erased, where there is no good reason to keep it;
  • withdraw consent where processing is based on consent;
  • object to certain processing; and
  • ask for a review of decisions made solely by automated means, if any apply to you.

How to make a request:

  • For student, parent or teacher records managed by an institute, please contact the institute first. It controls those records and can usually correct them directly in TroviX.
  • For your own TroviX account, or if you cannot reach the institute, email support@trovix-edu.com. We may need to verify your identity, and in the case of a minor, confirm that you are the parent or guardian.
  • We aim to respond to data-subject requests within one month, with a lawful extension where applicable. This operational target does not replace any applicable statutory deadline.

If you are not satisfied with our response, you may contact the Data Protection Authority of Sri Lanka through its official channels. [[VERIFY_CURRENT_OFFICIAL_DPA_CONTACT_DETAILS]]

13. Marketing

Any marketing communications must follow applicable consent and opt-out requirements. Essential security, billing and service notices may be provided through available channels. Actual marketing practices, broader collection/purposes and unmarked no-sale, child-advertising and automated-decision statements require confirmation. [[CONFIRM_OTHER_PROCESSING_MARKETING_AND_SHARING_PRACTICES]]

14. Changes to this policy

We may update this policy. We will post the new version on this page with a new "Last updated" date, and tell organization owners about material changes by email or in the app before they take effect.

15. Contact

Planned operator: TroviX Education (Pvt) Ltd — registration pending.
[[FINAL_OPERATOR_AND_CONTRACTING_ENTITY_PENDING_REGISTRATION]]
"Senavila", R.L.B Track 1, Saliya Ashokapura.
[[CONFIRM_COMPLETE_POSTAL_ADDRESS_CITY_POSTAL_CODE_COUNTRY]]
Email: support@trovix-edu.com