How GIMS handles information

GIMS — the Grawity Institute Management System — is operated by Grawity (“Grawity”, “we”, “us”). This page explains what information GIMS holds, why, and how it is protected.

An institute decides what to record about its students and staff, and uses GIMS to keep those records. Grawity processes that information on the institute’s behalf, to provide the service.

Institute: its name, contact email and phone, logo, subscription, and settings such as what it calls a course.

Staff: name, username, email address, phone number (optional), role, and account settings. Passwords are stored only as a one-way hash.

Students: the details on the admission form — such as name, gender, date of birth, mobile and WhatsApp numbers, email, photo, parent or guardian names and numbers, address, school or college, and goals. For identity, GIMS stores only the last 4 digits of an Aadhaar number, never the full number.

Learning and fees: courses and batches, enrollments, fee plans, payments and receipts, attendance, test attempts and results, and admission requests.

Enquiries: the name, mobile number, source and follow-up notes for people who asked about joining.

Activity: a record of important actions — who admitted, edited, collected or deleted what, and when — so the institute can trace changes.

If you send a message through the contact form, we keep your name, email address, message, and the network address it came from (to filter spam), so we can reply.

The enquiry form on www.grawity.in also asks for a mobile number, and optionally your institute’s name, the product you’re interested in and roughly how many students you have. These go to the same inbox, are used only to get back to you, and are kept on the same terms.

GIMS keeps you signed in using your browser’s local storage, and remembers small preferences there such as light or dark mode. It does not use advertising cookies, and we don’t run analytics or tracking scripts on GIMS.

To provide GIMS: show each person the records they’re allowed to see, calculate fees and balances, and produce receipts, admission forms and reports.

To send the emails an institute’s work needs, in the institute’s name: admission confirmations, fee receipts and reminders, absence notices, login details, and account security codes. An institute can switch off fee reminders and absence emails.

To keep the service secure: signing people in, ending sessions after a password change, limiting repeated attempts, and investigating problems.

To support you when you contact us. We don’t sell personal information or use it for advertising.

MongoDB Atlas stores the database. Render runs the GIMS service, behind Cloudflare, and Vercel hosts the website. Cloudinary stores photos and institute logos. Google Workspace sends GIMS’s emails.

When an institute uses Grawity Classroom, the details needed to give its students and staff Classroom accounts — names, email addresses, courses and batches — are shared with Classroom, and Grawity ID links the same person across both, so one login works in each.

These providers handle data only to provide their part of the service.

All connections use HTTPS. Passwords are hashed and never stored in readable form. Sign-in and password-reset codes are stored hashed, expire after 10 minutes, and allow only a few tries.

Every record belongs to one institute, and every request is checked against the institute and role of the person making it — a teacher sees only their own students and batches.

Changing a password ends every other session for that account. Repeated sign-in and code attempts are rate-limited.

Many students at coaching institutes are under 18. The institute is responsible for collecting their information appropriately, including with a parent’s or guardian’s knowledge and consent where the law requires it.

Records are kept while the institute uses GIMS. Archiving a student hides them from active lists but keeps their history; corrected payments are reversed rather than deleted, so the history stays accurate.

An institute’s admin can export all its data at any time from Settings, as a JSON backup or an Excel copy.

An institute can ask Grawity to delete its account and all its data. Students and staff who want to see, correct or remove their information should contact their institute first, which manages those records; we will help the institute respond.

Contact-form messages are kept until we no longer need them to respond, then deleted.

We’ll update this page when GIMS changes what it stores or who helps run it, with a new “Last updated” date.

For any privacy question or request, write to info@grawity.in or call +91 99106 37030.