Privacy Policy

This Privacy Policy applies to the GrantPanda platform and all products operated by H K Enterprises (Udyam Registration No. UDYAM-KR-11-0029354), a technology company registered in Karnataka, India.

The GrantPanda ecosystem includes:

• GrantPanda Scholarship Platform — AI-powered scholarship and funding discovery for students (grantpanda.online)
• ICSB Leave Management — an institution-grade leave, event, and approval management platform for colleges and schools
• WhatsApp Business Solutions — technology solutions built using the WhatsApp Business Platform for institutions and businesses

This policy explains what data we collect, why we collect it, how it is used, who it is shared with, and what rights you have. By using any GrantPanda product or service, you agree to the practices described in this policy.

Where relevant, this policy distinguishes between different categories of users and data: GrantPanda platform users, institutional customers, and end users of institutional deployments (students, parents, and staff).

2.1 GrantPanda Scholarship Platform

• Email address (waitlist registration or account creation)
• Name and academic profile information (academic background, interests, goals)
• Communications sent to us (support requests, feedback)

2.2 ICSB Leave Management — Student Data

• Student name, roll number, department, and year
• Contact information (email and/or phone number)
• Leave applications and reason descriptions submitted by the student
• Application status history (submitted, approved, rejected)
• Uploaded supporting documents where applicable

2.3 ICSB Leave Management — Parent Data

• Parent or guardian phone number (for WhatsApp notifications)
• Consent responses provided via WhatsApp

2.4 ICSB Leave Management — Staff, HOD & Admin Data

• Name, designation, department, and institutional email
• Login credentials (password stored as a hashed value, never in plain text)
• Approval and rejection actions with timestamps

2.5 Institution / Customer Data

• Institution name and contact information
• Administrator account details
• Configuration and deployment settings

2.6 WhatsApp / Messaging Data

• Recipient phone numbers used to send messages
• WhatsApp message identifiers returned by Meta
• Message delivery, read, and failure statuses received via webhook
• Message template and configuration information used for notifications

WhatsApp message content is processed through the WhatsApp Business Platform operated by Meta Platforms, Inc. GrantPanda does not retain the full body of WhatsApp messages beyond the period necessary for delivery, operational support, security, or audit purposes.

2.7 Automatically Collected Data

• Browser type, operating system, and approximate IP address
• Pages visited, time spent on pages, and referral URLs
• Session and authentication tokens (via cookies)

We use collected data to:

• Provide, operate, and maintain GrantPanda products and services
• Match students with relevant scholarship and funding opportunities (Scholarship Platform)
• Process and manage student leave applications, approvals, and related workflows (ICSB)
• Send WhatsApp notifications to parents and stakeholders for institutional workflows
• Authenticate users and manage account security
• Respond to inquiries and provide customer and institutional support
• Monitor platform stability, performance, and usage patterns
• Send product updates and service-related communications
• Comply with legal and regulatory obligations

We do not use personal data for advertising, profiling for commercial purposes, or sale to third parties.

We do not sell personal data to third parties. We may share data with:

Infrastructure and hosting providers

• Vercel — website hosting and edge delivery. Subject to Vercel's privacy policy.

Communication and email platforms

• Loops — waitlist and email communications for the Scholarship Platform. Subject to Loops' privacy policy.

Messaging platforms

• Meta Platforms, Inc. (WhatsApp) — when WhatsApp Business Platform services are used, recipient phone numbers and message content are transmitted through Meta's infrastructure. This processing is governed by Meta's Data Policy and the WhatsApp Business Platform terms. GrantPanda is not affiliated with or an agent of Meta.

Institutional administrators

In ICSB deployments, institution administrators, HODs, and authorised staff can view student and application data within the scope of their institutional role. This sharing is necessary to operate the leave management workflow and forms part of the service agreement with the institution.

Legal obligations

We may disclose data to courts, regulators, or governmental authorities when required by law, court order, or legitimate legal process.

Where GrantPanda products use the WhatsApp Business Platform, data is processed through Meta's infrastructure. GrantPanda acts as the technology provider that initiates messages; Meta's platform transmits and delivers them.

The following applies to all WhatsApp-based communications:

• Messages are sent only to recipients who have a legitimate and documented basis for receiving them (e.g., parents of students enrolled at an ICSB institution)
• Message content follows approved template formats in compliance with WhatsApp Business Platform policies
• Delivery, read, and failure statuses are received from Meta via webhooks and stored for audit and support purposes
• Recipients may contact GrantPanda or their deploying institution regarding WhatsApp communication preferences. Where a communication is required to operate an institutional workflow, the deploying institution determines the applicable notification requirements.

GrantPanda is not affiliated with, employed by, or acting as an agent of Meta Platforms, Inc. WhatsApp is a trademark of Meta Platforms, Inc.

We retain data for as long as necessary to provide services and meet legal obligations:

• Scholarship Platform — waitlist emails retained until the user requests deletion or unsubscribes
• ICSB student and application data — retained for the duration of the institution's deployment and for a reasonable period thereafter for audit and institutional record-keeping purposes, unless the institution instructs earlier deletion
• Parent phone numbers — retained for the duration of the student's active enrolment at the institution
• Staff and admin accounts — retained while the account is active; deleted or anonymised upon account closure
• WhatsApp message logs — message identifiers, delivery metadata, and webhook status information may be retained for operational support, security, and audit purposes. Full message content is not retained beyond the period necessary for these purposes.

Data required by applicable law or legitimate institutional obligations may be retained beyond user-requested deletion for the minimum period required.

Depending on your jurisdiction and applicable law, you may have the right to:

• Access and receive a copy of your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to or request restriction of certain processing activities
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with a relevant data protection authority in your jurisdiction

To exercise any of these rights, contact us at adnankhadnan@gmail.com. For data deletion requests, see our Data Deletion page.

Students in ICSB deployments — where data is held as part of an institution's use of ICSB, requests may need to be coordinated with your institution as the data controller for institutional records.

We use cookies and similar technologies for session management, authentication, analytics, and preferences. For full details, see our Cookie Policy.

We implement technical and organisational measures to protect personal data, including HTTPS encryption, hashed password storage, role-based access controls, and tenant data isolation in multi-institution deployments. For details, see our Security page.

No method of internet transmission is 100% secure. We cannot guarantee absolute security but are committed to implementing commercially reasonable protections.

The GrantPanda Scholarship Platform is not directed at individuals under the age of 13. We do not knowingly collect data from children under 13 through the Scholarship Platform.

ICSB Leave Management may process data relating to students who are minors, as part of institutional deployments. This data is processed under the authority of the deploying institution, which is responsible for ensuring appropriate consents and authorisations are in place under applicable law.

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date on this page or by direct notification to affected users or institutions. Continued use of any GrantPanda product after changes constitutes acceptance of the revised policy.

For questions, data requests, or concerns about this Privacy Policy, contact: