Privacy

Three kinds of people have information in Aasanix:

• Library owners and their staff, who have accounts.
• Readers — the students whose details a library enters.
• Visitors to this website.

For readers’ details, the library decides what to record and why. Under India’s Digital Personal Data Protection Act, 2023 the library is the one responsible for that information (the “data fiduciary”), and Aasanix handles it on the library’s instructions (as its “data processor”). A reader’s first stop for any question about their details is therefore their own library.

For owners’ and staff accounts, and for visitors to this site, Aasanix is responsible.

About a library owner. Your name, your library’s name, and the email address or mobile number you signed up with. Your password is stored only in a scrambled form that cannot be turned back into the password; we cannot read it. If you arrived through a referral code or a link from a campaign, that is noted too.

About staff. The name, username and role the owner gave them. Their PIN is stored scrambled, in the same way as a password.

What a library records about its readers. Whatever of these the library chooses to enter:

• Name, mobile number, a second mobile number, email address and postal address.
• A guardian’s name and mobile number.
• What the reader is preparing for, and any note the library writes.
• The type of an identity document and the last four characters of its number — never the whole number.
• Whether the reader is under 18 and, if so, a record that a guardian consented.
• Their seat, shift and the dates they have paid for.
• Fees charged, receipts, payments, refunds and deposits.
• When they came in and went out, if the library keeps attendance.

About the library itself. Its hall layout, prices, expenses, the cash counted at the end of a shift, and a log of who did what and when.

Recorded automatically. When somebody signs in, the network (IP) address and the kind of browser are kept with that sign-in, and the network address is kept with entries in the activity log. A network address is also kept when a demo library is created, to limit how many one person can make. If the software fails, the page it failed on and the error are recorded so it can be fixed.

What is not held. No date of birth. No gender. No full identity-document number. No photographs or scans of documents. No card or bank-account details — a library pays its subscription by UPI or bank transfer, outside this website.

Only what the software needs in order to work:

• A cookie that keeps you signed in — for up to 30 days for an owner, and for one working shift for staff at a counter.
• A cookie that remembers which branch you are working in.
• On a door tablet, a cookie that identifies that tablet to its library.
• On your device, your choice of light or dark screen; and on a door tablet, check-ins that are waiting to be sent because the internet was down.

There are no advertising cookies, no analytics cookies and no trackers from other companies.

When somebody presses “Look around first” or signs up, a check is made that a person and not an automated program is doing it. That check is run for us by Vercel, our hosting provider, using technical details of the browser.

• To run the service a library has signed up for.
• To keep it secure — for example, slowing down repeated wrong passwords.
• To answer a library’s request for help.
• To charge the library its subscription.
• To meet a legal obligation.

It is not sold, not shared for marketing, and not used to build profiles of readers. We do not contact a library’s readers.

A library may send a reader their receipt on WhatsApp. When it does, the message is sent by the library, from its own WhatsApp account on its own device; the reader’s mobile number and the words of the receipt go to WhatsApp in order to open that chat. Aasanix sends no message itself.

The library’s own people, according to the role the owner has given each of them. A tablet at the door can show a reader’s name and whether fees are due; it cannot show a phone number.

Us, in a limited way. The console we use to run the service shows how many readers a library has and the totals on its receipts. It cannot show readers’ names or phone numbers; the database does not allow it. If a library asks for help and one of us needs to look inside it:

• a reason has to be written down first;
• the visit can only look, not change anything, unless the person helping takes a separate and deliberate step to allow it — and it ends after 60 minutes;
• phone numbers and email addresses are hidden;
• it appears in the library’s own activity log, where the owner can see it;
• and an owner can switch such visits off altogether, in Setup.

The companies that host the service for us. Vercel runs the application, on servers in Mumbai, and Supabase holds the database and any files a library stores. They handle the information only to provide that hosting.

Nobody else, unless a law or a court order requires it.

• Each library’s records are walled off from every other library’s in the database itself, not only in the screens.
• Passwords and PINs are stored scrambled, and connections to the site are encrypted.
• The activity log cannot be edited or deleted by anybody — not the library, and not us.

No system can promise it will never fail. If something happens that affects a library’s records, we will tell that library promptly, with what we know.

• A library’s records are kept for as long as the library has an account. The library can erase a reader’s personal details at any time; the receipts stay, without the name.
• When a library is closed, its records are kept for 60 days — so it can still download them, or change its mind — and are then deleted. Copies in our hosting provider’s backups disappear as those backups expire.
• A demo library made from the home page is deleted after about a day. Everything in a demo is invented.
• Sign-in sessions and one-time codes are removed once they have expired.

If you are a reader. Ask your library to show you what it holds about you, to correct it, or to erase it. The software gives every library a register for such requests, with a 30-day clock on each, and a way to erase a reader’s personal details and keep proof that it was done.

If you own or work at a library. You can correct your own details inside the product. An owner can download a complete copy of the library’s records at any time, and can ask us to close the library and delete it.

If you are not satisfied with an answer, you may also have the right to complain to the Data Protection Board of India.

Many readers are under 18. A library that enrols one records that a parent or guardian has consented, and who took that consent. Aasanix does not hold a date of birth — only whether the reader is under 18 — and does not collect anything from children directly.

When what the software holds changes, this page changes with it, and the date at the top changes too. Libraries are told about a change that matters through the News screen inside the product.

If you run a library on Aasanix, write to us from Help inside it; the answer arrives on the same screen. An email address for anybody who is not a customer will be published on this page.

If you are a reader and your question is about what a library holds on you, please ask that library first: it is the one that can look at your record.