Privacy Policy

1. About this policy

IDMaker is operated by Thumbeja Publicity and helps printing houses and their client schools, colleges, and organisations collect, review, and export identity-card records. This policy explains how information is handled when you use the service. Your organisation or printing house also decides which records to collect and who may work with them.

2. Information we handle

• Accounts and contacts: Names, email addresses, contact numbers, organisation details, sign-in information, invitations, roles, and assigned permissions.
• Roster records: Names, identification and roll numbers, groups, dates of birth, addresses, parent contact details, blood groups, and other fields your organisation enables. These records can concern children as well as adult members and staff.
• Photos and activity: Uploaded or camera-captured portraits, cropped images and retained source JPEGs used for recropping, review decisions, and activity records.
• Billing: Selected packs, payment and order identifiers, purchase status, and account entitlements. When enabled, Razorpay processes payment methods; IDMaker does not store your card credentials.

3. How information is used and shared

We use information to provide sign-in, account administration, roster collection, photo preparation, approvals, printing exports, billing, support, and service security. Authorised staff can access records according to their role and assigned scope. The printing house can receive roster and photo exports needed to produce identity cards; people who receive downloaded files control those copies separately from IDMaker.

IDMaker uses Google Firebase services for authentication, database records, and photo storage, together with Google hosting infrastructure. Razorpay is involved when online payments are enabled. These providers process information needed to deliver their services. This policy does not promise that every service, backup, or support operation stays in one country or region.

4. Camera and information on your device

Camera access requires your browser permission and is used when you choose to capture a portrait. You can instead upload an existing image. Photo preparation takes place in the browser before upload. An offline upload queue can keep pending photos and related record details in the browser’s IndexedDB storage so uploads can be retried.

Cookies and browser storage support sign-in sessions, authentication state, and preferences such as the colour theme. On shared devices, sign out and check for pending photo uploads before clearing site data. Clearing browser storage can remove photos that have not yet uploaded; signing out alone does not necessarily erase locally queued data.

5. Access and responsible collection

Server checks, Firebase security rules, and role-based permissions restrict access to accounts, organisations, records, and photos. These safeguards reduce risk, but no online service can guarantee absolute security. Protect your account and share invitations and exported files only with intended recipients.

Schools and other organisations are responsible for deciding what information is necessary, providing appropriate notices, and obtaining legitimate permissions, including parent or guardian consent where required for children’s information. Use only the fields needed for your identity-card project.

6. Access, correction, export, and deletion

Contact your organisation administrator or printing house first to request access to, correction of, export of, or deletion of a roster record or photo. Available actions depend on your permissions and the project’s production stage. Authorised printing staff can export project records and photos through the service.

For account or service-level requests, contact support below. We may need to verify your identity and coordinate with the organisation responsible for the records. Retention depends on the project, account, and request; account closure does not trigger a guaranteed automatic purge within a fixed period. Some billing, security, activity, or backup records may need to be retained for legitimate operational or legal reasons. Deleting information from IDMaker does not delete copies already exported to other recipients.

7. Contact and policy updates

Send privacy questions and requests to softwarethumbeja@gmail.com. Include your organisation name and the kind of request, but avoid sending passwords or unnecessary identity documents. We may update this policy as the service changes; the date above identifies the current version.