Privacy policy

1. Who is responsible for the data

Each school that uses One School decides what data to keep about its students, parents and staff and why. For that data the school is the Data Fiduciary, and we act as its Data Processor: we store and process it only to provide One School to that school, on its instructions.

For the data of people who sign up for a trial or ask for a demo on our website, we are the Data Fiduciary.

2. What we collect

• School account details: school name, address, board, logo and contact details.
• People's details entered by the school: names, phone numbers, email addresses, roles, and for students, class, admission details, date of birth, guardians, attendance, fees, marks, documents and transport stop.
• Activity in the app: sign-ins, changes made (kept in an activity log for the school), messages sent within the app.
• Location of a school bus, only while a driver has started a trip in the driver app.
• Device details needed to send notifications to a phone, if the user turns notifications on.
• Website enquiries: name, phone number, school and message, when you ask for a demo.

We do not collect full Aadhaar numbers; only the last four digits can be stored, if the school chooses. Card and bank details for fee payments are handled by the school's payment provider, not by us.

3. How we use it

• To provide One School's features to the school and its users.
• To send sign-in codes and the school's notifications by app, SMS or WhatsApp.
• To keep the service secure, prevent misuse and fix problems.
• To answer support requests and demo requests.
• To meet legal obligations, such as tax and accounting records.

We do not sell personal data, and we do not use students' data for advertising.

4. Children's data

Student records are entered and controlled by the school, which is responsible for obtaining any consent required from parents or guardians. We process children's data only to provide the service to the school, and we do not track children or use their data for behavioural monitoring or targeted advertising.

5. Who we share it with

Only with service providers that help us run One School, under contracts that require them to protect the data:

• Cloud hosting and database providers, with data stored in India where available.
• SMS and WhatsApp delivery providers, for messages the school sends.
• Map tiles from OpenStreetMap, to show bus routes (no personal data is sent).

We may disclose data if required by law or by a lawful order of a government authority.

6. How long we keep it

We keep a school's data for as long as the school uses One School. If a school closes its account, it can export its data, and we delete it within 90 days unless the law requires us to keep some records for longer. Website enquiries are kept for up to two years.

7. Security

Data is encrypted in transit. Each school's data is kept separate and is visible only to people the school gives access to. Sign-in uses one-time codes sent to the user's phone, sessions expire, sensitive keys are stored encrypted, and changes are recorded in an activity log. No system is perfectly secure; if a breach affects personal data, we will inform the school and the Data Protection Board of India as the law requires.

8. Your rights

You can ask to see, correct or erase your personal data, and to withdraw consent where processing is based on consent. Parents and staff should first contact their school, which controls their records; we will help the school respond. You can also nominate another person to exercise your rights in case of death or incapacity.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

9. Changes to this policy

We may update this policy as the product changes. We will show the new date at the top and tell schools about significant changes in the app.