Privacy Policy

1. Who we are

HelloSchool.ai is a WhatsApp-native school communication platform developed and operated by Neohorizon Analytics Private Limited, 23, Kutty Venkatachalapathiiyer Lane, Mahal Vadampokki Street, Simmakkal, Madurai 625001, Tamil Nadu, India ("HelloSchool", "we", "us").

This policy describes how we collect, use, share, and protect personal information when you visit helloschool.ai (the "Site") or use our school management platform (the "Service").

For questions or requests, contact us at privacy@helloschool.ai.

2. Information we collect

2.1 Website visitors

When you browse helloschool.ai we may collect:

• Page views, click events, and session data via PostHog analytics (only if you consent — see section 7)
• IP address and browser/device information processed by Cloudflare for security and performance
• A one-time challenge token processed by Cloudflare Turnstile when you submit a contact form, to distinguish humans from bots

2.2 Contact form enquiries

When you submit an enquiry through the site we collect:

• Full name and email address (required)
• School name (required)
• Phone number (optional)
• Approximate number of students (optional, used for pricing estimates)
• Free-text message
• The page you submitted from, and your IP address (for spam prevention)

2.3 School administrators and teachers

When your school subscribes to HelloSchool, administrators and teachers create accounts. We collect name, work email, employee ID, and phone number. Authentication is managed via Supabase Auth using email/password or magic link.

2.4 Parents and guardians

Parent records are created by school administrators on behalf of enrolled students. We store name, phone number (used as the WhatsApp contact), email address, preferred language, and relationship to the student. Parents are sent a separate consent request before any messages are sent to them on WhatsApp.

2.5 Student records

Schools upload and manage student records including name, date of birth, gender, admission number, class and section, and profile photo. This information is processed strictly on behalf of the school under a data processing agreement. We do not use student data for any purpose other than providing the Service to that school.

3. How we use your information

• To respond to enquiries — contact form submissions are processed into sales leads so our team can follow up with you.
• To provide the Service — student, parent, and staff records enable schools to send attendance updates, fee reminders, announcements, and other communications via WhatsApp.
• To send WhatsApp messages — parent phone numbers are passed to the WhatsApp Business API to deliver school communications.
• To improve the Site — with your consent, PostHog analytics data helps us understand which pages are most useful and where the experience could be better.
• To prevent fraud and abuse — IP addresses and Turnstile tokens are used solely for spam and bot prevention and are not stored for marketing.
• To keep the Service running — logs and error reports (via Sentry) help us diagnose and fix technical problems.

4. Legal basis for processing

We rely on the following lawful grounds under the Digital Personal Data Protection Act 2023 (India):

• Consent — analytics cookies (you can withdraw consent at any time via the cookie banner or by contacting us).
• Legitimate interests — security, spam prevention, site performance, and responding to business enquiries.
• Contract — processing school, parent, and student data to deliver the Service under our agreement with the school.
• Legal obligation — where applicable law requires us to retain or disclose information.

5. Third-party services

We share data with the following sub-processors to operate the Service:

We do not sell personal information to third parties. We do not use personal data for advertising or profiling beyond analytics you have consented to.

6. WhatsApp communications

HelloSchool uses the WhatsApp Business API to send school communications (attendance, fee reminders, announcements, report cards) to parents. Before any message is sent to a parent's phone number, the school obtains explicit opt-in consent — either via a digitally signed email confirmation or a handwritten consent form uploaded to our system. Parents can opt out at any time by replying STOP to any message or by contacting their school administrator.

All messages sent through WhatsApp are subject to Meta's own privacy policy and terms of service. HelloSchool does not control Meta's data handling practices.

7. Analytics cookies

We use PostHog to collect anonymous analytics data (page views, clicks, session replays) to understand how the site is used. We do not load PostHog or collect any analytics data until you click Accept on the cookie banner.

If you accept, PostHog stores a unique visitor ID in your browser's local storage to recognise you across sessions. No advertising or third-party tracking cookies are used.

You can withdraw consent at any time by clicking Decline in the cookie banner, clearing your browser's local storage for this site, or emailing us at privacy@helloschool.ai. Analytics data already collected will be deleted on request.

8. Children's privacy

The Site (helloschool.ai) is directed at school administrators and is not intended for children under 18. We do not knowingly collect personal data directly from children through the Site.

Within the platform, student records (including date of birth and profile photo) are created and managed by the school as the data controller. HelloSchool acts as a data processor on the school's behalf. Schools are responsible for obtaining any parental or guardian consent required by applicable law before uploading student records.

We comply with India's Digital Personal Data Protection Act 2023, which requires verifiable parental consent before processing the personal data of children under 18. Schools using our platform are contractually required to comply with these obligations.

9. Data retention

• Contact form leads — retained in our CRM for up to 2 years from the date of submission, then deleted unless a business relationship has commenced.
• School, parent, and student records — retained for 30 days after your subscription ends, to allow reactivation or a final export, then permanently and irreversibly deleted. You may request immediate deletion at any time (see Terms of Service, section 9.4). Retained longer only where law requires it.
• WhatsApp message logs — retained for up to 2 years from message date for school audit and dispute-resolution while your subscription is active. On offboarding they are deleted with the rest of your school's data, subject to any minimum retention required by law.
• Parent consent records — retained for a minimum of 3 years from the date of consent as required for legal compliance.
• Analytics data — subject to PostHog's own data retention settings (currently 12 months). You may request deletion at any time.
• Error logs — retained for 90 days.

10. Data security

We take reasonable technical and organisational measures to protect personal data, including:

• All data in transit is encrypted via TLS (HTTPS enforced by Cloudflare)
• Database access is controlled by Row-Level Security (RLS) policies that enforce strict school-level data isolation — one school cannot access another's data
• Authentication uses short-lived JWT tokens (ES256); passwords are never stored in plaintext
• Consent documents are stored in a private AWS S3 bucket accessible only via time-limited signed URLs
• Production secrets (API keys, database credentials) are stored as environment secrets, never in source code

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach we will notify affected parties as required by applicable law.

11. Your rights

Under the Digital Personal Data Protection Act 2023 (India), you have the right to:

• Access — request a copy of personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data, subject to our legal retention obligations
• Withdraw consent — for analytics cookies, at any time via the cookie banner
• Grievance redressal — raise a complaint with our Grievance Officer (see section 13)

If you are a parent whose data is managed by a school using HelloSchool, please contact your school administrator first, as they are the data controller for that information. We will assist schools in fulfilling data subject requests.

To exercise any of the above rights, email privacy@helloschool.ai. We will respond within 30 days.

12. International data transfers

Some of our sub-processors (PostHog, WhatsApp/Meta, Google, Cloudflare, Sentry) are based in or route data through the United States. By using the Site or Service, school administrators acknowledge that data may be transferred to countries outside India. Where required, we rely on standard contractual clauses or equivalent safeguards for such transfers.

Core operational data (student records, parent records, message logs) is stored on AWS infrastructure in the ap-south-1 (Mumbai) region, keeping it within India.

AI features specifically: our AI tutoring and message-understanding features run primarily on hardware we operate in India. If those servers are unavailable, requests fall back to Google's Gemini API in the United States. When that happens, what is sent to Google is the parent's message together with recent conversation history from that WhatsApp thread — which in practice often contains a child's first name, because parents write messages like "what is May fee for Arjun". We do not send your student database, parent contact details, or records from any other part of the platform.

13. Contact and grievances

For privacy enquiries, data requests, or to raise a grievance, contact our Grievance Officer, appointed under the Digital Personal Data Protection Act 2023 and the Information Technology (Intermediary Guidelines) Rules 2021:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is operational, or with the relevant supervisory authority in your jurisdiction.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes that affect your rights, we will notify active school accounts by email. Continued use of the Site or Service after changes are posted constitutes acceptance of the revised policy.