Schools trust Ubuddy with some of the most sensitive data there is — information about children. We take that seriously. In one breath:

• Your school’s data belongs to your school. We process it only to run the platform, on the school’s instructions.
• We never sell personal data and we never use it for advertising. There are no ads anywhere in Ubuddy.
• Security is not an add-on — encryption, role-based access, audit logs and continuous backups run through the whole platform.

The rest of this policy is the detail behind those promises.

Ubuddy (“we”, “us”) provides a school management platform to schools in India. This policy covers our marketing website (ubuddy.in), school portals (like yourschool.ubuddy.in and admin.ubuddy.in) and our mobile apps.

For the data inside a school’s portal, the school decides what is collected and why — in the language of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the school is the data fiduciary and Ubuddy acts as its data processor. We handle that data only on the school’s documented instructions and under our agreement with the school.

For the little data our marketing website handles, and for the contact details of people who write to us, we are the data fiduciary ourselves.

On the platform (provided by your school):

• student records — names, admission details, class and section, date of birth, photos, documents and certificates;
• parent and guardian names and contact details;
• staff records, roles and permissions;
• operational data the school generates — fees and receipts, attendance, marks and report cards, timetables, transport routes and vehicle locations, messages sent to parents;
• account and security data — login identifiers, session information and audit logs of actions taken in the portal.

On the marketing website: ubuddy.in is a static site. It does not ask you to create an account, and if you request a demo or email us, we receive only what you choose to send — typically your name, school, email and phone number.

We use the data we handle to:

• provide the Service — from generating fee receipts to marking attendance to showing a parent where the school bus is;
• keep accounts secure — detecting suspicious logins, locking out attackers and maintaining audit trails;
• support schools when they ask us for help;
• maintain, troubleshoot and improve the platform’s reliability and performance;
• send service communications, such as maintenance notices;
• meet our legal obligations.

We do not sell personal data, rent it out, or use it to show advertising — to students, parents or anyone else.

Most of the people whose data lives in Ubuddy are children, and that shapes how we build everything. Students’ information enters the platform through their school, which is responsible for collecting it lawfully — including obtaining verifiable parental consent where the DPDP Act requires it.

On our side: we process students’ data only to provide the Service to their school, we never use it for advertising, profiling or marketing of any kind, and access within a school is limited by role — a class teacher sees their class, a driver sees their vehicle, and every access is logged.

Ubuddy AI answers a school’s questions using that school’s own data — when the front office asks “fees pending for Class 8?”, the assistant reads from the same fee module, under the same permissions, as the person asking. It cannot see other schools’ data.

Conversations with Ubuddy AI are processed to generate the answer and to keep the feature reliable and safe. We do not sell them, and we do not use your school’s identifiable data to build products for anyone else.

Security runs through the whole platform:

• data is encrypted in transit and at rest;
• Ubuddy is built on libraries and infrastructure maintained by an ISO 27001-certified company;
• there are no public sign-ups — every account is provisioned by a school administrator with a specific role;
• granular, role-based permissions limit every user to their job;
• suspicious login activity triggers automatic lockouts, and every action is recorded in an audit log;
• data is backed up continuously;
• our own staff access customer data only when needed to provide support or operate the Service, and that access is controlled and logged.

If we ever discover a personal data breach affecting your school, we will notify the school without undue delay and support the notifications the DPDP Act requires.

We share personal data only with:

• service providers who help us run Ubuddy — such as cloud hosting, payment processing for fee collection, and SMS, WhatsApp or email delivery for school communications. They are bound by contracts to protect the data and use it only to provide their service to us;
• the school itself — data flows to the school administrators, teachers, parents and students the school has authorised, according to their roles;
• authorities, where the law requires it — if we receive a legally binding demand, and where permitted we will inform the affected school.

If Ubuddy is ever part of a merger or acquisition, data would remain protected under this policy, and schools would be notified. A current list of our sub-processors is available on request at hello@ubuddy.in.

We keep your school’s data for as long as the school subscribes to Ubuddy — schools can also export any list to Excel or PDF at any time, so you are never locked in.

When a subscription ends, we give the school a reasonable window to export its data, after which it is deleted from our active systems and cycles out of backups on our standard schedule. We retain only what the law requires us to keep (for example, our own invoicing records).

If you are a parent, student or staff member, your data in Ubuddy is managed by your school — so requests to access, correct or erase it are fastest through the school office, which has the tools to act on them directly. Under the DPDP Act you may also have rights to grievance redressal and to nominate someone to exercise your rights.

If you contact us directly at hello@ubuddy.in, we will help — working with your school where the school is the data fiduciary. For data we hold as fiduciary (like demo enquiries), write to the same address to access, correct or delete it, or to withdraw consent.

Our marketing website is a static site and does not set advertising or cross-site tracking cookies.

The school portals use cookies that are essential to the Service — keeping you signed in securely and remembering preferences like your language (English or हिन्दी). Blocking these in your browser will stop the portal from working properly.

As Ubuddy grows, this policy will occasionally need updating. When it does, we’ll change the “Last updated” date above, and for significant changes we’ll notify schools through the platform or by email before they take effect. Earlier versions are available from us on request.

For anything about privacy or data protection — questions, requests or concerns — email hello@ubuddy.in with “Privacy” in the subject line and we’ll respond promptly. Our use of the platform is also governed by our Terms of Service.