Privacy policy

Last updated: 3 October 2026

1. Who we are

Patashala360 ("we", "us", "our"), of Siddipet, Telangana, India, provides school management software: a web application for the school office, and a mobile app for parents, students and teachers that is launching soon. This policy explains what personal data we handle, why, and the choices you have. It follows the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.

2. Our role and the school's role

• Student, parent and staff records: the school decides what is recorded and why. The school is the Data Fiduciary for this data, and Patashala360 processes it only on the school's behalf and on its instructions.
• School contact and billing details, and enquiries sent to us: Patashala360 is the Data Fiduciary for this data.

3. What we collect

• Students: name, date of birth, gender, admission number, class and section, and, if the school records them, blood group, religion, address and emergency contact. School records such as attendance, homework, exam marks and results, fee records and receipts, and bus stop.
• Parents: name, relationship to the student, mobile number and, if given, email address.
• Staff: name, employee code, contact details, date of birth, address, role, and the classes and subjects they handle.
• Bus trips: when a driver runs a bus trip in our mobile app, the location of the driver's phone, with its speed and direction, while the trip runs, including when the screen is off. Sharing stops when the driver ends the trip, or by itself 30 minutes after the last location or 4 hours after the trip started.
• Sign-in and security data: login ID, password (stored only as a one-way hash, never readable by anyone), signed-in sessions, failed sign-in counts, IP address, and a log of sensitive actions such as fee reversals and data exports.
• Schools: school name, address, state, GSTIN, licence details, invoices and payments.

We do not collect:

• The location of anyone other than a bus driver during a trip, and contacts, photos, camera or microphone access.
• Advertising IDs. There are no analytics, advertising or tracking tools in the web application or on this website.
• Card or bank account details. Fee payments are recorded by the school office, and schools pay their licence by UPI, bank transfer or cheque outside the app.

4. How we use it

• To run the service for the school: records, attendance, fees, exams and notices.
• To show parents and students where their school bus is during a trip. A parent sees only the buses their children ride this academic year, and a student only their own bus.
• To reply to enquiries sent through the form on this website. See section 10.
• To let people sign in safely, and to block repeated failed sign-ins.
• To send service emails to school staff, such as a set-password link or an account notice.
• To help the school when it asks for support. Every support session inside a school is logged.
• To invoice the school for its licence.

We never sell personal data, never show advertising, and never use children's data to build profiles, track behaviour or target anyone.

5. Cookies

The application uses only the cookies it needs to keep you signed in and to protect your session from forged requests. We do not use tracking or advertising cookies.

6. Who we share it with

• Your school: authorised staff see what their role permits, and parents see only their own children.
• Google Cloud: runs the application in Mumbai, India, keeps backups in Delhi, India, and serves this website through Firebase.
• MongoDB Atlas: hosts the database in Mumbai, India.
• Cloudflare: carries all traffic to the application, protects it from attacks, and checks the website form for spam.
• Mailjet: delivers service emails to school staff.
• Zoho Mail: hosts our own email inbox.
• Authorities: only when the law requires it.

These providers act on our instructions and may not use the data for their own purposes. School records are stored in India. Some data passes outside India while it is carried or delivered: traffic passes through Cloudflare's worldwide network, and service emails are sent through Mailjet's servers in the European Union. The Digital Personal Data Protection Act allows this unless the government restricts a country.

7. How we protect it

• All traffic is encrypted in transit, and our providers store data on encrypted disks.
• Each school's data is kept separate, and an automated test on every code change checks for queries that could reach another school's data.
• Every action is checked against the user's permissions on the server.
• Accounts lock after repeated failed sign-ins, and sensitive actions are logged.

8. How long we keep it

• We keep a school's data while the school uses Patashala360.
• When a school leaves, it can first download all of its data to Excel. We then delete the school's data within 90 days of the end of the agreement, or sooner if the school asks in writing. Backup copies are deleted within 30 days after that.
• Security logs, such as sign-ins and sensitive actions, are kept for one year and then deleted automatically.
• Bus trip locations are deleted automatically 30 days after the trip ends.
• Website enquiries are deleted 12 months after our last contact with you. See section 10.
• Invoices and payment records for the school's licence are kept for as long as Indian tax law requires.
• When a student leaves or a staff member is removed, their login is switched off. Their school records stay with the school as part of its records.

9. Children's data

Most students are under 18. We process their data only for the school's purposes and on the school's instructions. The school is responsible for obtaining a parent's consent as the Digital Personal Data Protection Act requires. We do not track children, do not monitor their behaviour, and do not show advertising to anyone. A student can sign in only with an account issued by their school.

10. Website enquiries

This section covers the enquiry form on patashala360.com. Patashala360 is the Data Fiduciary for this data. You must be 18 or older to send the form.

• What we collect: your name, mobile number, school name, city or town, and what you want (a demo, a price, the free plan or something else). If you give them, also your email, your role at the school, your number of students, your preferred language, your message, and whether we may message you on WhatsApp. We also record when you agreed and which version of the notice you saw.
• What we do not store: your IP address or browser details with your enquiry. To stop abuse, we keep a scrambled form of your mobile number and network address for up to one day, and then delete it.
• Spam check: when you send the form, Cloudflare checks your browser to stop automated spam. Cloudflare processes your IP address and browser details for this check, and also uses them to improve its protection against bots.
• Why we use it: to reply to your enquiry and follow it up by phone call or email, and on WhatsApp only if you ticked that box. We do not add you to a mailing list, sell your details, or share them for anyone else's marketing.
• Legal basis: your consent, given by ticking the box on the form.
• Who sees it: only Patashala360 team members who have been given permission to view enquiries. Our team gets an email alert that shows only the school name, city and type of enquiry.
• How long we keep it: 12 months after our last contact with you. If your school becomes a customer, the contact details you gave become part of the school's account.
• Your choices: withdraw your consent, or ask us to correct or delete your details, at any time. Write to hello@patashala360.com or tell us when we call. We stop contacting you straight away, delete your details from our system, and backup copies are deleted within 30 days.

11. Your rights

• Ask for a summary of the personal data held about you.
• Ask for it to be corrected or completed.
• Ask for it to be deleted, where the law does not require it to be kept. See how to delete your account.
• Withdraw consent you have given.
• Nominate someone to act for you.
• Complain to us, and then to the Data Protection Board of India.

For student, parent and staff records, please contact your school first, because the school controls that data. You can also write to us and we will work with the school. We reply within 30 days.

12. If something goes wrong

If a personal data breach happens, we tell the affected school without delay, report it to CERT-In within 6 hours, and inform the Data Protection Board of India and affected people as the law requires.

13. Changes to this policy

We may update this policy. The new version is posted on this page with the date it changed. For a significant change we also tell the schools we serve.

14. Contact and grievance officer

• Grievance Officer: Kiran Reddy
• Email: hello@patashala360.com
• Address: Patashala360, Behind Indur Engineering College, Siddipet, Telangana, India
• We reply to every grievance within 30 days.