These terms apply when ORNITHOAI Soft Tech Private Limited processes personal data on behalf of a school using HeySchool AI. They form part of the Terms of Service. The school is the Data Fiduciary; we are its Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023.
1. What we process, and why
The personal data of the school's students, parents, guardians and staff that the school records in HeySchool AI, processed only to provide the service the school has chosen. Our Privacy Policy lists the categories.
2. On the school's instructions only
We process the school's data only to provide HeySchool AI and on the school's documented instructions — including those it gives by using the service's settings — unless the law requires otherwise, in which case we will tell the school first where the law allows.
3. Confidentiality
Only our staff who need access to support or operate the service can reach a school's data, and they are bound by confidentiality.
4. Security measures
- Separation of each school's data by row-level security in the database;
- role-based access with an audit log of access changes;
- encryption in transit and at rest, and one-way hashing of passwords;
- private storage for documents and photographs, opened only through short-lived signed links;
- limits on sign-in attempts and SMS OTP verification;
- hosting on Microsoft Azure in India, with backups.
5. Sub-processors
The school authorises us to use the sub-processors below. We hold each to data-protection obligations no weaker than these, and will give the school notice before adding or replacing one.
| Provider | What they do for us | Where |
|---|---|---|
| Microsoft Azure | Hosting of the application, database and file storage | India (Central India region) |
| Anthropic | AI features — answering questions, drafting question papers, reading uploaded documents | Outside India |
| SMSHorizon | Sending one-time passwords (OTP) by SMS | India |
| Map / address-search provider | Suggesting addresses while a school registers | Varies by provider |
6. Personal data breaches
We will notify the school without undue delay after becoming aware of a breach affecting its data — and in time for it to meet its own legal deadlines — with what we know, the likely consequences and what we are doing about it. We will help the school notify the Data Protection Board and affected people as required.
7. Helping the school
We will help the school respond to requests from students, parents and staff exercising their rights — access, correction, erasure and grievance — and with any assessment or enquiry by a regulator.
8. At the end
When the subscription ends, the school can export its data. We then delete it within 90 days, including from backups on their normal cycle, unless the law requires us to keep it.
9. Records and audit
We will give the school the information reasonably needed to show we meet these terms, including a summary of independent security testing when available.
10. Contact
ORNITHOAI Soft Tech Private Limited
2nd Floor, 7-895/A, Subhash Nagar, IDA Jeedimetla, Hyderabad, Telangana 500055
Email: info@ornithoai.com
Phone: +91 89789 64747