This policy explains how ORNITHOAI Soft Tech Private Limited("we", "us") handles personal data in HeySchool AI — the school management platform, its apps and this website — in line with India's Digital Personal Data Protection Act, 2023 and the rules made under it.
1. Who we are
HeySchool AI is a product of ORNITHOAI Soft Tech Private Limited ("Ornitho AI"), Hyderabad, India.
ORNITHOAI Soft Tech Private Limited
2nd Floor, 7-895/A, Subhash Nagar, IDA Jeedimetla, Hyderabad, Telangana 500055
Email: info@ornithoai.com
Phone: +91 89789 64747
2. Our role and your school's role
Schools decide; we process. When a school uses HeySchool AI, the school decides what information about its students, parents and staff is recorded and why. For that information the school is the Data Fiduciary and we act as its Data Processor, handling the data only on the school's instructions and under our Data Processing terms. Questions about a school's records are best sent to the school first; we will help the school answer them.
We are the Data Fiduciary for a small set of data we collect for ourselves: enquiries and demo requests sent through this website, and the account details of the people who register and administer a school's subscription.
3. What we collect
| About whom | What |
|---|---|
| Students | Name, date of birth, gender, class and section, roll and admission numbers, photograph, attendance, marks and report cards, homework, fee records, transport route and stop, notes recorded by the school, and documents the school uploads (for example a birth certificate or transfer certificate). |
| Parents and guardians | Name, relationship, mobile number, email, address, and messages exchanged with the school. |
| Staff | Name, contact details, employment ID, role, qualifications, timetable, attendance and leave, and the salary and statutory details a school records for payroll. |
| Website visitors | What you type into our demo or contact forms: name, mobile, email, school, city and message. |
| Everyone who signs in | Mobile number, a one-way hash of the password, sign-in times, and a record of important actions (the audit log) used to keep accounts secure. |
4. How we use it
- To run HeySchool AI for the school — the features the school has switched on.
- To verify identity at sign-up and sign-in, including by SMS one-time password.
- To keep the service secure, prevent misuse and investigate problems.
- To reply to demo requests and enquiries sent through this website.
- To meet legal obligations, such as tax records and lawful requests from authorities.
We do not sell personal data, and we do not use it for advertising.
5. Children's data
Most students are under 18, so their data needs extra care. In particular:
- A school must obtain verifiable consent from a parent or lawful guardianbefore recording a child's data in HeySchool AI, as the law requires. Obtaining and keeping that consent is the school's responsibility as Data Fiduciary.
- We do not track children's behaviour, monitor them for advertising, or show them targeted advertising.
- Children's data is used only to provide the school's own services to that child.
6. How the AI features use data
When someone uses an AI feature — asking the Copilot a question, generating a question paper, or reading an uploaded document — the relevant records are sent to our AI provider to produce the answer. The AI only sees data the person asking is already allowed to see, within their own school. It is read-only: it cannot change records. Our AI provider processes this data to return the result and does not use it to train its models under our agreement with it.
7. Who we share it with
We share personal data only with the service providers below, who process it on our behalf under contract, and with authorities where the law requires.
| Provider | What they do for us | Where |
|---|---|---|
| Microsoft Azure | Hosting of the application, database and file storage | India (Central India region) |
| Anthropic | AI features — answering questions, drafting question papers, reading uploaded documents | Outside India |
| SMSHorizon | Sending one-time passwords (OTP) by SMS | India |
| Map / address-search provider | Suggesting addresses while a school registers | Varies by provider |
8. Where it is stored
HeySchool AI and its database are hosted on Microsoft Azure in India. Some processing — the AI features in particular — takes place outside India, and only to countries to which Indian law permits transfer.
9. How we protect it
- Each school's data is kept separate by row-level security in the database itself.
- People see only what their role allows; access changes are recorded.
- Data is encrypted in transit and at rest; passwords are stored only as a one-way hash.
- Documents and photographs are held in private storage, opened only through short-lived links.
- Sign-in attempts are limited, and sign-up is verified by SMS OTP.
If a personal data breach occurs, we will inform the affected school without delay, and the Data Protection Board and affected people as the law requires. See our Security page.
10. How long we keep it
We keep a school's data while its subscription is active. When a school leaves, it can export its data; we then delete it within 90 days, except where the law requires us to keep something longer (for example, invoices and sign-in logs). Website enquiries are kept for up to 24 months after our last contact.
11. Your rights
Under the DPDP Act you may:
- ask for a summary of the personal data held about you and how it is used;
- ask for it to be corrected, completed or updated;
- ask for it to be erased where it is no longer needed or consent is withdrawn;
- withdraw consent, as easily as it was given;
- nominate another person to exercise these rights if you die or become unable to; and
- raise a grievance with us, and then with the Data Protection Board of India.
If your data is held for a school, please contact the school first; we will assist it. Otherwise write to our Grievance Officer below.
12. Cookies and browser storage
HeySchool AI uses your browser's storage only to keep you signed in and remember settings such as your selected school. We do not use advertising cookies. If we add analytics to this website, we will ask first.
13. Changes to this policy
If we change this policy in a way that matters, we will tell schools in advance and update the date at the top.
14. Contact and grievances
Grievance Officer: Name — to be added
Email: info@ornithoai.com
Address: 2nd Floor, 7-895/A, Subhash Nagar, IDA Jeedimetla, Hyderabad, Telangana 500055
We aim to respond to grievances within 7 working days, and in any case within the time the law allows.