Hello!parent

1Who We Are

Hello!parent is a private school management platform designed for pre-primary educational institutions. It is operated by the school administration and used exclusively by enrolled students' parents and school staff.

This Privacy Policy applies to the Kids Cube mobile application (Android), the web portal, and all associated services.

2What Information We Collect

We collect only the minimum data necessary to operate the app:

• Student Information: Name, class, age, attendance records, academic results, and fee records
• Parent Information: Parent name, relationship (father/mother), contact phone number, and email address
• Login Data: A 4-digit PIN used for parent authentication. No passwords are stored for parents.
• Staff Information: Teacher/admin name, email, and class assignment
• Usage Logs: Login timestamps and IP addresses for security auditing only

3How We Use Your Information

Information collected is used exclusively for:

• Displaying your child's attendance, results, and fee records to authorised parents
• Sending school announcements and stories to parents
• Enabling teachers and administrators to manage classroom activities
• Detecting and logging unauthorised login attempts for security

We never sell, rent, or share your personal data with third parties for marketing or advertising purposes.

4Children's Privacy — DPDP & COPPA

Kids Cube is operated on behalf of schools. Student data is provided by the school administration and is accessible only to the student's own parent/guardian.

• We do not allow children to directly create accounts or submit personal information
• Parent accounts are created and managed by the school administration on behalf of parents/guardians
• Under the DPDP Act 2023, processing of children's personal data requires verifiable parental consent — this consent is obtained by the school and must be recorded before any data entry
• Parents may request to view, correct, or delete their child's data at any time by contacting the school or using the grievance process below

5Data Storage & Security

All data is stored securely with the following protections:

• All sessions are authenticated using signed JSON Web Tokens (JWT) stored in secure HttpOnly cookies — inaccessible to JavaScript
• Database backups are encrypted using AES-256-GCM before being stored in cloud storage
• All API communications occur over HTTPS
• Rate limiting is applied to login endpoints to prevent brute-force attacks
• Security events (login attempts, failures) are logged and auditable by the school administrator

6Data Sharing

We do not share your personal information with any third parties except:

• Cloud Infrastructure: Data is stored on Neon (PostgreSQL) and Vercel hosting infrastructure, both of which operate under their own privacy policies and GDPR-compliant data processing agreements
• Email Service: If you use the password reset feature, your email address is used to send an OTP via a configured SMTP service

7Your Rights — DPDP Act 2023 (Data Principal Rights)

As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights regarding your personal data:

• Right to Access: Request a summary of personal data we hold about you or your child (Section 11, DPDP Act)
• Right to Correction & Erasure: Request that inaccurate, incomplete, or outdated data be corrected or erased (Section 12, DPDP Act)
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer — we will respond within 7 working days (Section 13, DPDP Act)
• Right to Nominate: You may nominate another individual to exercise your data rights on your behalf in the event of your incapacity (Section 14, DPDP Act)
• Withdraw Consent: You may withdraw consent at any time. However, this may result in inability to access school-specific services. Contact the school administration to deactivate your account.

8Data Retention

We retain personal data only as long as the student is enrolled at the school. Upon unenrollment or at the end of the academic year, the school administrator can purge student and parent records through the admin dashboard.

9Data Breach Notification

In the event of a personal data breach that is likely to result in harm to you, we will:

• Notify the Data Protection Board of India as required under the DPDP Act 2023
• Notify affected Data Principals (parents/guardians/teachers) as soon as reasonably practicable via the school administration
• Document the breach and remediation steps taken

10Grievance Officer (DPDP Act 2023)

As required under Section 13 of the Digital Personal Data Protection Act 2023, we have designated a Grievance Officer to address your data-related concerns:

• Name: School Data Grievance Officer
• Contact: 2hello.parents2@gmail.com
• Response Time: Within 7 working days of receiving your complaint
• Escalation: If unsatisfied with our response, you may escalate to the Data Protection Board of India once the Board is operational

11Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated to the school administration, who will notify parents through the app's announcements feature. Continued use of the app after changes constitutes acceptance of the updated policy.