School data terms

These terms are part of every school's agreement to use School Buddy. They describe how we handle the student data a school puts in.

Roles

The school is the data fiduciary for student data and decides its purposes. We are the school's data processor and act only on the school's documented instructions.

The school's responsibilities

• Collect any consent the law requires from parents before adding a child's information, keep a record of it, and add only the information needed for school communication.
• Do not add Aadhaar numbers, medical records or other sensitive identifiers.
• Create and remove staff accounts promptly when people join or leave.

Our responsibilities

• Process student data only to run School Buddy for that school.
• Keep each school's data separate (database row security per school) and encrypt student names, diary text and leave reasons with a key unique to the school.
• Ask each parent in the app to confirm consent before they see a child's records, and let them withdraw it.
• Tell the school without undue delay, and within 72 hours, if we become aware of a personal data breach affecting its data, and help it meet its own notice duties.
• Keep an audit log of actions on school data, without names or content.
• On request, or when the school stops using School Buddy, return the data as an export and delete it within 90 days (backups within a further 31 days).

Sub-processors

• Hostinger: servers and encrypted backups. Encrypted backup copies are also kept on a secured company computer in India.
• Apple and Google: delivery of push notifications that contain no student details; Google: crash reports through Firebase Crashlytics.

Schools can request the signed data-processing agreement at support@homeworkai.in.