Privacy Policy

1. Contact Information

2. Information We Collect

We collect the following categories of personal data, depending on how you use Ambiful Learning:

• Identity and contact data: name, email, phone number, and account role.
• Account and authentication data: hashed password data, session data, account status, and optional 2FA/TOTP configuration.
• Learning and academic data: enrolled courses, attendance, assignments, quizzes, grades, and progress metrics.
• Parent/guardian linkage data: parent-child relationship information for monitoring features.
• Financial and fee data: fee currency, due dates, payment/fee status, and related records.
• Communications data: contact form submissions, support interactions, and newsletter preferences.
• Technical and usage data: device/browser details, logs, diagnostics, and analytics events.
• AI interaction data: prompts, generated responses, and context required to provide AI-assisted features.

3. How We Use Information

• Provide core platform features and role-based access.
• Operate educational workflows and dashboards.
• Send service-related communications and support responses.
• Protect accounts, prevent abuse, and maintain platform security.
• Analyze service usage and improve performance.
• Comply with legal obligations and enforce terms.

4. Legal Basis by Processing Purpose (where applicable)

Where GDPR/UK GDPR or similar laws apply, we process personal data under one or more of the following legal bases: contract performance, legitimate interests, consent, and legal obligations.

5. Cookies and Similar Technologies

We use cookies and local storage for necessary operations, preferences, and analytics (subject to consent where required). You can control non-essential cookies through our consent controls and your browser settings.

6. Sharing and Service Providers

We share information only as needed to operate the platform (for example cloud hosting, database, storage, email delivery, analytics, authentication, and AI processing providers), to comply with law, or to protect rights and safety.

For Ambiful School these providers include: Vercel (hosting), Supabase (database), Amazon Web Services (file storage and, where a school turns it on, Amazon Rekognition for face recognition), Razorpay (fee payments), Expo, Apple Push Notification service and Firebase Cloud Messaging (mobile notifications), MSG91 (SMS and WhatsApp messages), our email delivery provider, and OpenAI (AI-assisted features such as lesson plans and report-card comments). Each receives only the data needed for its task. We do not sell personal data and we do not share it with advertisers or data brokers.

7. Data Retention

We retain personal information only for as long as necessary to provide services, meet legal obligations, resolve disputes, and enforce agreements. Data is deleted or de-identified when no longer required.

8. Your Rights

Depending on applicable law, you may have rights to access, correct, delete, or restrict processing of your personal information.

Request mechanism: Users can submit requests to view, edit, or delete personal information via privacy@ambiful.com or through https://www.ambiful.com. We verify identity before fulfilling requests.

9. Children and Educational Use

Our platform supports educational use and may involve minors through authorized parents/guardians, schools, or admins. We process children's information only as required for educational services and applicable law.

10. Security

We apply reasonable technical and organizational safeguards to protect personal information. No system can guarantee absolute security.

11. Policy Updates

We may update this Policy from time to time. Material changes will be posted on this page with an updated date.

12. Sources of Personal Data

• Directly from you: during sign-up, profile edits, support requests, and platform usage.
• From authorized users: such as admins, tutors, parents/guardians, or school representatives.
• Automatically: through logs, device/browser metadata, and cookie or local-storage preferences.
• From integrated services: where needed to provide authentication, communications, analytics, and AI features.

13. International Transfers

Ambiful Learning is operated from India, but some service providers may process data in other countries. Where cross-border processing occurs, we use contractual and operational safeguards appropriate to the sensitivity of the data and applicable law.

14. Sale of Personal Data and Marketing Use

We do not sell personal data for monetary consideration. We do not use student learning data for unrelated third-party advertising. Where consent is required for optional analytics or marketing cookies, we provide controls through cookie preferences.

15. Ambiful School: School Portal and Mobile App

15.1 Who is responsible for school data

Ambiful School is used by schools to run their day-to-day work with students, parents/guardians and staff. Accounts are created by the school; there is no public sign-up. For information about its students, parents and staff, the school decides what is collected and why (it is the data fiduciary under India's Digital Personal Data Protection Act, 2023), and we process that information on the school's behalf and under its instructions. The school is responsible for obtaining any consent it needs, including verifiable consent from a parent or guardian for a child.

15.2 Information processed in Ambiful School

• Profile and contact details: name, email address (optional for students), phone number, address, date of birth, role, class and section, roll number, and profile photo.
• School records: attendance, timetables, homework and assignments, exam marks, report cards, certificates, leave requests, and transport and visitor records.
• Fees and payments: fees due, amounts paid, payment status and receipts. Card and UPI details are entered directly on Razorpay's payment page; we never receive or store them.
• Photos ("Moments"): class photos posted by staff, and photos attached to incident reports, lost-and-found posts and circulars.
• Health information: allergies, immunisations, health screenings, and visits to the school nurse, recorded by school staff.
• Wellbeing and incidents: mood check-ins entered by students or parents, and incident or safeguarding reports entered by staff.
• Messages and posts: parent–teacher and staff chat messages, notices, circulars and announcements.
• Search queries: text typed into in-app search, used only to return results.
• Device information (mobile app): a notification token, device name, platform and app version for each signed-in device, so we can send notifications and let you sign out of devices.

15.3 Face recognition for class photos (optional)

A school may choose to turn on face recognition for Moments. It is off by default and is used only when (a) we have enabled it for that school, (b) the school has switched it on, and (c) the school has recorded that a parent or guardian has given consent for that child. When active, Amazon Rekognition compares faces in class photos with the child's profile photo to suggest which children appear; a staff member reviews the suggestions before a photo is shared. It is also used to blur other children's faces, so each family sees its own child clearly. We store only the face identifier returned by Amazon Rekognition, not separate copies of face images. If consent is withdrawn, the child's face data is removed. This data is never used for any other purpose.

15.4 How Ambiful School uses this information

• Only to provide the school service: showing each person the records they are allowed to see, sending notifications, collecting fees, and supporting teaching and pastoral care.
• A wellbeing check-in may be flagged automatically, based on its scores and words, so that a staff member can follow up. This is an aid for staff, not a diagnosis.
• AI-assisted features (for example report-card comments or lesson plans) receive only the information needed for that task. AI never decides grades, risk levels or other outcomes.
• We do not use this information for advertising, we do not track you across other companies' apps or websites, and the mobile app contains no advertising or third-party analytics.

15.5 Who can see it

Access is limited by role within the school. Parents see their own child's information; students see their own; staff see what their role requires; school administrators manage the school's records. Moments photos are shown only to the families of the children tagged in them. We do not share school data with other schools.

15.6 Mobile app permissions

• Camera: to scan gate passes and take photos you choose to upload.
• Photo library: to pick photos you choose to upload.
• Face ID / fingerprint: to unlock the app. This check happens on your device; we never receive your biometric data.
• Notifications: to alert you about notices, messages, fees and attendance. You can turn these off in your device settings.

The app does not use your location, contacts or microphone.

15.7 Retention and deletion

School records are kept for as long as the school uses Ambiful School, and afterwards only as agreed with the school or required by law. When a photo is deleted, the original and any blurred copies are removed. To correct or delete your information, or to close your account, contact your school, or email privacy@ambiful.com and we will work with your school to action the request. Some records, such as fee receipts, may need to be kept for legal reasons.

15.8 Deleting your Ambiful School account

You can ask for your Ambiful School account to be deleted at any time — parents, students and staff alike.

How to ask

• In the app: Profile → Delete account → Request deletion.
• On the web: use our account deletion request form, or email privacy@ambiful.com with your school, your name and the email or phone you sign in with.
• Through your school: your school's office can raise the request for you.

What is deleted

• Your login (email or phone and password) and your sessions on every device — you can no longer sign in.
• Your personal account data held by Ambiful: notification tokens, profile photo, app preferences, and any face-recognition data.
• For a parent: the link to your child, so you no longer see their information.
• Messages you sent stay in the school's records but are shown as from a "Former member".

What the school may keep

A student's school record — attendance, marks and report cards, fees and receipts, certificates, health and incident records — belongs to the school, which may be required by law or by its board to keep it (for example, fee receipts under tax law and admission and transfer records). We tell the school about your request; these records are kept only for as long as the school must keep them and are then deleted or anonymised.

How long it takes

We acknowledge a request within 7 days and complete it within 30 days, or tell you what the school has to keep and why. We may ask you to confirm your identity first.

16. Grievance and Data Protection Requests (India)

For India-based users, privacy grievances or requests regarding access, correction, deletion, or consent withdrawal can be submitted to privacy@ambiful.com. We acknowledge and process requests within a reasonable period and in line with applicable law.

17. Contact for Privacy Matters