Privacy Policy

REO360 is a school management platform operated by Edstreet Private Limited ("REO360", "we", "us"), based in Mumbai, Maharashtra, India. This policy applies to the REO360 website, the web app and the REO360 mobile apps (together, the "Service").

It is written to meet the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), its Rules, and the Information Technology Act, 2000 and the rules made under it.

Responsibility depends on the data, because a school and REO360 play different roles.

• School records: for information about pupils, guardians and staff that a school enters or generates in REO360, the school is the Data Fiduciary. It decides what is collected and why. REO360 is its Data Processor and acts only on its instructions.
• REO360 accounts and our website: for your sign-in identity, the devices you use, and anything you send us through our website, REO360 is the Data Fiduciary.
• Safety and misuse: to keep the Service and the children who use it safe, REO360 decides for itself when a chat needs to be reviewed, as described under "Who can see your information".
• Your school's own privacy notice governs how it uses your information. Please ask the school for a copy.

What is held depends on which modules a school uses and what it chooses to record. It can include the following.

• Account and identity: name, mobile number, email address, your role at a school, and a PIN stored only as a one-way hash.
• Pupils: name, date of birth, gender, photograph, address, nationality, mother tongue, admission and class details, previous school, attendance, homework, marks, report cards, certificates and fee records.
• Pupil identifiers: APAAR ID and PEN where the school records them. For Aadhaar we hold the last four digits at most, never the full number.
• Sensitive details a school may record: religion, social category, RTE status, special-needs status, blood group and medical notes.
• Guardians: name, phone numbers, email address, occupation, income band, address, photograph, relationship to the pupil, language and WhatsApp preference. Schools may also record custody or access restrictions.
• Staff: name, date of birth, gender, contact details, photograph, address, qualifications, employment details, and documents such as ID proof, police verification and contracts.
• Transport crew: names and phone numbers of drivers and attendants, which are shown to the families they serve.
• Wellbeing: counselling requests and counsellors' notes.
• Messages: notices, conversations, leave requests, feedback and survey responses.
• Reports: if you report someone, your name, who you reported, the reason and your description.
• Payments: amounts, dates, fee details, gateway reference numbers and cheque or demand draft details. Card, UPI and netbanking details are entered on the payment gateway's own page and never reach REO360.
• Technical: IP address, browser, device make and model, operating system and app version, push notification token, session records and activity logs.
• Enquiries: the school name, city, role, contact details and message you send through our contact form.

• No biometric data. Fingerprint or face unlock on the mobile app is handled by your phone. REO360 only learns whether it succeeded.
• No location tracking. The app does not ask for your location, and there is no live bus tracking.
• No access to your contacts, SMS messages or microphone.
• The app uses your camera, photos or files only when you choose to add a picture or document.

We use personal data only to:

• Provide the Service: run attendance, timetables, homework, exams, fees, transport, library, meals, wellbeing and communication for the school.
• Verify who you are, keep you signed in and show you only what your role permits.
• Send notices, alerts and reminders that the school or the Service generates, by the channels available to you.
• Keep the Service secure and reliable, investigate faults and abuse, and maintain activity logs.
• Provide support, including looking at a school's account when the school asks or a fault requires it.
• Reply to enquiries and book demos.
• Meet legal obligations and respond to lawful requests.

For school records, the school determines the lawful basis, and is responsible for giving the notices and obtaining the consents the law requires. That includes verifiable consent from a parent or lawful guardian where the DPDP Act requires it for a child.

For REO360 accounts, we process your data with your consent, or for the legitimate uses the DPDP Act allows, such as complying with the law. Where processing relies on consent, you can withdraw it at any time by contacting the school or our Grievance Officer. Withdrawing consent may mean some or all of the Service can no longer be provided to you, and does not affect processing that took place before.

Most people whose records are in REO360 are children, and we treat their data with particular care. Pupils cannot sign themselves up: only a school can create a pupil's account. A pupil sees only their own information.

We do not use children's data for advertising, and we do not profile children for any commercial purpose. Activity within the Service, such as attendance and marks, is recorded only to serve the school's educational purpose and pupils' safety.

If you believe a child's data has been added without proper authority, please contact the school or our Grievance Officer.

Within a school, access follows the person's role and relationship to the record.

• Staff see what their role requires. A subject teacher sees the sections they teach, and a class teacher sees their class.
• Guardians see the children linked to them, within the limits the school sets. Pupils see themselves.
• Medical notes are limited to staff with specific permission. Counselling records are limited to the counsellor and roles the school designates.
• Authorised REO360 staff can open a school's account for support. Each such session needs a stated reason, is limited in time and is recorded so the school's activity log can show it.
• Chats are visible only to the people in them. School staff, including school admins, cannot read a chat they are not part of.
• Authorised senior REO360 staff can read chats, including the author of an anonymous message, to investigate a safety concern, a complaint or misuse, or when the law requires it. A school can ask us to investigate. Each read needs a stated reason and is recorded in a log that cannot be edited.
• If you report someone, your school's admins see your name, the reason and your description. The person you report is not told. Reports do not include the text of a chat.
• Other schools cannot see your data. One mobile number can link to several schools, but no school can see your relationship with another.

We use the service providers below to run REO360. They may process personal data only to provide their service to us, under contract. A school can ask us for the current list.

• Amazon Web Services (Mumbai region): hosting, databases, file storage and backups.
• Google Firebase: delivering push notifications and, on the mobile apps, crash reports. Push notifications include the message content. Crash reports include technical details, your role and an account identifier that does not show your name.
• Payment gateways chosen by the school: processing online fee payments. Payments are governed by the gateway's own terms.
• SMS, WhatsApp and email providers, where enabled for a school: delivering login codes, notices and alerts.
• Video meetings: online classes may use an outside service such as Jitsi Meet, and forms may link to services such as Google Forms. These are separate services with their own privacy terms, and they apply when you leave REO360 to use them.

We do not sell personal data and we do not share it for anyone else's marketing. We share information beyond the school and the providers above only where the law requires it, for example with a court or a government authority acting lawfully, or to protect the safety of a person. If REO360's business is transferred, the Service and the data would move to the new owner under the same commitments, and schools would be told.

School records, uploaded files and backups are stored in India, in Amazon Web Services' Mumbai region.

The exception is Google Firebase, which may process push notifications and crash reports outside India. Should the Government of India restrict transfers to a country, we will follow that restriction.

We use reasonable security safeguards appropriate to the sensitivity of the data, including:

• A separate database for each school, with row-level security on top.
• Encrypted connections, and encryption at rest for stored files and backups.
• Additional field-level encryption for medical notes and counselling records.
• One-way hashing for PINs and passwords. Signing in uses a one-time code rather than a password for parents and most staff.
• An additional PIN check for administrative and finance roles.
• Activity logs of changes to records and data exports, which cannot be edited.
• Daily backups.

No system is completely secure. If a personal data breach occurs, we will contain it, investigate it and tell the affected school without undue delay. We and the school will then make the notifications the law requires, including to the Data Protection Board of India, CERT-In and affected individuals.

We keep personal data only as long as it is needed for the purposes above or as the law requires.

• School records: for as long as the school uses REO360. Academic, attendance and financial records form a permanent school record and are kept even after a pupil leaves or a staff member moves on.
• After a pupil leaves: the pupil's own sign-in closes, and the family keeps access for any other children and past receipts.
• When a school leaves REO360: the school can export its data, and we then delete it as set out in our Terms of Use.
• Chats and reports: kept with the school's records, so that a complaint can be investigated later. Messages are not removed when an account is deleted.
• Activity logs: for as long as the school's records are kept.
• Your REO360 account: when you ask to delete it, it is deleted within 30 days unless you sign in again first. See reo360.in/delete-account.
• Login codes: valid for five minutes and stored only in a form that cannot reveal the code.
• Sign-in sessions: end after up to 14 days on the web and 90 days on the mobile app without use, or when you sign out.
• Backups: taken daily and kept for about 30 days, after which they expire.
• Server logs: kept on a short rolling basis and overwritten automatically.
• Enquiries: kept for as long as we need to respond and follow up.

Under the DPDP Act, you have the right to:

• Get a summary of your personal data and how it is being processed, and know who it has been shared with.
• Have inaccurate or incomplete data corrected and updated.
• Ask for your data to be erased where it is no longer needed and no law requires it to be kept.
• Withdraw consent where processing relies on consent.
• Have a grievance addressed, and nominate someone to exercise your rights if you die or become unable to.

For school records, please contact your school first: it controls those records, and we act on its instructions. Records that a school must keep, such as fee receipts and academic results, may not be erasable.

To delete your REO360 account, follow the steps at reo360.in/delete-account. For anything else about your account or data we control, contact our Grievance Officer. We may need to verify your identity first. A parent or lawful guardian can make a request on a child's behalf.

You can change your notification preferences at any time in your settings, including categories, channels and quiet hours. Emergency alerts from your school are always delivered.

We use only first-party cookies and browser storage that the Service needs to work. We do not use analytics cookies, advertising cookies or third-party trackers.

• reo_session: keeps you signed in securely. It can last up to 30 days, and your session may end sooner.
• reo_csrf: protects forms against cross-site request forgery. It is set on every page, including the public website.
• reo_ctx: remembers which school and role you are using.
• Browser storage remembers conveniences on your own device, such as your theme, sidebar state, last school and selected academic year.

• Notifications: to send you alerts. You can turn these off in your phone's settings.
• Camera, photos and files: only when you choose to add a picture or document.
• Face or fingerprint unlock: optional, and handled by your phone.

The Service links to other sites, including our social media pages, payment gateways and online meeting services. Their privacy practices are their own, and we encourage you to read their policies.

We may update this policy as the Service or the law changes. We will change the date at the top of this page, and tell schools about material changes in advance through the Service or by email.

If you have a question, complaint or request about your personal data, write to the Grievance Officer, Edstreet Private Limited (REO360), Mumbai, Maharashtra, India, at hello@reo360.in, or call +91 80828 43033, Monday to Friday, 10:00 AM to 6:00 PM IST.

We will acknowledge your complaint within one working day and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.