Privacy Policy

Last updated: 24 July 2026

This Privacy Policy explains how Ripple Academy (“Ripple”, “we”, “us”) collects, uses, discloses, and protects personal information in connection with the Ripple mobile application and this website (together, the “Service”). Ripple Academy operates a preschool located at Address line — to be confirmed.

Ripple is the data fiduciary responsible for the personal data processed through the Service. The software was designed and built for us by our technology provider, Naazware, and delivered to us to operate; Naazware does not own, control, or make decisions about the personal data in the Service (see Our technology provider below).

1. Who this policy covers

The Service is used by adults on behalf of a preschool:

• Parents and guardians — to read their own child’s development reports.
• Teachers and school staff — to record and review assessments.

Children do not use the Service. The app is not directed to children; it processes information about children on the school’s behalf, entered and read by adults.

2. Information we collect

About a child

• Name, gender, and (optionally) date of birth
• The class or group the child belongs to
• The parents/guardians linked to the child
• Developmental assessment responses, the scores derived from them, and the resulting reports

About an adult (parent, teacher, or staff member)

• Name, email address, and mobile number
• A password, which is stored only in a securely hashed form (never in plain text)

From the website

• Enquiry-form details you choose to submit: your name, email, phone, optionally your child’s name and age, and your message.

What we do NOT collect

To keep this concrete: the Service does not collect photographs or video, audio, attendance, location or GPS, advertising identifiers, device fingerprints, or analytics/tracking data, and it contains no third-party advertising or tracking SDKs. There is no push-notification token collection.

3. Children’s data and parental consent

A child’s information is processed only for the school’s educational purpose of assessing and supporting the child’s development, and only on the basis of verifiable parental consent obtained by the school at enrolment or account setup, in accordance with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”). We do not use a child’s data for advertising, profiling for commercial purposes, or tracking, and we do not permit any third party to do so.

4. Why we use the information

• Child data — to create and deliver developmental assessments and reports to the child’s own parents and teachers.
• Adult account data — to authenticate the account, secure access, and contact the account holder about their use of the Service.
• Website enquiry data — to respond to your enquiry about admissions or programs.

Our legal bases are the parent’s consent (for child data), the performance of the school’s relationship with families, and our legitimate educational interest in running the Service securely.

5. Who can see the information

Access is strictly scoped by role and enforced on our servers, not merely hidden in the interface:

• A parent can read only their own child’s published reports.
• A teacher can access only the children in the classes assigned to them.
• School administrators and authorised staff manage the school’s records.

We do not sell personal data, share it for advertising, or disclose it to any party except as described here or as required by law.

6. Service providers (sub-processors)

We use a small number of infrastructure providers strictly to host and run the Service on our instructions:

• Render — application hosting.
• MongoDB Atlas — database hosting.

These providers process data only to provide hosting and do not use it for their own purposes. We use no analytics, advertising, or marketing processors.

7. How long we keep information, and archiving

A child’s assessment records are educational records and are retained by the school while the child is enrolled and for up to three years after the child leaves, unless a valid deletion request applies. Adult account details are retained while the account is active and removed when the account is deleted. Website enquiry details are retained only as long as needed to respond to the enquiry and for our own records. Within the Service, an archived record is hidden from day-to-day use but is not the same as deleted; deletion is handled through the process in the next section.

8. Your rights and choices

Subject to applicable law, you may:

• Ask what personal data we hold about you or your child, and request a copy;
• Ask us to correct inaccurate information;
• Request deletion of an account and personal details through our account deletion page. When a parent’s account is deleted, the parent’s personal details are removed; the child’s educational records remain the school’s records;
• Withdraw a consent you previously gave (this may limit use of the Service).

9. How we protect information

• Passwords are stored only as secure hashes, never in plain text.
• On the mobile app, the authentication token is held in the device’s secure keystore (iOS Keychain / Android Keystore), and cached data is encrypted at rest and wiped on sign-out.
• All traffic between the app and our servers uses encrypted HTTPS connections.
• Access to records is enforced server-side by role, so a user can never reach data outside their own scope.
• We do not include personal information in our technical logs.

No system can be guaranteed perfectly secure, but we take reasonable and appropriate measures to protect personal data.

10. Where data is processed

The Service is operated for a school in India and personal data is processed on the infrastructure of the hosting providers named above. Some processing may take place on servers those providers operate outside India; wherever it is processed, the data remains protected by the measures described in this policy.

11. Grievance officer

As required by the DPDP Act, you may contact our grievance officer with any question or complaint about how personal data is handled, and we will respond within the timeframe the law requires:

• Name: Shritica Joshi
• Email: ripplepreschool@gmail.com
• Address: Address line — to be confirmed

12. Our technology provider

The Ripple platform was designed and developed by Naazware and delivered to Ripple Academy to own and operate. Naazware is a technology vendor only: it is not the data fiduciary, does not operate the Service, and does not control, use, or make decisions about the personal data processed through it. Responsibility for the Service and for the personal data rests with Ripple Academy.

13. Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects the current version, and material changes will be communicated through the Service or the website.

14. Contact us

For any privacy question, email hello@ripple.school.