Privacy policy

This policy covers the BHB International School website at bhbinternational.school, the parent and staff portal on it, and the school’s mobile app. The entity responsible for your data is named in the block at the foot of this page. It applies to parents, guardians, students and staff.

• Parent and guardian details. Name, relationship to the student, mobile number, email address and postal address, so we can identify you as the person entitled to a child’s records and reach you about the child.
• Student profiles. Name, date of birth, class, section, roll and admission number, attendance, marks, homework, fee dues and receipts, transport stop, and the notices and parent-teacher meetings that concern the child. These are school records we already keep in order to provide education.
• Online transaction details. For each fee payment: the amount, the fee heads it settles, the date, the payment method you chose, the gateway’s transaction reference, and whether the payment succeeded or failed. We use these to issue your receipt and to reconcile the money against your child’s account.
• Staff location — staff app only, optional. When a staff member chooses to mark attendance from the app, their location is read once, at that moment, to confirm they are on campus. Location is never read in the background and never tracked continuously.
• Device and session data. A signed sign-in token is stored on your device so you stay logged in. It contains no password. We use no advertising identifiers, no third-party analytics and no ad networks. The cookie policy lists every cookie the website sets, and there are three.

The parent app asks for three things, each at the moment it is needed and each refusable without losing the rest of the app.

• Notifications. Allowing them stores a push token for that device against your account, so a notice or a fee reminder reaches your phone. It identifies the device, not you, and it is deleted when you sign out of that device or ask us to delete your account.
• The microphone — only in the study helper. Held while you tap the mic to ask a question aloud, and at no other time. Your phone’s own speech service turns the speech into text; the app records nothing and uploads no audio, and what reaches the school is the typed-out question. Everything in the study helper works by typing instead.
• Photos and files — only when you attach one. Picked by you, from the picker, when you add a document to a leave application, a complaint or a profile. The app does not read your gallery.

The parent app asks for no location permission at all— it does not have one to ask for. The staff app is a separate app with a separate listing, and the one-off attendance reading described above is the only location it takes.

The app keeps a copy of your child’s current school data on the phone so it opens without waiting for the network. Uninstalling the app removes that copy immediately.

Fee payments are completed on the payment gateway’s own secure, PCI-DSS compliant page. Your card number, CVV, UPI PIN, net-banking user ID and net-banking password are entered there, not here. They are never transmitted to the school, never stored on our systems, and are not available to any member of school staff.

What comes back to us is the outcome of the transaction and its reference number — enough to issue a receipt and to trace the payment if something goes wrong, and nothing more.

We do not sell, rent, trade or licence parent data, student profiles or transaction records to anyone. We do not share them with advertisers, data brokers, coaching centres, publishers or any other commercial third party.

Data leaves the school’s own systems only in these narrow cases, each limited to what the recipient needs to do its job:

• Our payment processor, to take your fee payment, settle it to the school’s bank account, and process any refund or chargeback. This is the only third party that handles your payment instrument, and it does so under its own published privacy terms and RBI regulation.
• Our hosting providers (Google Cloud and Supabase), which store the school’s database under contract. They process data on our instructions and have no right to use it for their own purposes.
• Our messaging provider (Meta’s WhatsApp Business API), to deliver one-time passwords, absence alerts and fee reminders to the mobile number you registered with the school.
• Government and regulatory bodies, where we are required by Indian law to report or produce records — for example statutory returns for the education department, or a lawful order from a court or authority.

• All traffic between your device and the portal is encrypted in transit over HTTPS, and data is encrypted at rest on the hosting provider’s infrastructure.
• Access is role-based. A parent account can reach only that family’s own children. Staff see only the records their role requires, and administrative actions are recorded in an audit trail.
• Sign-in is by one-time password to your registered mobile number, so an account cannot be opened by someone who does not control that number.
• If a breach affecting your data occurs, we will inform affected families and the relevant authority without undue delay.

Student academic and financial records are retained for as long as the school’s statutory record-keeping obligations require, because a former student may need a transfer certificate, a mark sheet or a fee certificate years after leaving. Portal access for a family ends when the student leaves. Transaction records are retained for the period required by tax and audit law.

The portal and app are used by parents, guardians and staff, not by children directly. Student records shown in them are school records held under the school’s custodianship and processed for legitimate educational purposes only.

• You can sign out at any time, which removes the sign-in token from your device.
• You may ask what data the school holds about your family, ask for a correction, or update your registered mobile number, by writing to the school office.
• Fee reminders and absence alerts are part of the school service rather than marketing, so they continue while your child is enrolled. We send no promotional messages.
• You may ask us to delete your app account and the data held against it. What goes, what the school must keep, and how to ask are set out on the account and data deletion page.

If our practices change we will update this page and move the date at the top. Material changes are also announced in the portal’s Notices section. Questions about this policy go to director@bhbinternational.school, or see our contact page.