Everything Your School Needs. One Platform.

Privacy, made clear.

Who This Policy Covers

The Institution is typically the data controller (or "Data Fiduciary" under Indian law) for student and staff records entered into ValleyX. ValleyX acts as a data processor, handling that information on the Institution's instructions.

For information such as app login credentials, device data, service security information, and certain driver or device information, ValleyX may act as a data controller in its own right. If you have questions about School-managed records, please contact your Institution first.

Information We Collect

Student records (name, date of birth, class, attendance, grades, fee status, photographs), parent/guardian contact details, staff records including employment and payroll data, and emergency or medical information where the Institution chooses to store it.

Account credentials, profile information added by parents, staff, or drivers, messages and notices sent through the Services, and payment information for fee transactions processed via third-party gateways.

Real-time GPS location while a trip is active, trip logs (route, start and end times, stops), and driver identity or vehicle details provided by the Institution.

Device type, operating system, app and device identifiers, app usage and crash logs, IP address, approximate location for security and fraud prevention, and push-notification identifiers such as Firebase Cloud Messaging (FCM) tokens. FCM tokens are used to deliver authorised notifications such as school notices, attendance updates, fee reminders, and transport alerts. Biometric data is addressed separately in Section 08 below.

How We Use Your Data

Children's Data

Student accounts and data are created and managed by the Institution or a parent/guardian, not directly by the child. We do not knowingly allow children to create independent accounts without Institution or parental involvement. Where our processing of a child's personal data relies on consent, we treat the Institution's enrolment process, or a parent/guardian's action within the Services, as the point at which that consent is obtained and recorded on our behalf, consistent with the Institution's own policies and applicable law.

We do not undertake behavioural monitoring or tracking of children, and we do not serve targeted or behavioural advertising directed at children, in line with the DPDPA. We limit student data collection to what is necessary for educational and administrative purposes, and do not use student data to build advertising profiles.

Parents and guardians may contact their Institution to review, correct, or request deletion of their child's information. If an Institution is unresponsive, parents or guardians may also contact us directly at the details in Section 14, and we will coordinate with the Institution as needed.

Location Data & Bus Tracking

Location is shared with the Institution and with parents/staff of students on that specific route for live bus tracking. Trip logs may be retained for a limited period for safety audits and dispute resolution, as configured by the Institution. Drivers can see in-app whenever tracking is active. Drivers who use the ValleyX Driver app directly must be at least 18 years of age, consistent with Institution employment policies.

Payment Information

Fee payments are processed via third-party, PCI-DSS compliant payment gateways. ValleyX does not store full card numbers, CVVs, or full bank account credentials. We retain limited transaction metadata — amount, date, status, and last 4 digits where provided by the gateway — for receipts, reconciliation, and dispute handling.

Cookies & Tracking Technologies

Biometric Data

We do not collect biometric data unless an Institution specifically enables this feature and connects its own compatible biometric devices (such as ZKTeco readers) through the ValleyX Biometric Agent.

Where enabled, the device converts a fingerprint into a mathematical template; ValleyX stores this template and associated attendance timestamps, not a reconstructable image of the fingerprint itself.

Institutions enabling biometric attendance are responsible for obtaining any consent required from staff under applicable law before enrolling them. Biometric data is used solely for attendance verification and is not shared outside the Institution's ValleyX account.

How We Share Information

Data Retention

We retain personal information for as long as the Institution's subscription is active and as necessary to provide the Services. Following termination, School Data may be retained for a limited transition period to allow authorised export and closure, after which it is deleted or anonymised in accordance with the applicable agreement, unless longer retention is legally required or otherwise permitted. Driver app trip logs and staff biometric templates are kept only as long as necessary for safety, operational, dispute-resolution, or other legitimate purposes, and are deleted or anonymised once that purpose has been served.

Your Rights & Account Management

ValleyX does not provide self-service account registration through its mobile applications. User accounts are created, provisioned, and managed by the subscribing Institution or by authorised ValleyX administrators. Users cannot independently create a ValleyX account through the Services.

If an account or associated personal information needs to be deleted, disabled, or corrected, the request should generally be made to the School that manages the account. The School may request ValleyX to delete or modify the relevant account or data through its administrative systems. ValleyX may also delete or disable accounts through its backend administration where authorised or required. Information may be retained where required for legal, security, fraud-prevention, dispute-resolution, or other legitimate purposes.

Grievance Officer

Grievance Officer: Faizan Shabir

Email: grievance@valleyx.in

Response time: We aim to acknowledge grievances within 48 hours and resolve them within 30 days, or as otherwise required by applicable law.

Data Breach Notification

If we become aware of a personal data breach affecting an Institution's data, we will notify the affected Institution without undue delay, and in any event within 72 hours of becoming aware of the breach, along with information reasonably available to help the Institution meet its own notification obligations under applicable law, including to the Data Protection Board of India and affected individuals where required.

International Data

ValleyX primarily hosts and processes data on infrastructure located in India. We may use service providers that host or process information in other countries, for functions such as cloud backup, SMS/push delivery, or payment processing. Where this occurs, we take appropriate contractual, technical, and organisational measures consistent with applicable data protection requirements, and we will update this section to name specific countries or regions if our processing locations materially change.