Your data is
your trust.
At ValleyX, protecting the information entrusted to us by schools, parents, staff, and drivers is not just a responsibility — it's fundamental to how we build our platform.
Privacy, made clear.
This Privacy Policy explains how ValleyX ("ValleyX," "we," "us," or "our") collects, uses, shares, and protects information when schools, parents, students, staff, and drivers use our school management platform and related mobile applications, including ValleyX Parent, ValleyX Staff, and ValleyX Driver (collectively, the "Services"). ValleyX accounts are provisioned and managed by subscribing schools or authorised ValleyX administrators; users do not independently create accounts through the Services. This policy applies only to the Services and does not cover any third-party sites, apps, or services that may be linked from within the Services. By using the Services, you agree to the practices described in this policy.
Who This Policy Covers
ValleyX is provided to schools ("Institutions") as a subscriber, and staff, students, and parents access the Services through accounts created or authorised by the Institution.
The Institution is typically the data controller (or "Data Fiduciary" under Indian law) for student and staff records entered into ValleyX. ValleyX acts as a data processor, handling that information on the Institution's instructions.
For information such as app login credentials, device data, service security information, and certain driver or device information, ValleyX may act as a data controller in its own right. If you have questions about School-managed records, please contact your Institution first.
Information We Collect
We collect only the information needed to provide, improve, and maintain the ValleyX platform and its services.
Student records (name, date of birth, class, attendance, grades, fee status, photographs), parent/guardian contact details, staff records including employment and payroll data, and emergency or medical information where the Institution chooses to store it.
Account credentials, profile information added by parents, staff, or drivers, messages and notices sent through the Services, and payment information for fee transactions processed via third-party gateways.
Real-time GPS location while a trip is active, trip logs (route, start and end times, stops), and driver identity or vehicle details provided by the Institution.
Device type, operating system, app and device identifiers, app usage and crash logs, IP address, approximate location for security and fraud prevention, and push-notification identifiers such as Firebase Cloud Messaging (FCM) tokens. FCM tokens are used to deliver authorised notifications such as school notices, attendance updates, fee reminders, and transport alerts. Biometric data is addressed separately in Section 08 below.
How We Use Your Data
We use collected information to operate and improve ValleyX while supporting schools and their authorised users. We do not sell personal information, and we do not use student data for targeted advertising or behavioural profiling.
Operate attendance, fee management, communication, and transport tracking.
Verify accounts and keep the platform safe from unauthorised access.
Handle fee transactions and generate receipts and invoices.
Deliver alerts on behalf of the Institution, like bus arrivals or fee reminders.
Provide real-time transport tracking for safety and transparency.
Analyse usage trends and comply with legal obligations.
Children's Data
ValleyX is designed for use by schools and processes information relating to students who may be minors. We take extra care here, consistent with India's Digital Personal Data Protection Act, 2023 ("DPDPA").
Student accounts and data are created and managed by the Institution or a parent/guardian, not directly by the child. We do not knowingly allow children to create independent accounts without Institution or parental involvement. Where our processing of a child's personal data relies on consent, we treat the Institution's enrolment process, or a parent/guardian's action within the Services, as the point at which that consent is obtained and recorded on our behalf, consistent with the Institution's own policies and applicable law.
We do not undertake behavioural monitoring or tracking of children, and we do not serve targeted or behavioural advertising directed at children, in line with the DPDPA. We limit student data collection to what is necessary for educational and administrative purposes, and do not use student data to build advertising profiles.
Parents and guardians may contact their Institution to review, correct, or request deletion of their child's information. If an Institution is unresponsive, parents or guardians may also contact us directly at the details in Section 14, and we will coordinate with the Institution as needed.
Location Data & Bus Tracking
The ValleyX Driver app collects precise GPS location only while a trip is active — never in the background outside a route.
Location is shared with the Institution and with parents/staff of students on that specific route for live bus tracking. Trip logs may be retained for a limited period for safety audits and dispute resolution, as configured by the Institution. Drivers can see in-app whenever tracking is active. Drivers who use the ValleyX Driver app directly must be at least 18 years of age, consistent with Institution employment policies.
Payment Information
Fee payments are processed via third-party, PCI-DSS compliant payment gateways. ValleyX does not store full card numbers, CVVs, or full bank account credentials. We retain limited transaction metadata — amount, date, status, and last 4 digits where provided by the gateway — for receipts, reconciliation, and dispute handling.
Cookies & Tracking Technologies
Our website and Services use a limited set of cookies and similar technologies. We do not use these to build advertising profiles of children.
Required for login sessions, security, and basic site functionality. These cannot be disabled.
Help us understand aggregate usage patterns so we can improve the Services. Used on our marketing website, not inside student-facing app screens.
Device and app identifiers (such as FCM tokens) used solely to deliver notices described in Section 02.
Where required, you can manage cookie preferences through your browser settings. Disabling essential cookies may affect your ability to use parts of the Services.
Biometric Data
Some Institutions use biometric devices (such as fingerprint scanners) for staff attendance. We treat this as sensitive personal data and handle it with additional safeguards.
We do not collect biometric data unless an Institution specifically enables this feature and connects its own compatible biometric devices (such as ZKTeco readers) through the ValleyX Biometric Agent.
Where enabled, the device converts a fingerprint into a mathematical template; ValleyX stores this template and associated attendance timestamps, not a reconstructable image of the fingerprint itself.
Institutions enabling biometric attendance are responsible for obtaining any consent required from staff under applicable law before enrolling them. Biometric data is used solely for attendance verification and is not shared outside the Institution's ValleyX account.
How We Share Information
We never share student or staff data with advertisers or data brokers. We only share with:
The primary relationship through which most data flows.
Cloud hosting, SMS/push, and payment gateways, under confidentiality obligations.
Only as intended by platform features, like a teacher viewing their class.
Where required by law, court order, or to protect safety.
Data Retention
We retain personal information for as long as the Institution's subscription is active and as necessary to provide the Services. Following termination, School Data may be retained for a limited transition period to allow authorised export and closure, after which it is deleted or anonymised in accordance with the applicable agreement, unless longer retention is legally required or otherwise permitted. Driver app trip logs and staff biometric templates are kept only as long as necessary for safety, operational, dispute-resolution, or other legitimate purposes, and are deleted or anonymised once that purpose has been served.
Your Rights & Account Management
Depending on your role and applicable law, including the DPDPA, you may have rights relating to your personal information, including access, correction, and deletion, subject to applicable legal, contractual, and Institution requirements.
Request access to personal information held about you or your child, subject to applicable requirements.
Ask for inaccurate or incomplete information to be corrected.
Where applicable, request deletion of information through your Institution or the authorised ValleyX administrator managing your account.
Where processing is based on consent, request withdrawal of that consent, subject to applicable limitations.
ValleyX does not provide self-service account registration through its mobile applications. User accounts are created, provisioned, and managed by the subscribing Institution or by authorised ValleyX administrators. Users cannot independently create a ValleyX account through the Services.
If an account or associated personal information needs to be deleted, disabled, or corrected, the request should generally be made to the School that manages the account. The School may request ValleyX to delete or modify the relevant account or data through its administrative systems. ValleyX may also delete or disable accounts through its backend administration where authorised or required. Information may be retained where required for legal, security, fraud-prevention, dispute-resolution, or other legitimate purposes.
Where ValleyX processes information on behalf of an Institution, requests relating to School-managed records may need to be handled by the Institution as the party responsible for those records.
Grievance Officer
In accordance with the DPDPA and applicable Indian law, we have appointed a Grievance Officer to address questions or complaints about how we handle personal information.
Grievance Officer: Faizan Shabir
Email: grievance@valleyx.in
Response time: We aim to acknowledge grievances within 48 hours and resolve them within 30 days, or as otherwise required by applicable law.
Data Breach Notification
If we become aware of a personal data breach affecting an Institution's data, we will notify the affected Institution without undue delay, and in any event within 72 hours of becoming aware of the breach, along with information reasonably available to help the Institution meet its own notification obligations under applicable law, including to the Data Protection Board of India and affected individuals where required.
International Data
ValleyX primarily hosts and processes data on infrastructure located in India. We may use service providers that host or process information in other countries, for functions such as cloud backup, SMS/push delivery, or payment processing. Where this occurs, we take appropriate contractual, technical, and organisational measures consistent with applicable data protection requirements, and we will update this section to name specific countries or regions if our processing locations materially change.
Your school's data deserves serious protection.
We take appropriate technical and organisational measures to protect sensitive information, including encryption of data in transit, role-based access controls, and regular security reviews — and we continuously work to maintain the security and reliability of the ValleyX platform.
No system is 100% secure. Please protect your login credentials and report any suspected unauthorised access immediately.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify Institutions of material changes by email and by posting an in-app notice, and will update the date above. Continued use of the Services after changes take effect means you accept the revised policy.
Questions about your privacy?
We're happy to clarify how ValleyX handles your information.
Privacy enquiries: privacy@valleyx.in · Grievances: grievance@valleyx.in
Contact ValleyX →