Privacy Policy — HALO Schools

This Privacy Policy explains how personal data is handled in the HALO Schools mobile apps:

HALO Parent & Student (Android app com.myhaloschools.family), for students and for parents or guardians; and
HALO Teacher & Staff (Android app com.myhaloschools.staff), for a school's teaching and non-teaching staff.

HALO Schools is a school management product provided by SPS TECH SERVICES PRIVATE LIMITED ("we", "us", "our"), registered office: D.No: 19-786/1, P.No: 16, Koduru St, Murali Nagar, Kanuru, Vijayawada (Rural), Krishna, Andhra Pradesh - 520007, India.

Words used in this policy follow India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"): a Data Principal is the person the data is about, a Data Fiduciary decides why and how personal data is used, and a Data Processor handles personal data on a Data Fiduciary's behalf.

1. Who is responsible for your data

The apps are used by schools that subscribe to HALO Schools.

Your school (or educational institution) is the Data Fiduciary for the records it keeps about its students, parents, teachers and staff — for example admission, class, attendance, timetable, homework, leave, fees, results and payroll records. The school creates your account and decides what it records about you or your child.
We act as the school's Data Processor for those records. We store and process them only to provide HALO Schools to the school, on the school's instructions.
We are an independent Data Fiduciary only for the limited data we use for our own purposes: administering school accounts, billing, running and securing the service (for example sign-in and security logs), answering support requests, and meeting our legal and compliance obligations.

For questions about the records your school keeps, please contact your school first. You can also contact us at any time (section 13).

2. Your account and signing in

Accounts are created by your school. You cannot create an account in the apps. The school sends a set-up link to the email address it has on record.
To sign in you enter your email address or mobile number and your password. The password travels over an encrypted connection and our server stores only a one-way hash of it. The apps never store your password.
When you sign in, our server records a sign-in session for that app with a fixed label naming the app ("HALO Parent & Student" or "HALO Teacher"). The apps do not send any device identifier.
A session ends when you sign out. It also ends automatically after 30 days without use, and in any case 90 days after you signed in.
On your phone the apps keep only the session tokens, encrypted with a key held in the Android Keystore, and exclude them from device backups and transfers.
Our security logs may record the time and network (IP) address of sign-ins and important changes.

3. What the apps show and what they send

The apps display information your school has recorded. They send to our server only what you enter or choose.

HALO Parent & Student

Your name, email address, mobile number and profile photo, and — for a parent — those of the children the school has linked to you.
School information: class and section, subjects, timetable, homework, results and report cards, learning resources, notices and attendance.
Fees: amounts due, payment status and receipts recorded by the school. There is no online payment in the app.
Leave: a student can apply for leave for themselves, and a parent for a linked child, with a reason. You may attach one document (see section 4). The form suggests a medical certificate, so a document you attach may contain health information.
Transport: where the school provides it, the bus route and the school vehicle's location. The app never uses your own location.

HALO Teacher & Staff

Your own name, email address, mobile number, profile photo and employee details, and your payslips.
For the classes you teach: students' names, admission or roll numbers and attendance. You can record attendance for those students.
Homework you create for your classes (title, instructions, due date, points and an optional file). Once published, it is shown to the students of that class and their parents.
Your own leave requests, with a reason and an optional document. A document you attach (for example a medical certificate) may contain health information.
Your signed-in devices, which you can sign out from the app.

4. Documents you attach

Attachments are optional. You choose each file yourself in the Android file picker. The apps do not ask for permission to read your storage and cannot see any other file.
Only one PDF, JPG or PNG file of up to 5 MB can be attached. The app checks the file's type, size and content on your phone before anything is sent.
When you open a document from the app (for example a fee receipt, report card or payslip), the app keeps one copy in its private storage so that your phone's viewer can show it, and replaces it when you open the next one. Learning resources open as links in your web browser.

5. What the apps do not do

No advertising, and no advertising, analytics or crash-reporting software.
No use of the Android advertising ID.
No access to your location, contacts, camera, microphone, call log or files. The only Android permission the apps use is internet access.
No in-app chat, and no public sharing of content.
No push notifications. School notices are shown inside the apps.
We do not sell personal data.

6. How personal data is used

Only to provide HALO Schools to your school and to you:

to sign you in and keep your account secure;
to show you your own information, or your child's;
to carry out what you ask for, such as a leave request, attendance or homework;
to send you service emails, such as your account set-up link or a password reset;
to keep the service working, secure and auditable, and to meet our legal obligations.

7. Who can see your data

Your school, through HALO Schools, according to the roles and permissions the school sets. For example, a teacher sees student information only for the classes they teach, and a parent sees only the children linked to them.
Service providers we use to run HALO Schools, only as needed to provide it: Hostinger (hosting and data storage, in India) and Brevo (delivery of service emails). They act on our instructions.
Authorities, where the law requires us to disclose data.

We do not share personal data with anyone for their own marketing or advertising.

8. Security

All traffic between the apps and HALO Schools is encrypted (HTTPS only).
Each school's data is kept separate from every other school's at the database level.
Access inside a school depends on each person's role.
Sign-in sessions on your phone are protected with the Android Keystore.

No system is completely secure. If a personal data breach affects school records, we inform your school without delay so that it can notify you and the Data Protection Board of India as the DPDP Act requires, and we help it do so. For data we hold as a Data Fiduciary, we notify you and the Board ourselves.

9. How long data is kept

While your school uses HALO Schools, its records are kept for as long as the subscription continues and as needed to provide HALO Schools. The school decides when to remove records.
After a school's subscription ends, the school has up to 90 days to export its data or ask us for it. Within the following 90 days we delete or anonymise that school's data, except records we must keep for legal, accounting or security reasons.
Security and audit logs are kept for up to 1 year where this is necessary for security or to meet legal obligations.
Backups expire or are overwritten within 35 days under our normal backup rotation.
On your phone, the session tokens are removed when you sign out or uninstall the app.

10. Your rights and choices

Under the DPDP Act you may ask to access, correct, complete or erase your personal data, nominate another person to exercise your rights, and raise a grievance.

See or correct your information: most records are kept by your school, so please ask your school first. You can view your own details in the app.
Sign out: you can sign out at any time. In HALO Teacher & Staff you can also sign out your other devices.
Delete your account or data: see section 11.

We aim to respond to a request within 30 days, after confirming your identity and subject to any exceptions the law allows.

11. How to ask for your account or data to be deleted

There is no self-service deletion in the apps. To make a request:

Email your school, or email us at info@myhaloschools.com with the subject "Data request". Please include your name, your school, the email address or mobile number you sign in with, and what you would like deleted.
We verify your identity, for example by replying to the email address or mobile number your school has on record.
We check whether the data is held for your school. For school records, we act on your school's approval or instruction, because the school is responsible for those records and may be required by law to keep some of them.
We delete or anonymise the data that can be removed, and keep only records that must be retained for legal or security reasons.
We tell you what was done, or why something could not be deleted.

12. Children and students

HALO Parent & Student is used by students from Class 1 to Class 10, including children under 13 and other minors. Under the DPDP Act everyone under 18 is a child.

Student accounts are created by the school. The school or educational institution is responsible for obtaining any parent or guardian consent or authorisation that the law requires before it gives a student access to HALO Schools.
A student sees only their own records. A parent sees only the records of the children the school has linked to them. A teacher sees student information only for the classes they teach.
The apps have no advertising, no targeted advertising, no use of the Android advertising ID, no behavioural tracking or monitoring, no chat and no contact with strangers.

13. Contact and grievances

SPS TECH SERVICES PRIVATE LIMITED — HALO Schools
D.No: 19-786/1, P.No: 16,
Koduru St, Murali Nagar, Kanuru,
Vijayawada (Rural), Krishna,
Andhra Pradesh - 520007, India

Privacy questions and data requests: info@myhaloschools.com

Grievances: SPS TECH SERVICES PRIVATE LIMITED, info@myhaloschools.com

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Changes to this policy

We publish any new version of this policy on this page with a new effective date. If a change materially affects how personal data is handled, we will email the administrators of the schools that use HALO Schools at least 30 days before it takes effect where practicable, so that they can inform their students, parents and staff.