Privacy Policy

1. Who we are and what this policy covers

River Sand Labs Private Limited
Operator of LightUp Education
No. 25, 2nd Floor, Montieth Mansion, Montieth Road,
Egmore, Chennai, Tamil Nadu, India – 600 008
Privacy and support email: admin@riversandlabs.com

This policy describes how LightUp Education handles personal information through its iOS and Android app, the school portals displayed inside the app, and related account, notification, payment and support services. Features available to you depend on your school and your role.

We onboard a school after entering into an agreement with it. School administrators create or authorize staff, teacher, parent, guardian and student accounts and distribute credentials through the portal. Access is for an authorized school community; it is not an unrestricted public social network.

2. The school’s responsibilities and ours

Your school determines why school records are collected, which school features are enabled, who is authorized to see them and how long its records must be kept. We generally provide and operate the platform on its behalf. We also handle information necessary for platform security, device registration, support and service administration.

The school’s own privacy notice and applicable agreement may provide further details about school-specific processing. Contact your school first for questions about admission records, attendance, grades, fees, safeguarding records or a child’s authorized contacts. Contact us for questions about the platform or assistance identifying the responsible school. We coordinate requests as appropriate; the school arrangement does not remove your rights under applicable law.

3. Information we handle

Information may be entered by you, uploaded by an authorized school user, generated when you use a feature, or supplied by a service provider. We handle the following categories where relevant:

Account and identity: name, school association, role, user identifiers, email, phone number, login/session information, authentication and account-security records.
Student and family records: admission number, date of birth, class, section, parent/guardian relationships, addresses, emergency contacts, photographs, application details and supporting documents.
Education and school activity: attendance, timetables, assignments, submissions, examination results, school communications, library and activity records.
Sensitive school information: health, allergy, support needs or identity documentation where requested and recorded by the school for an appropriate school purpose. These fields are not needed by every school or every user.
Employment and administrative records: staff profiles, attendance, leave, payroll and related bank/tax information, where your school uses these modules and your role permits access.
Financial records: fee schedules, concessions, amounts, currency, invoices, transaction identifiers, payment status, receipts, refunds and bank-transfer references or proofs submitted for reconciliation.
Communications and uploads: messages, group membership, announcements, documents, photographs and other content sent or uploaded through enabled features.
Transport and location: routes, pickup points, bus enrollment, trip attendance, authorized handover records, staff attendance location and bus/crew location during location-enabled activities.
Device and technical information: installation identifier, notification tokens, operating-system platform, school-device associations, IP address, connection/request information, timestamps and service/security logs. The mobile app maintains a central notification-device registration that can be linked to more than one authorized school.

4. Why information is used

Authenticate users, provide school-authorized access, manage account security and prevent abuse.
Deliver education, administration, attendance, transport and communication features selected by the school.
Process and reconcile school fees, concessions, receipts and refunds.
Deliver transactional email and push notifications, including account credentials and school notices.
Respond to support and privacy requests, investigate incidents and maintain the service.
Provide enabled AI-assisted features as described below.
Maintain records required by applicable obligations and exercise or defend legal rights.

The applicable lawful basis depends on the information, purpose and jurisdiction, such as a school’s statutory duty, a relevant agreement, valid consent or another basis permitted by applicable law. Sensitive information and children’s information require the additional safeguards and authorizations applicable to them. Your school can explain its basis for school-record processing; accepting general app terms is not blanket consent for every use.

We use personal information for these service purposes. We do not sell or rent personal information or use school information for targeted advertising or unrelated commercial profiling.

5. Device permissions and your choices

Permission or capability	School-related purpose	Your choice
Camera and selected photos/files	Photographs, document uploads, attachments and supported scanning features.	Choose what to upload; camera access can be changed in device settings.
Microphone	Only a feature that records or uploads audio, if available in your school’s version.	You may refuse or revoke microphone permission. A permission declaration alone does not mean the app continuously records audio.
Location	Location-enabled attendance and transport features, such as staff check-in and bus/crew tracking during a trip.	Location access can be refused or changed in device settings; the affected feature may then be unavailable or require a school-approved alternative.
Notifications	School messages, reminders and service notifications.	Notification permission and available school notification channels can be managed in device settings.

Location collection is linked to the selected school feature. Viewing a bus location does not itself require collecting a parent’s or child’s phone location. The LightUp Education mobile app requests while-in-use location access; it does not declare an always-on background-location entitlement. A separately configured crew application that supports background trip tracking requires a feature-specific explanation and the corresponding device permission before that mode is used.

You can stop using a permission-dependent feature and revoke the relevant device permission. Revoking permission stops future access permitted by that setting; it does not automatically delete records already submitted to the school. We do not need access to your entire phone address book to display school portal contacts.

6. Students and children’s information

Student access and records are part of a school-managed service. Schools and authorized parents/guardians are responsible for providing the authorizations and notices needed for a child’s participation under applicable law. We do not treat a child’s use of the app as authorization for unrelated processing.

A parent or guardian may contact the school to review or correct their child’s records, understand consent choices or request deletion/restriction where available. A school may need to verify parental authority or custody restrictions. School-authorized relationships and role permissions determine access; having a similar surname or email address is not authorization to view a student’s information.

School records must not be used for targeted advertising or sold for commercial profiling. Do not enter unnecessary sensitive information about a child. Notify the school and us if an account or record appears to be associated with the wrong child or school.

8. AI-assisted features

When enabled, AI can assist with school searches, drafting, translation, document extraction, learning materials or operational questions. Queries, selected context, documents or draft text supplied to an AI feature may be sent to the configured AI provider. Depending on the feature, that content can contain personal information you or an authorized school user include.

AI processing involves third-party services such as OpenAI or Google Gemini; it is not necessarily performed only on your phone. Do not submit passwords, authentication codes, payment-card details or unnecessary sensitive student information in prompts or documents.

AI responses can be incorrect. School personnel must review important results; generated text does not establish a student’s entitlement, fee liability, legal right or educational outcome. Provider retention and processing depend on the specific service and contractual configuration. This policy makes no blanket claim that all AI data is never retained or never used for training.

Contact the school or us about the AI features enabled for your school, the information they use and available restrictions. Permission to use ordinary school services is not blanket permission for undisclosed third-party AI sharing.

9. Payments, receipts and refunds

The school determines its fees, currency, concessions and refund policy. Stripe or Razorpay handles the payment credentials supplied in its checkout or payment interface. Our service receives information needed to verify and reconcile payments, including references, amounts, currency, status and receipts; it is not intended to store full card numbers or card security codes on application servers.

Offline payment and refund reconciliation may include transfer references and proof documents. Upload only the evidence requested, and redact unrelated transactions or unnecessary bank details. A refund may require school approval and provider processing. The school may retain financial records after portal access ends to meet accounting, audit or legal obligations.

10. Storage, transfers and security

School information may be stored in school-specific cloud databases and storage, processed on application servers, cached for service performance and recorded in operational logs. Central platform services also handle limited account, school-routing and notification-device information. Hosting and service-provider processing locations may differ from your country and your school’s country.

Applicable school agreements and transfer arrangements govern processing locations and protections. We do not promise that all information remains in Canada, India or any other single country unless that is specifically agreed and technically configured.

Access controls, authentication, school/role checks and HTTPS connections are used to protect the service. Account security can include required password changes and authenticator codes. These measures reduce risk but cannot guarantee that every system or transmission is secure. School chat is not represented as end-to-end encrypted.

11. How long information is kept

Retention depends on the type of record, school instructions, the school agreement, the purpose for which it was collected, applicable recordkeeping obligations and any ongoing dispute or security investigation.

Education, admission and staff records: retained under the school’s applicable record-retention schedule and service agreement.
Financial records: retained for the school’s accounting, audit, tax and dispute requirements.
Messages, uploads, attendance and transport records: retained according to their school purpose and configured retention rules; detailed location history may have a different retention period from summarized trip records.
Account and notification-device records: retained while necessary for authorized access, delivery, security and handling closure requests.
Security logs and backups: retained for operational, recovery and legal needs. Deleted information may remain in protected backups until those backups expire or are replaced under the applicable backup cycle.

There is no single universal retention period for every school record. Ask your school or our privacy contact for the schedule applicable to your information. Closing portal access, uninstalling the app or removing a school from the app does not by itself erase legally retained school records.

12. Access, correction, deletion and consent choices

Depending on applicable law and your relationship to the information, you may request access, correction, a copy, deletion, restriction or other available privacy rights, and withdraw consent for processing that relies on it. Some information may need to be retained or processing continued for another lawful purpose. We will explain an applicable restriction rather than treating every school record as exempt from deletion.

Visit Your Privacy Choices for request options and permission instructions. Send a request to your school or the privacy email in this policy. Identify the school and account involved and what you are requesting; do not send passwords or authenticator codes. We may verify identity, authority to act for a child and the scope of the request. We coordinate with the school and respond within the period required by applicable law.

Account closure and deletion: you may request deletion of your login account and personal information that no longer needs to be retained. Financial, statutory education or safeguarding records may require separate retention even after login access is removed. Requesting deletion is distinct from simply deactivating an account. Contact us if the school is unavailable or you need assistance.

You can manage device permissions and notifications in device settings. Removing a school from the mobile app detaches that school from the installation where supported; it is not a request to delete the school’s student or financial records.

13. Local storage, links and notifications

The mobile app and its school web views use local preferences, session storage/cookies and cached files to remember selected schools, keep authenticated sessions and support the interface. The central notification service uses an installation identity and push token to deliver messages to the appropriate school account/device.

Notification previews may be visible on a locked or shared device. Adjust device notification settings if you do not want school message previews displayed. Sign out when using a shared device. External payment pages, school content or links may have their own privacy practices; review them before providing information.

14. Changes and contact

We may update this policy to reflect service or legal changes. The published version will identify its effective date. Material changes will be communicated through an appropriate app, portal, school or other available channel where required. A policy update does not replace any permission or consent required for a new processing purpose.