Privacy Policy

Bellbox Technologies Private Limited ("Bellbox", "we", "us") operates the Bellbox school management platform. We are headquartered in India and all personal data is stored and processed within India in accordance with the Digital Personal Data Protection Act 2023 ("DPDP Act").

Our Data Protection Officer (DPO) can be reached at dpo@bellbox.co.in. Grievances are acknowledged within 48 hours.

We collect personal data in two capacities:

As a Data Fiduciary (marketing site visitors)

• Name and email address when you fill out a contact or get-started form.
• Device, browser, and usage data via analytics (PostHog, self-hosted in India).
• Cookie preferences stored locally in your browser.

As a Data Processor (school platform users)

• Student profiles: name, date of birth, class, roll number, board, attendance, grades, and homework records — on behalf of the school.
• Parent contact details: name, phone, email, relationship to student.
• Teacher and staff records: name, employee ID, subject, schedule.
• Financial data: fee payments, receipts, UPI AutoPay mandates (processed via Razorpay — no card numbers stored on Bellbox servers).
• Special category data (health notes, counselling records) — encrypted separately, accessed only by authorised staff.

• To provide, maintain, and improve the Services.
• To send transactional notifications (attendance alerts, fee receipts, homework reminders) via WhatsApp, SMS, or email.
• To generate academic reports and analytics for school administrators.
• To process fee payments and issue GST receipts.
• To comply with legal obligations including the DPDP Act 2023, RBI payment regulations, and NEP 2020 reporting requirements.
• To respond to grievances and support requests.

We do not sell, rent, or share personal data with third parties for advertising purposes.

The DPDP Act 2023 requires verifiable parental consent before processing personal data of children (under 18). Schools are responsible for obtaining and recording this consent during student enrolment. Bellbox provides tools in the Admin dashboard to record and manage consent. We do not process student data until the school confirms consent has been obtained.

• All data is stored in AWS ap-south-1 (Mumbai, India).
• Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Aadhaar numbers, PAN, bank details, and counselling notes are envelope-encrypted with a separate KMS key.
• Database access is governed by Row-Level Security (RLS) — each school can only access its own data.
• We maintain a SOC 2 Type II audit programme and conduct annual penetration tests.

• Active school data: retained for the duration of the subscription plus 90 days after termination.
• Financial records: retained for 7 years as required by the Income Tax Act and GST laws.
• Audit logs: retained for 2 years.
• Marketing enquiry data: retained for 12 months or until consent is withdrawn.

As a Data Principal you have the right to:

• Access — request a summary of personal data we hold about you.
• Correction — request correction of inaccurate data.
• Erasure — request deletion of data where there is no legal obligation to retain it.
• Grievance redressal — file a grievance and receive a response within 48 hours.
• Withdraw consent — withdraw consent at any time; we will stop processing non-essential data within 72 hours.
• Nominate — nominate another person to exercise these rights on your behalf.

To exercise any right, write to dpo@bellbox.co.in with subject line "DPDP Rights Request". We will respond within 30 days.

We use the following categories of cookies:

• Essential — session management, CSRF protection. Cannot be declined.
• Analytics — usage patterns via PostHog (self-hosted in India). Declined via the cookie banner.

We do not use third-party advertising cookies.

We share data with sub-processors only as necessary to provide the Services:

• Razorpay / PhonePe — payment processing (India)
• MSG91 — SMS notifications (India)
• Meta / WhatsApp Business API — WhatsApp notifications
• Amazon Web Services — cloud infrastructure (Mumbai region only)
• Resend / AWS SES — transactional email
• Anthropic Claude API — AI features (data is redacted before leaving India)

A full list of sub-processors is available at the link in the footer.

We will notify you of material changes to this policy at least 14 days before they take effect by email and in-app notification. The current version is always available at bellbox.co.in/privacy.

• DPO: dpo@bellbox.co.in
• Security: security@bellbox.co.in
• General: hello@bellbox.co.in