Privacy Policy

1. Who We Are

BellZy is a product developed and operated by AbledYou, a company incorporated in India. In this Privacy Policy, "BellZy," "we," "our," and "us" refer to AbledYou.

We act as the Data Fiduciary under India's Digital Personal Data Protection (DPDP) Act, 2023, meaning we determine the purpose and means of processing personal data collected through the BellZy platform.

For any privacy-related inquiry, contact us at: privacy@bellzy.in

2. Data We Collect

We only collect data that is necessary to provide the BellZy service. We follow a principle of data minimisation — if we don't need it, we don't collect it.

2.1 Data you provide directly

Data Type	Examples	Who provides it
Account information	Name, email address, phone number, designation	School administrator during sign-up
School details	School name, address, UDISE code, board affiliation	School administrator
Staff profiles	Teacher names, phone numbers, subject/class assignments	Administrator when onboarding staff
Communication content	Announcements, notices, and messages sent via BellZy	Users (principals, admins)
Payment information	Billing name, GST number; card/bank details handled by our payment processor	Administrator during subscription

2.2 Data collected automatically

Data Type	Examples
Usage data	Pages visited, features used, timestamps, button clicks
Device & browser data	IP address, device type, OS version, browser type
Notification metadata	Message delivery status, read receipts, timestamp of acknowledgement
Log data	Error logs, API request logs, session identifiers

We do not collect sensitive personal data such as biometrics, health records, financial credentials, or caste/religion information.

3. How We Use Your Data

We process personal data only for the following lawful purposes:

• Service delivery — To operate the BellZy platform: routing notifications, generating read receipts, managing staff rosters, and delivering scheduled announcements.
• Account management — To create and maintain user accounts, authenticate logins, and manage subscriptions.
• Product improvement — To analyse usage patterns (in aggregate, anonymised form) so we can fix bugs and build better features.
• Customer support — To respond to queries, troubleshoot issues, and provide onboarding assistance.
• Security & fraud prevention — To detect and prevent unauthorised access, abuse, and security incidents.
• Legal compliance — To comply with applicable Indian laws, court orders, and regulatory requirements.
• Billing & invoicing — To process payments, issue GST-compliant invoices, and manage subscription renewals.

We do not use your data for behavioural advertising or sell your data to third parties. Ever.

4. Sharing & Disclosure

We do not sell, rent, or trade personal data. We may share data in the following limited circumstances:

4.1 Service providers (sub-processors)

We use trusted third-party vendors who process data on our behalf and under strict data processing agreements:

• Cloud infrastructure — Data is hosted on AWS (Mumbai region, ap-south-1) and remains within India.
• Push notifications — Firebase Cloud Messaging (Google LLC) delivers in-app push notifications. Only a device token and message content are shared.
• SMS gateway — An India-based SMS provider for OTP and fallback alerts. Only the recipient's phone number and message content are shared.
• Payment processing — Razorpay (for Indian schools) processes payment card data under PCI-DSS compliance. We do not store card details.
• Analytics — We use privacy-preserving analytics (no cross-site tracking, no user fingerprinting).

4.2 Legal requirements

We may disclose data when required by a valid legal process — a court order, summons, or demand from a competent Indian authority — provided we are legally permitted to notify you before disclosure.

4.3 Business transfers

If AbledYou is acquired or merges with another entity, personal data may be transferred to the successor. We will notify affected users via email at least 30 days in advance and ensure the new entity honours this policy.

4.4 With your consent

We may share data for any other purpose with your explicit, informed consent.

5. Data Retention

We retain personal data only as long as necessary for the purposes described above or as required by law.

Data	Retention Period
Account & staff profile data	Duration of active subscription + 90 days after termination
Message content & notification history	12 months from the date of the message
Read receipt metadata	12 months
Billing records	7 years (as required by the Income Tax Act, 1961)
Security & access logs	90 days
Anonymised analytics	Indefinitely (no personal data retained)

Upon account deletion, we will erase or anonymise personal data within 30 days, except where retention is required by law.

6. Security

We implement technical and organisational measures appropriate to the risk level of the data we process:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256.
• Access to production systems is restricted to authorised personnel via multi-factor authentication and role-based access controls.
• We conduct periodic security reviews and vulnerability assessments.
• Our cloud infrastructure is hosted exclusively within India (AWS ap-south-1).

No system is completely secure. If you discover a security vulnerability, please report it responsibly to security@bellzy.in and we will respond within 48 hours.

In the event of a personal data breach that poses a risk to individuals, we will notify the Data Protection Board of India and affected users in accordance with the DPDP Act, 2023.

7. Your Rights

Under the Digital Personal Data Protection Act, 2023, you (as a Data Principal) have the following rights with respect to your personal data:

• Right to access — Request a summary of personal data we hold about you and how it is being processed.
• Right to correction — Request correction of inaccurate or incomplete personal data.
• Right to erasure — Request deletion of your personal data, subject to our legal retention obligations.
• Right to grievance redressal — Raise a complaint with our grievance officer (see Section 11) and receive a response within 48 hours.
• Right to nominate — Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, email privacy@bellzy.in from the address associated with your account. We will verify your identity and respond within 15 business days.

If you are dissatisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is operational.

8. Children's Data

BellZy is designed exclusively for use by adult school staff — principals, vice principals, administrators, and teachers. The platform is not intended for use by students under the age of 18, and we do not knowingly collect personal data from minors.

School administrators are responsible for ensuring that only authorised adult staff members are registered on the BellZy platform. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@bellzy.in and we will delete it promptly.

9. Cookies & Tracking

Our web application uses the following types of cookies:

Type	Purpose	Duration
Essential	Authentication session, CSRF protection, user preferences	Session / 30 days
Analytics	Aggregated usage metrics (no cross-site tracking)	12 months

We do not use advertising cookies or third-party tracking pixels. You may disable non-essential cookies in your browser settings without affecting core functionality.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or our product. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send an email notification to all registered account administrators at least 15 days before the change takes effect.
• Display an in-app banner notifying users of the update.

Continued use of BellZy after the effective date of a revised policy constitutes acceptance of those changes. If you do not agree with the changes, you may terminate your account before the effective date.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

For general product support, contact hello@bellzy.in.

Our registered office address is available upon request for legal correspondence.