Legal

Privacy Policy

Last updated: 14 September 2026

In short: we hold the information your school needs to reach you — your name, contact details, and what you've responded to. If your school uses fee payments, bus tracking, or student pickup, we've explained exactly what those add in sections 2 and 3. We don't sell anything to anyone, and we don't advertise.

1. Who we are

KoalaCast is a Software-as-a-Service platform that enables organisations — including schools, housing societies, and offices — to communicate with their members, collect responses and payments, and manage day-to-day operations. KoalaCast is operated by KoalaCast Pvt Ltd, registered in India.

When we say "KoalaCast", "we", "us", or "our" in this policy, we mean the company operating this service. When we say "you", we mean any person using our platform, whether as an administrator, moderator, or member.

Your organisation decides what information to put into KoalaCast and who can see it. We hold that information on their behalf. If you have a question about why your school holds a particular detail about you, they are the right people to ask — and we'll always help them answer.

2. What data we collect

Everyone

Account information: Your name, email address, and phone number when you are added to a KoalaCast workspace.
Organisational data: Workspace name, channel names, and any custom contact fields your organisation administrator configures.
Announcement content: The text, images, and attachments included in announcements and forms.
Responses: When you mark something as read, acknowledge it, answer a form or survey, or vote in a poll.
Messages: If your organisation enables direct messaging, the messages you send and receive.
Profile photo: If you or your administrator uploads one.

If your organisation uses fee payments

Payment records: The amount, date, receipt number, and the reference number returned by the payment provider.
Offline payments: If your school records a cash or cheque payment, the method and any reference note they enter.

We never see or store your card number, CVV, UPI ID, or bank details. Those go directly to Razorpay and never reach our systems.

If your organisation uses student pickup passes

Collector details: The name, relationship, and phone number of the person you authorise to collect your child.
Collector photo: A photo you upload so the guard can confirm who is at the gate.
Collection record: The time your child was released, who verified it, and — if the PIN was overridden — the reason the guard gave.

If your organisation uses bus tracking

Bus location: The vehicle's position while a trip is running. This is the bus, not a person.
Your home area, only if you choose to set it: An approximate point, accurate to about 100 metres, used to tell you how long until the bus reaches you. We store coordinates, never an address.
Bus rosters: Which vehicle a student travels on, and in which direction.

Setting a home location is entirely optional, and you can remove it at any time from the bus tracking page. Your school and the driver cannot see it. See section 3 for how bus location is shared.

Data we collect automatically

Usage data: Which announcements you opened, when, and how many times.
Device and browser information: Your browser type, operating system, and IP address when you access the platform.
Last active timestamp: The last time you accessed your workspace.
Push notification tokens: If you enable notifications, an anonymous identifier issued by your device's operating system so we can deliver them.

Data we do not collect

Card numbers, CVV codes, bank account details, or UPI IDs.
Biometric data or government ID numbers.
Continuous location of any individual. We never track where a parent, student, or staff member is.

Your organisation can create custom fields and forms, so it's possible for them to ask for information we haven't listed here. What they ask for, and why, is their decision — we simply store it securely on their behalf.

3. How location works, in plain terms

Location is the most sensitive thing on this platform, so it's worth being precise about it rather than leaving it inside a longer list.

The bus

A bus only reports its position while a driver has an active trip running. When the trip ends, the live position is deleted, not merely hidden.
Only families whose child is on that bus, for that direction of travel, can see it. A parent whose child takes a different bus in the morning cannot watch that bus's morning run.
Your school's administrators can see route history for up to 30 days, for operational and safety purposes. After that it is deleted automatically.

Your home area

Only stored if you choose to set it, and only ever used to calculate how far away the bus is.
Deliberately imprecise — rounded to roughly 100 metres, so it identifies a neighbourhood rather than a building.
Stored as coordinates. We never hold a postal address for this purpose.
Readable only by you. Not by your school, not by the driver, and it does not appear in any export.
Removable by you at any time, with one tap and no explanation needed.

We do not track the location of any person. The bus reports where the vehicle is; nothing reports where you are.

4. How we use your data

To provide the service: Delivering announcements to the right recipients, tracking viewership, maintaining acknowledgement records, processing form responses, and running whichever modules your organisation has enabled.
To send notifications: Login links, invitations, announcements, payment receipts, pickup confirmations, and bus alerts — by email, in-app, or push, depending on your organisation's settings.
To maintain security: Detecting unauthorised access, preventing abuse, and keeping audit logs of administrative actions.
To improve the platform: Understanding which features are used most, so we know what to build next.
To process payments: Passing the necessary details to Razorpay so a payment can be completed and reconciled.

We do not sell your personal data to third parties. We do not use your data for advertising. We do not use it to train AI models.

5. Legal basis for processing (GDPR)

If you are located in the European Economic Area, we process your personal data under the following legal bases:

Contract: Processing necessary to provide the KoalaCast service you or your organisation has subscribed to.
Legitimate interests: Maintaining security, preventing fraud, and improving the platform.
Consent: For optional features you switch on yourself — setting a home location for bus ETAs, and enabling push notifications. Both can be withdrawn at any time.
Legal obligation: Retaining payment records as required by Indian accounting regulations.

6. Data sharing and third parties

We share data with the following service providers, each bound by their own privacy policies. We share only what each one needs to do its job.

Provider	Purpose	Data shared
Supabase	Database, authentication, and file storage	All workspace and user data
Vercel	Application hosting	Server logs, IP addresses
Resend	Email delivery	Name, email address, message content
Razorpay	Payment processing	Billing name, email, payment amount
Cloudinary	Image hosting and optimisation	Photos uploaded to the platform
Google Maps	Displaying the map on bus tracking	Bus coordinates and your IP address, only while you view the map
Apple / Google push services	Delivering push notifications	An anonymous device token and the notification text

We do not share your data with any other third parties without your explicit consent, except where required by law.

7. Data retention

Active workspaces: We retain data for as long as your organisation's workspace is active.
Live bus position: Deleted the moment a trip ends.
Bus route history: 30 days, then deleted automatically.
Pickup passes: Retained as a collection record so a school can answer questions about who collected whom.
Audit logs: 12 months, for security and compliance.
Payment records: 7 years, as required by Indian accounting regulations.
Cancelled accounts: 30 days after cancellation, during which an export can be requested. After that, permanently deleted — except payment records, which we are legally required to keep.

8. Data security

All data is encrypted in transit using TLS 1.2 or higher.
Database access is controlled by Row Level Security — each organisation's data is isolated at the database level, not just in application code. The same applies within an organisation: a parent can only reach their own child's records.
Administrative operations use a service key that is never exposed to the browser.
Payment gateway credentials belonging to your school are encrypted at rest and are never returned to a browser.
Passwords, where used, are hashed by Supabase Auth. We cannot see or recover them. Magic link sign-in is also available and uses no password at all.
Supabase infrastructure is hosted on AWS with SOC 2 Type II compliance.

9. Your rights

You have the following rights regarding your personal data:

Access: Request a copy of all personal data we hold about you.
Correction: Request correction of inaccurate personal data.
Deletion: Request deletion of your personal data, subject to legal retention requirements.
Portability: Request your data in a machine-readable format.
Objection: Object to processing based on legitimate interests.
Withdraw consent: Remove your home location or turn off push notifications yourself, at any time, from within the app.

Because your organisation controls its own workspace, some requests are quickest through them — they can correct your details or remove you directly. For anything else, contact us at hello@koalacast.io and we will respond within 30 days.

10. Cookies

KoalaCast uses only functional cookies necessary for the service to operate. See our Cookie Policy for details. We do not use advertising or tracking cookies.

11. Children's privacy

KoalaCast is provided to organisations, and accounts are created by their administrators — not by children signing up themselves. In a school, an account usually represents a student, and it is a parent or guardian who uses it.

Some features hold information about a child: which bus they travel on, who is authorised to collect them, and what has been paid on their behalf. This is the information a school needs to keep a child safe, and it is held under the school's control and instruction.

We do not knowingly collect personal data directly from children under 13 without consent obtained through the school. If you believe we have, contact us at hello@koalacast.io and we will remove it.

12. Changes to this policy

We will notify workspace administrators by email at least 14 days before making material changes to this privacy policy. Continued use of the platform after that date constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions or to exercise your rights:

Email: hello@koalacast.io
Subject line: Privacy Request — [Your Name]