Privacy Policy

1. Introduction

This Privacy Policy explains how Balraj Singh, sole proprietor of KR Edtech Solutions, operating under the brand name “Bamio” (“Bamio”, “we”, “us” or “our”) collects, uses, discloses, stores, transfers, protects and deletes personal data when people use the Bamio mobile application, Bamio School features, bamio.in, related web interfaces and support services (together, the “Services”).

Bamio is a combined education platform. A parent, student, teacher or school administrator may use different role-based parts of the same application or connected web services. The legal role Bamio performs can therefore depend on the feature, the user’s role and who determines the purpose of the processing.

This Policy gives particular attention to children’s privacy. It should be read with the Parent-Friendly Privacy Summary, the Parent & Student Terms of Service and, where a school uses Bamio, the applicable School Services Agreement and Data Processing Addendum (“DPA”).

2. Who this Policy applies to

• Parents and legal guardians who create, approve, manage or support a child profile.
• Children and students who use Bamio under a parent-managed or school-linked account.
• Teachers, principals, administrators and other authorized school staff using school-linked features.
• Schools and educational institutions whose users access Bamio.
• Visitors to bamio.in and people who contact Bamio for support, privacy, grievance, legal or copyright matters.

3. Bamio’s role depends on the processing purpose

3.1 Direct family and student services

For features offered directly to parents and students — for example personal learning profiles, SpeakUp, Spotlight, Voice Diary, My Bag, Quest, study planning and other direct-to-user functionality — Bamio generally determines how those features operate and why personal data is processed for providing, securing and improving the Services.

3.2 School-directed processing

For certain school-controlled records and workflows — such as rosters, class/section assignments, school attendance, marks, school assignments, teacher comments and institution-managed academic records — the school may determine the purpose and instructions for processing. Where Bamio processes such data on the school’s behalf, the School Services Agreement and DPA allocate the parties’ responsibilities and instructions.

3.3 Bamio’s independent operational processing

Even for school-linked users, Bamio may determine and carry out processing needed for its own account administration, security, fraud and abuse prevention, service reliability, support, billing, legal compliance, incident response and enforcement of platform rules. The same data item may therefore be processed for more than one legitimate and disclosed purpose.

5. Parents, children and consent

5.1 Parent-managed child profiles

Bamio is designed for parent or guardian involvement in a child’s use. Where a parent creates or approves a child profile, Bamio may record the parent account, the child profile, the relevant notice and policy version, the consent or approval event, timestamp, and other details needed to evidence the account relationship and permissions.

5.2 Verifiable parental consent where required

Where applicable law requires verifiable parental or guardian consent for a particular processing activity, Bamio will implement the required verification and consent flow before relying on that processing. Bamio may use reliable age/identity details already available to it or other lawful verification methods. Bamio should not require a full identity document where a less intrusive verification method is sufficient.

5.3 School-linked accounts

A school may provide student information and may assign content or academic workflows to a student account. The school is responsible for the notices, permissions and authority it is required to obtain for the school’s own processing. Bamio may also require a direct parent/guardian notice, approval or consent where required by law, app-store policy, Bamio policy or the nature of the feature.

5.4 Withdrawal and changes

A parent or other authorized person may withdraw a permission or consent where withdrawal is legally available. Withdrawal may disable the related feature. For school-controlled academic records, Bamio may need to coordinate with the school because the school may retain the record independently or have its own legal or administrative retention duties.

India’s Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 are being brought into force on a staggered timetable. Bamio intends to update operational consent and notice flows as the applicable provisions commence.

6. Information we collect

6.1 Parent or guardian information

• Name, email address, optional phone number, country or region, account credentials in hashed form, account settings and communication preferences.
• Support messages, privacy requests, grievance correspondence and service communications.
• Relationship or authorization information needed to manage a child account or consent flow.

6.2 Child or student profile information

• Display name, first name or nickname, age or date of birth where required, class/grade, language preferences, avatar and parent-linked identifiers.
• School, class, section, roll/admission/student identifier and teacher assignment where the account is school-linked.

6.3 School records and school-linked information

• School name, class, section, staff assignment, roster and account status.
• Attendance, marks, assessments, assignments, homework, submissions, completion status, scores, teacher feedback, school reports and school-linked usage records where the relevant school feature is enabled.
• Institutional settings, policies, timetable information and administration records associated with the school account.

6.4 Identity or school-verification documents

Where a school chooses to record them, we keep only the last four characters of a student’s Aadhaar or birth-certificate number, and of a teacher’s Aadhaar or PAN. We do not ask for, and our system does not accept, the full number. The last four characters are used only as a record-matching reference; they are not sufficient by themselves to authenticate identity or to reconstruct the full number, and they remain personal data protected under this Policy. The relevant screen or school workflow explains why the information is requested, whether it is mandatory or optional, and who can access it.

6.5 Content created or submitted

• SpeakUp and speech features: voice recordings, audio, transcripts, speech or presentation feedback and related scores.
• Spotlight: video or presentation recordings, audio, transcripts, presentation analysis and related feedback where enabled.
• Voice Diary: diary audio, transcript, diary entry, reflection, summaries and related history.
• My Bag and study uploads: photos, PDFs, handwriting samples, textbook pages, worksheets, notes and other study material.
• Text inputs, questions, answers, chat-style educational interactions, journal entries, tasks and student submissions.
• AI-generated reports, study plans, explanations, summaries, feedback, revision recommendations and parent/teacher reports.

When your child uploads a practice video, photo or PDF, the working copy used for processing is held in secure private cloud storage while it is being processed, with restricted access, encrypted transport and encrypted storage, and is deleted once processing completes. Where a feature keeps a user-visible recording, upload or result for you — for example your practice history — that retained copy follows the retention positions in Section 13. Uploaded files are used only for the analysis you asked for: never for advertising, never for profiling, and never for any other purpose.

6.6 Learning activity and analytics

• Attempts, answers, scores, time spent, session duration, task completion, drill attempts, quest/lesson completion, revision history, study consistency and progress trends.
• Feature interactions and service events used to provide the feature, measure reliability, support the user and improve educational experience.

6.7 Information sent to AI, transcription and vision providers

To generate transcription, OCR/vision assistance, explanations, feedback or educational recommendations, Bamio may send the minimum relevant portion of a prompt, audio, transcript, image, PDF, assignment context, age/grade context, learning level, child display name or session context to an external provider. We aim to avoid sending parent contact details, full date of birth, Aadhaar number, identity documents or unnecessary school identifiers unless the specific workflow genuinely requires them.

6.8 Device, security and technical information

• Device type, operating system, app/browser version, IP address, session identifiers, authentication/security events, crash logs and diagnostic information.
• Push-notification token and notification delivery information where notifications are enabled.
• Necessary web/session information used for authentication, security and service operation. Bamio does not use child advertising identifiers for targeted advertising.

6.9 Payments

If paid subscriptions or services are offered, payment and subscription information may be processed by Apple, Google or another disclosed payment provider. Bamio does not ordinarily receive full payment-card numbers from app-store purchases.

7. How we use information

• Create, authenticate, link and administer parent, student, teacher and school accounts.
• Deliver educational features such as speech transcription, AI feedback, vision/OCR assistance, tutoring, exercises, study planning and progress reports.
• Deliver school assignments and school-controlled content to authorized users and return school-linked submissions or reports.
• Personalize recommendations, revision and practice for the same student using that student’s own learning history.
• Provide reports and progress information to the parent and authorized school users according to the feature and role permissions.
• Send essential account, school, support, reminder, safety and security communications.
• Provide support and respond to privacy, grievance, legal and copyright requests.
• Protect accounts and systems, investigate abuse or unauthorized access, prevent fraud and respond to incidents.
• Meet contractual, app-store, tax, accounting, legal and regulatory requirements.
• Improve service reliability, educational quality and product design using aggregated or de-identified information where reasonably possible.

8. AI, personalization and automated assistance

8.1 AI output is educational assistance

Bamio uses AI-assisted systems for educational explanations, transcription, OCR/vision tasks, feedback, summaries, practice generation, reports and recommendations. AI output may be incomplete, incorrect, unsuitable or outdated and should not be treated as a guaranteed factual, medical, psychological, legal or professional assessment.

8.2 Same-student personalization

Bamio may use a student’s own answers, scores, time spent, attempts, progress history, practice frequency, teacher feedback, AI feedback history and learning patterns to create a personalized learning profile and recommend content for that same student.

8.3 General AI model training

Bamio does not intentionally submit children’s personal data, school content, uploaded files, voice, video, transcripts or prompts to an external AI provider for the purpose of training that provider’s public or general-purpose AI model. Provider terms, retention settings and technical options vary. Bamio reviews available contractual and configuration safeguards and maintains a subprocessor inventory. Where a provider has not given Bamio an individual written assurance, Bamio relies on that provider’s published terms and configures the no-training and retention options the provider makes available.

8.4 No cross-user raw content reuse

Unless separately disclosed and lawfully permitted, Bamio does not use one student’s identifiable raw content or personalized learning profile to make another student’s personalized profile, nor does it provide one school’s confidential content to another school.

8.5 Aggregated or de-identified improvement

Bamio may use aggregated or de-identified statistics to improve reliability, safety, educational quality and product design. Information is not treated as de-identified if Bamio can reasonably link it back to a particular child, parent, teacher or school.

9. School-linked visibility and access

• Authorized teachers may see school-linked submissions, answers, completion status, scores, teacher feedback and reports for students they are authorized to teach or support.
• Authorized school administrators may see school, class, staff and student information according to role permissions and the school’s configured access.
• Parents may see their child’s profile, progress, reports and school-linked activity where the feature makes this available.
• Students should not see another student’s private submission unless a school-controlled feature expressly enables an appropriate classroom activity.
• Private/direct-to-family content is not intended to be visible to the school unless the user submits or shares it through a school-linked feature or another clearly disclosed workflow.
• Bamio uses role-based authorization as the intended control model, maintains authentication and role-based authorization controls, and will investigate and remediate confirmed unauthorized-access defects according to risk and severity.

10. Service providers and subprocessors

Bamio uses external providers to operate the Services. The table below reflects the live production infrastructure as verified on 22 August 2026. A provider may process only the data needed for the service it supplies.

Bamio does not authorize service providers to use personal data for their own advertising or resale. Some providers rely on their own supporting infrastructure — for example, the cloud platforms their services run on. This table and the School DPA’s provider register are kept current as providers change.

11. No child advertising, sale or behavioural targeting

Bamio does not sell children’s personal data. Bamio does not show third-party behavioural advertising to children, does not use child data for targeted advertising, and does not intentionally use advertising identifiers to track children across apps or services for advertising. Parent marketing communications, if any, are directed to the parent and can be opted out where applicable.

We may publish anonymous, combined statistics about how children use Bamio — for example average practice time or typical progress — which never identify any child. We do not use your child’s personal information, work or recordings in our marketing unless you give us separate written permission, which you can withdraw at any time.

12. Children’s safety and sensitive inferences

12.1 Educational performance, not diagnosis

Bamio may measure educational performance indicators such as answers, scores, fluency practice, presentation practice, task completion, attempts, time spent and study consistency. Bamio does not diagnose, treat, screen for or predict mental-health, psychological, psychiatric, medical, developmental, speech-language pathology or learning-disability conditions. Some features describe observable communication behaviours — for example eye contact, speaking pace or visible signs of nervousness during a practice recording — purely as coaching feedback on that performance; these are not clinical assessments and must not be used as one.

12.2 Voice and video are not biometric identification

Bamio may process voice, audio, face images or video as content needed for educational feedback, transcription or presentation analysis; this can include measuring facial, eye and posture geometry on the fly during a practice recording to generate presentation feedback. Bamio does not use that content for facial recognition, voice recognition for identity, biometric authentication or creation of biometric identifiers for identification.

12.3 No open stranger communication by default

Bamio does not create public child profiles or an open stranger-chat/community feature by default. If classroom sharing is introduced, it should be school-controlled, age-appropriate and separately disclosed.

13. Data retention

Bamio uses feature-specific retention rather than one rule for every type of content. The current positions are:

14. Security

Bamio uses technical and organizational measures intended to protect personal data, including secure transport using TLS/HTTPS, authentication, role-based access controls, least-privilege principles, credential hashing, provider security controls, monitoring and incident response appropriate to the stage and risk of the Services. No system is perfectly secure.

High-risk identity and child-content workflows require security controls proportionate to their sensitivity. Government identity numbers are held as their last four characters only (see Section 6.4); the full numbers are not collected and cannot be stored.

If Bamio becomes aware of a personal-data breach, it will assess applicable notification and response duties and will notify affected users, schools, providers or authorities where required.

15. International processing and transfers

Bamio’s primary persistent application database and its managed backups are hosted in Mumbai, India. Certain personal data may nevertheless be processed, transmitted or temporarily stored outside India by the service providers described in this Policy — for example for application hosting, AI-assisted processing, transcription, email delivery or temporary media processing, including in the United States. We use contractual and technical safeguards for that processing, and Bamio will comply with applicable restrictions on cross-border processing.

16. Your privacy choices and rights

Depending on applicable law, account type and whether data is controlled by Bamio or a school, an authorized person may request access, correction, update, deletion, withdrawal of consent/permission, grievance redressal or other rights available under applicable law. To make a request, email admin@bamio.in with the subject “Privacy Request” or use available in-app tools.

For school-controlled records, Bamio may refer or coordinate the request with the relevant school. Bamio will not use that coordination to prevent a user from exercising a right that Bamio itself is responsible for handling.

17. Account deletion and data deletion

• Parents may delete or request deletion of a child profile using available in-app tools or by contacting Bamio.
• Parents can start account deletion from the app’s parent settings. Account and data deletion can also be requested, without signing in, at www.bamio.in/delete-account, or by email.
• For school-linked accounts, de-linking or deleting the Bamio account may require coordination with the school. School-held records may remain with the school under school policy or applicable requirements.
• Bamio targets completion of deletion from active systems within 30 days of a validated request unless a longer period is required for legal, security, dispute, school-record or operational reasons.
• Residual copies may remain temporarily in protected backups until the relevant backup cycle expires and are not intended to be restored for ordinary product use after deletion.

18. Cookies, notifications and communications

The mobile app does not rely on browser cookies in the same way as a website. Bamio web services may use strictly necessary cookies or similar session technologies for authentication, security and core functionality. Bamio does not use third-party advertising cookies to target children. Bamio may send essential service emails and, where enabled, push notifications for assignments, reminders, reports, account status and security alerts.

19. Changes to this Policy

Bamio may update this Policy as the Services, law, providers or processing practices change. Material changes will be notified through the app, email or another reasonable channel. Where a change requires fresh consent or authorization under applicable law, Bamio will seek it before relying on the changed processing. Past versions of this Policy remain available at www.bamio.in/privacy/archive.

20. Contact

Read the parent summary → Terms of Service ← Back to home