Privacy policy

1. Who we are

Little Steps (“we”) runs the Little Steps app and this website. Schools sign up to use Little Steps with their teachers, office staff and parents.

For the records a school keeps — such as attendance, the diary and fees — the school decides what is collected and why; we hold and process them for the school. For your account itself, we are responsible.

2. What we hold

• Your account: your mobile number, your name and the language you choose; if you add them, your email, your photo and a second mobile number.
• What your school adds: children’s names, dates of birth, classes and photos; attendance; diary entries; notices; staff details and any medical notes the school records.
• Staff attendance location: only at the moment a staff member checks in or out, to confirm they are at school; it is kept with that day’s attendance. The app never follows anyone’s location at other times.
• Your phone: the app version, the phone model and a notification token, so the app can send you notifications.
• Security records: when and on which phone you signed in, and the internet address and device of sign-ins and important changes — to keep accounts and schools safe.

We do not read your contacts, call logs, messages or other apps, and we do not use advertising identifiers.

3. Why we use it

• To run the school’s app: showing each person what their role should see, and sending notifications.
• To keep accounts and schools secure, for example with sign-in codes and sign-in records.
• To help when you or your school ask for support.
• To meet our legal duties.

We never use your information for advertising, and we never sell it.

4. Who can see it

• People in your school, by role: parents see their own children; teachers see their classes; the principal and the office see the school.
• The Little Steps support team, only when needed to help you or your school.
• Service providers that run parts of the service for us — hosting, sign-in text messages, and the notification services of Expo, Google and Apple, which carry each notification’s text to your phone — under contracts that limit what they may do.
• Authorities, when the law requires it.

One school never sees another school’s information.

5. Where it is kept and how it is protected

We keep the information on servers in India. Connections are encrypted; photos and files are private and open only through links that expire within an hour; access is limited and recorded.

6. How long we keep it

• Your account: as long as you use Little Steps. When you ask to delete it, we delete your account and personal details within 30 days, except the security records below.
• School records: as long as the school uses Little Steps and the law requires. Records a school must keep, like attendance and fee receipts, stay with the school even after you leave.
• Security and audit records are kept for three years, then deleted. Sign-in codes are deleted after a day; a photo you replace or remove is deleted after 30 days.

7. Children

Children do not have accounts. The school adds a child’s details and the child’s parents see them in the app. At admission the school records whether the parent agrees to the child’s photos being used. To correct a child’s details, talk to the school office.

8. Enquiry and admission forms

A school can put an enquiry form and an admission form on this website, at links it shares on posters and on WhatsApp. Families fill them in without an account.

• Who receives it: what you send goes to that school only. The school decides what to do with it; we hold it for the school. A form never shows anything about another family.
• The enquiry form asks for the child’s name and class, your name, how you are related to the child and your mobile number — and, if you give them, the child’s date of birth, your email and area, how you heard of the school and your question.
• The admission form asks for the child’s name, gender, date of birth and class; the parents’ or guardians’ names, mobile numbers and occupations; and, if you give them, the address, allergies, medical notes and the child’s photo. We never ask for Aadhaar, and documents are brought to the school office, not uploaded.
• The forms use no cookies and no trackers. To stop spam, your phone solves a small puzzle while you type, and we count the forms sent from each internet address for an hour.
• An admission form you have not sent yet stays only in your phone’s browser, for 3 days, so a reload loses nothing; sending it or Clear the form removes it.
• How long it is kept: enquiries stay with the school while it uses Little Steps; an enquiry the school deletes is erased after 30 days. An admission form the school does not admit, or one replaced by a newer form, is erased with its photo 180 days after. Once the child is admitted, the form and its photo are erased 30 days later — the details continue in the child’s school record. A photo never sent with a form is erased after a day.
• To see, correct or delete what you sent, ask the school. It can also send you a private link to correct your admission form; the link works once, for 30 days.

9. Your rights

Under India’s Digital Personal Data Protection Act, 2023, you can ask to see the personal data we hold about you, correct it, delete it, and complain to us about how it is handled. You can also name someone to use these rights for you.

• Correct your name, email, photo or second number in the app: More → My profile.
• Delete your account in the app (More → Delete my account) or on this website.
• For anything else, contact Little Steps support (below). For a school’s records, ask the school — it decides about them.

10. Questions and complaints

Write to Little Steps support from the app (More → Help) or on WhatsApp. Our grievance officer looks into every complaint about personal data. If you are not satisfied with our answer, you can take it to the Data Protection Board of India.

11. Changes to this policy

When this policy changes, we publish the new version here with its date.