Privacy Policy

8 AM is a student-transit notification service. When a student taps an RFID card on a reader (in the school bus or at school), the parent or guardian receives a notification on the 8 AM app, for example:

This policy applies to personal data of (a) students, (b) parents and legal guardians, (c) school staff and administrators, and (d) visitors to our website.

The Service is provided to Schools, which subscribe to and pay for it. The School decides to adopt the Service for its students, and 8 AM processes student data on behalf of the School as a Data Processor under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). The School's own privacy notice will also apply.

For parent account data, app usage data and website data, 8 AM acts as the Data Fiduciary.

Most students using the Service are under 18 years of age and are "children" under the DPDP Act. Therefore:

1. 1.We process a child's personal data only with verifiable consent of the parent or lawful guardian, obtained through the School enrolment process and the app sign-up process (for example, OTP verification on the parent's mobile number registered with the School).
2. 2.We process a child's data only for the child's safety and for the transport-notification purpose described in this policy.
3. 3.We do not carry out targeted advertising directed at children, and we do not track or monitor children's behaviour for any commercial, marketing or profiling purpose.
4. 4.We collect only the minimum data necessary to run the Service.

• From the School, when it enrols students and assigns RFID cards and routes.
• From you, when you register on the app or contact us.
• Automatically, when the RFID card is tapped on a reader, and when you use the app.

We use personal data only to:

1. 1.Send boarding, arrival, departure and drop-off notifications to parents;
2. 2.Alert parents and the School about exceptions (for example, a missed tap or a card tapped at an unexpected stop), where this feature is enabled;
3. 3.Provide the School with transport and trip records for student safety;
4. 4.Verify identity, manage accounts and prevent misuse or fraud;
5. 5.Provide customer support;
6. 6.Maintain, secure, fix and improve the Service (using aggregated or de-identified data wherever possible);
7. 7.Comply with law, court orders and lawful requests of government authorities.

We share personal data only on a need-to-know basis with:

• The student's School and its authorised staff;
• Transport staff (bus driver/attendant/transport in-charge) — limited to what they need, such as the student's name and stop;
• Service providers working on our behalf, under written contracts requiring confidentiality and security: cloud hosting, SMS/push notification providers and customer-support tools;
• Government or law-enforcement authorities, when required by law or to protect the life or safety of a child;
• A successor entity in case of merger, acquisition or sale of business, subject to the same protections in this policy.

Data is stored on secure servers located in India. If any service provider processes data outside India, we will do so only in countries permitted under Indian law and with appropriate contractual safeguards.

We use reasonable security practices, including: encryption of data in transit (TLS) and at rest; role-based access so staff see only what they need; OTP-based login; audit logs of access; regular security testing; and confidentiality obligations for our employees and vendors. We follow the Information Technology Act, 2000 and the reasonable security practices rules made under it.

If a personal data breach occurs, we will take immediate steps to contain it, and we will inform the affected parents, the School, the Data Protection Board of India and CERT-In, in the manner and time required by law.

As a parent/guardian (for yourself and on behalf of your child), you have the right to:

1. 1.Access — get a summary of the personal data we hold and how it is used;
2. 2.Correction and updating — fix incorrect or incomplete data;
3. 3.Erasure — ask us to delete data that is no longer needed (subject to legal retention requirements);
4. 4.Withdraw consent — at any time (see Section 14);
5. 5.Grievance redressal — raise a complaint with us (Section 16);
6. 6.Nominate — nominate another person to exercise these rights in case of your death or incapacity.

Where the School is the Data Fiduciary, we may forward your request to the School and assist it in responding. We may verify your identity before acting on a request.

You can withdraw consent through the app settings or by emailing fivextechnologiesofficial@gmail.com. Once consent is withdrawn, we will stop sending notifications and stop processing your child's data, except where we must retain it by law.

Our website uses essential cookies to function and may use basic analytics cookies to understand site traffic. You can control cookies through your browser settings. We do not use advertising or tracking cookies. The mobile app does not use advertising identifiers.

If you have any concern or complaint about your data, please contact:

We will acknowledge your complaint within 48 hours and try to resolve it within 30 days or such time as required by law. If you are not satisfied, you may approach the Data Protection Board of India.

We may update this policy from time to time. If we make significant changes, we will notify you through the app or by email before they take effect, and seek fresh consent where required. The "Last updated" date at the top shows the latest version.