Privacy Policy

1. Who we are, and what this policy covers

Hash Future School ("Hash Future School", "we", "us", "our") is an online school for learners aged 6 to 17, operating from Peringala P O, Kochi, Kerala 683565, India. We are the organisation responsible for the personal data described in this policy. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") we act as the Data Fiduciary for that data, and the people whose data we hold are the Data Principals.

This policy covers:

• this website, www.hashfuture.school, and every page and form on it;
• futureassist.hashfuture.school, our learning platform, where student records, attendance, progress reports and project showcases live;
• our enquiries, demo bookings, admissions, event registrations (such as the International Junior Entrepreneurship Challenge), partner-programme registrations (such as IIT Madras School Connect), newsletter and team-application forms;
• email, WhatsApp, phone and in-person communications with our team.

Some organisations we work with are responsible for your data in their own right, not on our behalf. These include payment providers, examination boards and partner institutions whose programmes you apply to. Their own privacy notices apply to the data they collect directly from you.

This policy should be read together with our Terms of Service and our Refund Policy.

2. Summary at a glance

This table is a summary to help you find your way around. The sections that follow are the authoritative detail.

3. The personal data we collect

3.1 Information you give us

• Enquiries and demo bookings - the parent or guardian's first and last name, email address, phone number, the child's age, your location, and anything you write in a message to us.
• Admissions and enrolment - the student's name, date of birth or age, gender, nationality, current grade and curriculum, present school, city and country, time zone, preferred language, interests and background notes; the parent or guardian's name, relationship, email, phone number and occupation; and, where a partner programme requires it, the identity document type, number and issuing country, and a photograph.
• Team applications - your name, age, email, phone number, location, education, evidence of your work, written answers to our questions, and a link to a 3 to 5 minute video that you host yourself (for example on YouTube).
• Event registrations - for the International Junior Entrepreneurship Challenge, your team name and category, the team lead's name, email and phone number, city, country and school, the names of your team members, your mentor's name, relationship, email and phone number, a description of your idea, how you heard about the challenge, and your acceptance of the rules.
• Newsletter - your email address and, optionally, your name.
• Payments - the name, email address, phone number and billing details you give to the payment provider, and the transaction and invoice records we receive back (see Section 8).
• Conversations with our team - email, WhatsApp, phone and video-call content, including anything you choose to share with us.

3.2 Information about children, and sensitive information

Because we teach learners aged 6 to 17, most of the data we hold is children's data. We treat this as a significant responsibility, not a category.

• Children's data includes the student's name, date of birth or age, contact details where given, guardian details, enrolment and progress records, and, for partner programmes, identity document details and a photograph.
• Identity document numbers are requested only where a partner programme genuinely requires them, such as registering a candidate for the IIT Madras School Connect assessment. We tell you why at the point we ask. Where a partner allows an alternative, we will use it on request.
• Learning and health needs - if you tell us about a learning difficulty, diagnosis or health need, we treat it as sensitive personal data. We use it only to support your child's learning and to keep them safe, and we share it within the school only with the staff who need it.
• What we do not ask for - we do not collect biometric data or financial account details from students, and we do not ask for information about religion, caste or political opinion. If you volunteer such information in an application or a message, we hold it only for the purpose you gave it to us.

3.3 Information we collect automatically

When you visit our pages, our hosting provider and our security tools record routine technical information:

• your IP address and the approximate location derived from it;
• your device type, operating system, browser and screen size;
• the page you came from, the pages you view on our site, and the time you view them;
• form-security signals used by Google reCAPTCHA to tell humans and automated scripts apart;
• error and security logs, including failed login attempts on our staff area.

We use this information to run and secure the site, to fix faults, and to understand in aggregate which pages are useful. See Section 4 for cookies.

3.4 Information we receive from others

• Payment providers confirm whether a payment or refund succeeded, and give us the transaction reference.
• Partner institutions tell us the status of applications you make through us, such as a School Connect registration.
• Our learning platform (futureassist.hashfuture.school) provides attendance, mentoring notes, progress reports and approved project showcase entries.
• Other people - for example, a team member who adds you to an event team, or a parent who names a second guardian on a registration form.
• Publicly available sources - for example, a video you tell us to watch at a link you provide.

3.5 What we do not do

• We do not collect or store full card numbers, card security codes (CVV) or UPI PINs.
• We do not buy personal data, and we do not obtain contact lists from third-party brokers.
• We do not use children's data for advertising or for building profiles of them.
• We do not send marketing to students. Anything promotional goes to the parent or guardian, or to an adult applicant.

4. Cookies and similar technologies

Cookies are small files a website stores in your browser. We also use similar technologies such as browser local storage, which lets our site remember a small setting on your own device without sending it anywhere.

We only set non-essential cookies after you agree to them, and you can change your mind at any time - see "How to control cookies" below.

How to control cookies

You can block or delete cookies and clear local storage at any time in your browser's settings (usually under Privacy or Site Data). Blocking everything may stop forms and the staff area from working. You can also use:

• Google Ads Settings to control personalised advertising from Google;
• Meta ad preferences to control advertising based on your activity on Meta's platforms;
• optout.aboutads.info or optout.networkadvertising.org for participating interest-based advertising companies;
• youronlinechoices.eu if you are in the European Union or the United Kingdom.

If you would rather we handled it for you, write to learn@hashfuture.school and we will record that you do not want measurement or advertising cookies on your device.

5. Advertising, measurement and social platforms

We promote the school to families who may be looking for an online school, using advertising platforms such as Google and Meta. Here is exactly what that involves.

• Where we run a campaign, the platform may set or read cookies, pixels or similar identifiers on our pages and on its own services in order to measure conversions - for example, whether a page visit led to an enquiry form being submitted - and to decide who sees our ads. That processing is governed by the platform's own privacy notice: Google and Meta.
• We receive campaign reports in aggregate, such as how many people saw an ad or clicked it. We do not receive a visitor's name, email address or phone number from those reports.
• We do not sell personal data, and we do not pass personal data to advertising platforms for their own purposes.
• We never use children's data for advertising. We do not target, retarget or build audiences from a child's data, we do not ask advertising platforms to target people under 18, and we do not use a child's data to build advertising profiles.

Our pages on social platforms

If you follow, message or comment on our pages on YouTube, Instagram, Facebook, X, LinkedIn or WhatsApp, that platform processes your information under its own notice, and we can see the content you choose to share and aggregated insights about our audience. If you contact us on WhatsApp, the conversation is delivered through WhatsApp (Meta) before it reaches us.

You can opt out of personalised advertising using the tools listed in Section 4.

6. Why we use your data, and the basis we rely on

We use personal data only for the purposes below. Where we rely on consent, you can withdraw it at any time; where we rely on a contract, the processing is necessary to provide what you have asked for; where we rely on a legal obligation, the law requires it.

Where we rely on legitimate interests, we balance our interest against your rights, and we use the least intrusive means available - for example, aggregate statistics rather than individual profiles.

7. Children, students and parental consent

Our school teaches children, so this section matters more than any other. It explains how we handle a child's data and the role of the parent or guardian.

Consent comes from the parent or guardian

• We ask a parent or legal guardian for consent before we collect or use a child's personal data. Every registration records the guardian's name, relationship and contact details, and we treat that guardian as the consenting party.
• Where we need to confirm that consent is genuine, we may verify it by contacting the guardian on the email address or phone number already on file, or by asking for a written confirmation. A payment made by a guardian, or a form completed and submitted by a guardian, is treated as evidence of that guardian's consent.
• Under India's DPDP Act we treat everyone under 18 as a child, and we ask for verifiable parental consent for all of them. In the United States we apply the same rule to children under 13 under the Children's Online Privacy Protection Act, and in the European Union and the United Kingdom we apply the local age of digital consent, which is 16 or lower depending on the country.
• We collect only what the programme actually needs, and we do not make participation in an activity conditional on providing more information than is reasonably necessary.

What we will not do with a child's data

• We do not serve targeted advertising to children, and we do not use children's data for advertising or retargeting.
• We do not undertake behavioural monitoring or behavioural advertising directed at children, and we do not track a child across other websites.
• We do not sell or rent children's data, and we do not use student personal data to train artificial intelligence models.
• Students do not have public profiles or accounts on this website.

Student work and the project showcase

Some student work is published on our showcase pages, because presenting finished work to real people is part of how we teach. Before anything is published, a mentor reviews it, and we publish it under the display name agreed with the family, with the grade or age only where that was agreed. We do not publish a child's contact details, address, school or full name, and we do not publish a child's photograph without written consent from the parent or guardian.

A parent or guardian can ask us to remove a published project, or withdraw consent for it, at any time by writing to learn@hashfuture.school. We will take it down and confirm that we have.

Parents' rights and withdrawal of consent

• A parent or guardian can exercise every right in Section 14 on their child's behalf, and a student who is old enough to understand can ask us themselves.
• Withdrawing consent for the data the school depends on to teach means we can no longer provide the programme. We will tell you that clearly before you decide, so the choice is an informed one.
• If you believe a child has given us personal data without your consent, contact us and we will delete it. If a child contacts us directly and cannot be identified as an enrolled student, we delete the data and ask for a guardian to get in touch.

8. Payments, fees and financial records

Our online payment pages are operated by regulated payment service providers. For payments in India, our principal provider is Razorpay; for families paying from outside India, the provider named on the international payment link at checkout applies. The provider is the organisation that collects your payment details, and its own privacy notice applies to that step.

• We do not collect or store your full card number, card security code (CVV), UPI PIN or net-banking credentials. These are entered directly on the provider's page, which is certified to the PCI-DSS standard and regulated by the Reserve Bank of India.
• What we receive is a confirmation containing the transaction reference, the amount and currency, the outcome, the date and time, the payer's name and contact details, and the reason if a payment failed - together with the invoice details we must keep for tax purposes.
• Invoices and receipts. We keep billing and tax records for the period required by tax and accounting law, which in India is generally up to eight years.
• Refunds are made to the original payment method and follow our Refund Policy.
• Monthly plans are collected through the same provider. To stop a plan, tell us in writing and we will stop requesting payments and confirm the final position in writing.
• Fraud prevention. We may use transaction data, and share it with our payment providers, banks or law enforcement, where that is necessary to detect or prevent fraud or to comply with a lawful request.
• Partner programme fees - such as board examination fees and IIT Madras School Connect course fees - are set and collected by those bodies, and they are responsible for the data they collect for that purpose.

If you are asked for payment details anywhere other than a clearly identified provider's page, treat it as suspicious and contact us before paying.

9. Emails, WhatsApp and marketing

• Service messages - enrolment confirmations, class schedules, progress reports, invoices, security notices and changes to this policy - are part of the service we provide. You cannot unsubscribe from these while you remain enrolled, but we keep them relevant and we do not use them for promotion.
• Marketing messages - our newsletter, programme announcements and event invitations - are sent with consent. Every marketing email contains a one-click unsubscribe link, and we keep a suppression list so that we do not contact you again after you opt out. Our email delivery is handled by Mailgun on our instructions.
• Email engagement. Our email provider reports whether a message was delivered, and for newsletters whether links were clicked, so we can tell what families find useful. If you would rather we did not record this, tell us and we will send you plain text messages with tracking switched off.
• WhatsApp, phone and SMS. If you give us a phone number, we may contact you on it, including on WhatsApp, about your enquiry or your child's learning. You can tell us to stop at any time by replying, or by writing to us. We keep a record of that request.
• No marketing to children. We do not send marketing to students, and we do not sell, rent or trade contact lists.

10. Who we share personal data with

We do not sell personal data, and we do not share it for anyone else's marketing. We share it only with the organisations below, only as much as the purpose requires, and only under a contract that limits them to acting on our instructions.

We may also publish statistics about the school - such as participation numbers from an impact report. Those figures are aggregated, and a person is never identifiable from them.

11. Where your data is stored, and international transfers

Our website and database are hosted by Vercel and Neon, and our email is delivered through Mailgun. That means personal data may be stored or processed outside your country of residence, including in the United States and the European Union. We are based in India, and our team accesses records from India.

Where we transfer personal data out of a country that restricts it - for example out of the European Economic Area or the United Kingdom - we rely on recognised safeguards, such as the standard contractual clauses in our provider agreements, and we limit the transfer to what the purpose requires. You can ask us for more detail about those safeguards by writing to learn@hashfuture.school.

12. How long we keep your data

We keep personal data only for as long as it is needed for the purpose we collected it for, plus any period the law requires. These are our standard periods.

If you ask us to delete something and we do not need it for a legal or accounting reason, we delete it and tell you when that is done.

13. How we protect your data

• All traffic to our site is encrypted in transit using HTTPS with transport layer security.
• Our database is encrypted at rest by our hosting providers, and access is limited to the credentials our application needs.
• Our staff area is restricted to authorised administrators. Passwords are stored only as one-way hashes, and sessions use a signed token in a secure, HTTP-only cookie that scripts on the page cannot read.
• We apply the principle of least privilege: staff and contractors can see only the records their role requires, and access is removed when a role ends.
• Everyone who works with student data is bound by confidentiality obligations, and mentors are given guidance on handling children's information.
• Card and bank details never reach our servers; they are handled by our payment provider.
• We review our providers' security practices, and we keep the number of suppliers that touch personal data deliberately small.
• We keep records of the processing we carry out, and we review this policy and our practices regularly.

No system can be completely secure. If you think your account or information has been compromised, contact us immediately at learn@hashfuture.school or on +91 94971 20591.

14. Your rights and choices

You have rights over your personal data, and a parent or guardian may exercise them on behalf of their child. We do not charge for exercising a right, and we will not treat you differently for doing so.

Your rights under India's DPDP Act, 2023

• Access - a summary of the personal data we hold about you, what we are doing with it, and the identities of the organisations we have shared it with.
• Correction and completion - we will correct inaccurate or incomplete data, and update it.
• Erasure - we will delete data you no longer want us to keep, unless the law requires us to retain it.
• Withdraw consent - at any time, as easily as you gave it.
• Grievance redressal - a route to us for complaints, described in Section 20.
• Nomination - you may nominate another person to exercise your rights in the event of your death or incapacity.

If you are in the European Union or the United Kingdom

You have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to receive a portable copy, to withdraw consent, and to lodge a complaint with your national supervisory authority. Our legal bases are set out in Section 6. Where we rely on legitimate interests, you may object, and we will stop unless we have compelling grounds that override your rights.

If you are in the United States, including California

You may request to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information for inferring characteristics about you. You may use an authorised agent to make a request, and we will not discriminate against you for exercising your rights.

How to make a request

1. Write to learn@hashfuture.school with "Privacy request" in the subject line, and tell us what you would like us to do.
2. To protect the data, we may ask you to confirm your identity - typically by replying from the email address we already hold for you, or by confirming details we already have on file.
3. For a child's data, we may ask for proof of your relationship to the child as parent or legal guardian.
4. We will respond within 30 days. If a request is complex we will tell you why we need longer.

You can also unsubscribe from marketing at any time using the link in any email, or by simply telling us to stop.

15. Other websites, links and embedded content

Our pages link to other websites - partner institutions, payment pages, social media, and resources we think are useful - and we embed video and occasionally an external form. Those services have their own privacy notices, and we are not responsible for how they handle your data. We recommend reading the notice of any site before you give it personal information, particularly a payment page.

16. Automated decisions and profiling

We do not use your personal data to make automated decisions that have a legal or similarly significant effect on you, such as an automated decision on an admission. Admissions, class placements and progress decisions are made by people. We do not profile children, and we do not build advertising profiles.

17. Do Not Track and Global Privacy Control

Because we do not sell personal data and do not share it for cross-context behavioural advertising, we honour Global Privacy Control (GPC) signals as a request to opt out of sale and sharing. We do not track visitors across third-party websites, so we do not change our behaviour in response to Do Not Track signals beyond that.

18. If there is a data breach

We keep an incident response plan. If a breach of personal data occurs, we act to contain it immediately, assess the risk to the people affected, notify our service providers where they are involved, and notify the relevant authority and the affected individuals without delay where the law requires it - including the Data Protection Board of India under the DPDP Act, and supervisory authorities and individuals in the European Union or the United Kingdom where applicable. We tell you what happened, what we are doing about it, and what you can do to protect yourself.

19. Changes to this policy

We review this policy at least once a year, and whenever we change how we handle personal data. When we make a material change, we update the "last updated" date at the top of this page and, where the change affects enrolled families or is significant, we tell parents and guardians by email.

20. How to contact us

If you have a question, a request or a complaint about privacy, start with our Grievance Officer. We will acknowledge your message and tell you who is handling it.

If you are not satisfied with our response, you may escalate your complaint to the regulator in your country - in India, the Data Protection Board of India, established under the DPDP Act; in the European Union or the United Kingdom, your national supervisory authority. You do not need to approach us first before approaching a regulator, though we would appreciate the chance to put things right.

21. Governing law

This policy is governed by the laws of India, and any dispute relating to it is subject to the jurisdiction of the courts at Kochi, Kerala, India. Nothing in this section removes a right you have under the law of the country where you live, including the right to complain to your local data protection authority.