Privacy Policy

Last updated: October 12, 2026

This Privacy Policy explains how KVA Labs (“Company”, “we”, “us”) collects, uses, stores, and protects your information when you use the TimeIt360 platform (“Service”). This policy is published in compliance with the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDPA”).

By using the Service, you consent to the collection and use of your information as described in this policy.

1. Information We Collect

Account Information

• Name and email address of the school administrator
• School name, address, principal's name, and contact details
• Phone number (optional, for payment prefill)
• Password (stored in hashed form, never in plain text)

School Operational Data

• Teacher names, email addresses, optional phone numbers, and availability schedules
• Subject names and configurations
• Grade and section information
• Bell schedule timings and working days
• Timetable configurations and generated timetables
• Substitution records (which teacher covers which period on which date, and the reason recorded)

Important: We do not collect individual student names, student personal data, student academic records, or any other student-identifiable information. The Service only processes grade and section labels (e.g., “Grade 7A”) for timetable generation.

Ori Assistant Conversations and Support Tickets

• Ori conversations: When you use Ori, our in-app AI assistant, we store the conversation against your account: your email address, the messages you and Ori exchange, and the school data Ori looked up to answer you (for example teacher names and email addresses, assignments, and timetable details).
• Spreadsheets you attach to Ori: If you attach a spreadsheet so Ori can prepare an import, we store its contents (up to 500 rows) against your conversation, along with the import preview you are asked to confirm.
• Support tickets: If you raise a support ticket, either through the support form or when Ori raises one for you, we store the ticket (subject, description, your email address, your school, and the page you were on). A ticket raised by Ori also carries an excerpt of the recent conversation and any diagnostic analysis Ori prepared. New tickets are emailed to our support inbox, and the resolution is emailed to you.

Please do not enter student personal information into Ori or into spreadsheets you attach to it.

Connector Activity (only if an administrator connects Claude or ChatGPT)

• A record of each connector tool call: the time, the administrator's account and school, the connected app (its OAuth client ID), the tool's name, whether it succeeded, an error code if it did not, how long it took, and a one-way hash of the request's arguments (never the arguments or the results themselves)
• The connected app's registration (its name and the address it returns to) and the administrator's approval of it, held by our sign-in service
• Spreadsheets an administrator asks Claude or ChatGPT to import (up to 500 rows), kept as import previews, and single-use confirmation records for publishing (stored only as hashes, valid for a few minutes)

See Section 7 for how the connector works.

Payment Information

• Transaction records (amount, date, plan type, payment status)
• Razorpay payment IDs and order IDs

We do not store credit card numbers, bank account details, or UPI IDs. All payment processing is handled by Razorpay, which is PCI-DSS compliant. Please refer to Razorpay's Privacy Policy for how they handle payment data.

Automatically Collected Information

• Browser type and version
• IP address
• Pages visited and page-load performance measurements (through Vercel Analytics and Speed Insights)
• Error reports for debugging and improving the Service, which include technical details and the signed-in user's ID, email address, and school (see Section 3)

2. How We Use Your Information

We use your information to:

• Provide the Service: Generate timetables, manage school data, process payments, and deliver core functionality
• Communicate with you: Send account notifications, payment receipts, subscription reminders, and support responses
• Improve the Service: Analyze usage patterns (in aggregate) to improve features, fix bugs, and enhance performance
• AI Features: Process your conversations with Ori, our AI chat assistant, to answer your questions and prepare changes that you confirm. To do this, Ori sends your messages, together with the school data needed to answer them (such as teacher names and email addresses, assignments, timetables, and generation results), to a third-party AI provider. This data is not anonymized. For teacher, grade, and subject imports, the rows of the spreadsheet you attach are also sent to the AI provider so it can identify the relevant columns
• Mobile notifications: Send push notifications to teachers' devices when a substitution is assigned, whether from the web app or from the mobile app (see Section 6)
• Legal compliance: Meet our obligations under applicable Indian law, including tax regulations

We do not use your data for advertising, profiling, or selling to third parties.

3. Data Sharing

We share your data only with the following parties, and only to the extent necessary:

Several of these providers process data on servers outside India. Content sent to the AI providers (including Anthropic and OpenAI when an administrator uses the connector), Expo, Apple, Google, Resend, and Sentry is handled under each provider's own terms and privacy policy, for example OpenAI's Privacy Policy, Anthropic's Privacy Policy, and Google's Privacy Policy.

We do not sell, rent, or trade your personal information to any third party.

4. Data Storage and Security

• Location: Your data is stored on Supabase cloud servers in the Asia Pacific (Mumbai, ap-south-1) region.
• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access control: We use Row Level Security (RLS) policies to ensure complete data isolation between schools. No school can access another school's data.
• Authentication: We use JWT-based authentication through Supabase Auth. Your sign-in session is kept in first-party browser cookies, and you can end it at any time by signing out.
• Backups: Automatic daily backups are maintained by our database provider.

5. Cookies

We use essential first-party cookies only, for authentication, session management, and keeping your Ori conversation together. We do not use third-party advertising or tracking cookies.

We also keep display preferences (such as sidebar and table density settings) in your browser's local storage. These stay on your device.

6. Mobile Companion App

The TimeIt360 mobile companion app (iOS and Android) lets teachers, students, and parents view their school's published timetable and substitutions using an access code issued by the school. Teachers can also receive substitution alerts, and administrators using an admin access code can assign, save, and remove substitution covers. It is a separate experience from the web app and handles data differently:

What we collect on the mobile app

• Access code — a per-entity code (teacher, grade-section, or admin) typed in by the user. The code is issued by the school's administrator and is the only credential. We do not collect names, email addresses, phone numbers, or any other personal identifiers from mobile-app users; the code itself is tied to the teacher, class, or admin role the school created it for.
• Push notification token — for teacher codes only: if the teacher allows notifications, the app gets a push token for the device from Expo's push service and sends it to our servers together with the access code and the device platform (iOS or Android). We use it only to deliver substitution alerts.
• Substitution changes made with an admin code — assigning, saving, or removing a cover is recorded in your school's substitution records on our servers, exactly as it would be if made in the web app.
• App preferences — notification on/off toggle, lead-time choice (5/10/15 min), skip-free-periods toggle, the user's last-selected view mode (list vs grid), and, for admin codes, the teacher or class last viewed. Stored locally only.

What we do NOT collect on the mobile app

• No advertising identifiers (no IDFA, no Google Advertising ID)
• No analytics or usage-tracking tools in the app
• No location data
• No contacts, photos, microphone, or camera access
• No advertising or analytics SDKs (no Facebook SDK, no Google Analytics, etc.). The only third-party services the app uses are the push notification services described below

Where mobile-app data is stored

• On the device (in the app's private storage, via React Native AsyncStorage): the access code, school identity returned by the API after validating the code (school name, time zone, entity type and name), and app preferences listed above.
• On our servers: the catalog of issued access codes (so the API can validate them); the published timetable and substitution data that the web app already stores, including any substitution changes made from the mobile app; and, for each teacher's device that allows notifications, a record linking its push token to the access code, school, and teacher it was issued for, the device platform, and the dates it was registered and last seen.

What gets sent to our servers

When the mobile app fetches a timetable, resolves a code, registers for notifications, or (for admin codes) changes a substitution, it makes HTTPS requests to timeit360.com with the access code in an X-Access-Code header. Requests also carry the details needed for the action, such as the date, the ID of the teacher or section being viewed (for admin codes), the push token, or the substitution being saved. Standard request metadata (IP address, user-agent) is captured in our server logs and deleted after 30 days.

Notifications

Substitution alerts are push notifications. When a substitution is assigned, we send a push notification to the devices registered for the substitute teacher and for the absent teacher. The text of the notification includes the teachers' names, the class and subject, the period, and the date. Our servers send it to Expo's push service, which passes it to Apple's Push Notification service (iOS) or Google's Firebase Cloud Messaging (Android) for delivery, so those services process the device token and the notification text. Only devices signed in with teacher codes are currently sent these alerts. A device signed in with a class or admin code can still have a push token stored but is not sent substitution alerts.

Period reminders. The app has settings for period reminders (on/off, lead time, and skip-free-periods), but it does not currently schedule period reminders or any other local notifications. Those settings are saved on the device only. The in-app notification toggle does not control substitution alerts; to stop them, turn off notifications for the app in your device's Settings.

Permissions requested

• Notifications — requested only for teacher codes: when the teacher enters their code and, if it has not been granted, when the app starts while signed in. Admin and student/parent codes are never asked. It is used to deliver substitution alerts. The user can decline it or revoke it at any time in the device's Settings, and the timetable features work without it.

No other system permissions are requested.

Data deletion on the mobile app

• Sign out (Settings tab) first asks our servers to remove the device's push token, then clears the stored access code, identity, and preferences from the device. (Older versions of the app did not remove the token on sign-out; if you used one, uninstalling the app or emailing us removes it.)
• Uninstalling the app removes all device-side data. Alerts can then no longer be delivered to that device.
• Code revocation by the school admin causes the next API call from the device to fail with a 404, after which the app clears local identity and returns the user to the enter-code screen. Revoking or regenerating a code also disables every push token registered under it, and we never send alerts to a token whose code is no longer active.
• Push tokens on our servers are disabled on sign-out or when the code is revoked or regenerated, move to the new code if the device signs in with a different teacher code (and are disabled if it signs in with a non-teacher code), and are deleted if the school's data is deleted. To have a specific device's push token removed sooner, email support@kvalabs.com.

Children's use of the mobile app

The mobile app may be used by students or parents to view a class's published schedule using a grade-section code distributed by the school. The app does not ask these users for names, contact information, or any other personal data — only the access code. Grade-section codes do not register for notifications, so no push token is stored for these devices. Standard request metadata (IP address, user-agent) is captured in our server logs for all users. The viewable content is the class timetable that the school chooses to distribute, including teacher names and any substitutions affecting that class.

7. Connecting TimeIt360 to Claude or ChatGPT

A school administrator can connect TimeIt360 to Claude (Anthropic) or ChatGPT (OpenAI) through the TimeIt360 connector, so that the administrator can ask that AI service about their school's timetable data and, with confirmation, import data and generate and publish a timetable. Connecting is optional. Nothing is shared with Anthropic or OpenAI until the administrator approves the connection on a TimeIt360 consent screen. This section describes what the connector does; the rest of this policy continues to apply.

Who can connect

• School administrators only. The connector works for the account that owns the school in TimeIt360. Anyone else who signs in is refused, and no authorization is issued.
• Supported apps only. The consent screen is offered only to Claude, ChatGPT, and Claude Code or similar tools running on your own computer. It shows the app's name and the address it will return to; any other application is refused.

What is shared with Anthropic or OpenAI

When the administrator asks Claude or ChatGPT something that needs school data, that service calls the connector's tools and TimeIt360 returns the result to it. A result can include teacher names and email addresses, subjects, grades and sections, teacher assignments and availability, bell times, the published timetable, substitutions, generation status and diagnostic results, and school-wide totals. Phone numbers are removed from results, and results are size-limited. We do not hold student data, so none is shared.

Anthropic or OpenAI then processes that content, together with the administrator's conversation, under its own terms and privacy policy, including how long it keeps conversations. TimeIt360 does not control that processing. The administrator decides what to ask and can disconnect at any time.

In the other direction, the AI service sends TimeIt360 the tool requests, for example a question about one class or a spreadsheet the administrator asks it to import. A spreadsheet received this way is handled like a spreadsheet attached to Ori: its rows (up to 500) are stored as an import preview that can be confirmed for 30 minutes, kept with your school's records as described in Section 9, and, for teacher, grade, and subject imports, sent to our AI provider so it can identify the relevant columns (Section 3). In ChatGPT, an uploaded file is fetched by our servers from a temporary link that OpenAI provides. Please do not ask the connector to import student personal information. The diagnostic tool may also send the facts of a failed generation to our AI provider so the summary can be worded.

Imports and publishing take two steps: a preview first, then a separate confirmation that needs the preview's draft ID (imports) or a single-use confirmation code that expires in about five minutes (publishing). The tools that change data are marked as such so that Claude or ChatGPT can ask the administrator before running them.

Sign-in and access tokens

The connection uses OAuth. When the administrator approves it, our sign-in service (Supabase Auth) issues the AI service an access token and a refresh token for that administrator and school. Access tokens expire after about one hour, and refresh tokens are replaced each time they are used. The connector accepts a token only if it was issued for the connector, and everything it does is limited to the administrator's own school. The AI service keeps the tokens; we keep a record of the app that registered and of the administrator's approval.

What we record

• Audit log. For each tool call we record the time, the administrator's account and school, the connected app, the tool's name, whether it succeeded, an error code if it did not, the duration, and a one-way hash of the arguments. We do not record the arguments or the results. Only your school's administrator account can read these records, and they are deleted with your school's data (Section 9).
• Error reports. If a tool call fails unexpectedly, the error report sent to Sentry includes the tool's name, the signed-in user's ID, and the school ID (see Section 3).

Disconnecting

The administrator can disconnect at any time from the connector or app settings in Claude or ChatGPT. The AI service then stops using the tokens and cannot renew them, and access tokens that were already issued stop working within about one hour. To have a connection ended on our side straight away, or to ask us to delete what the connector stored for your school, email support@kvalabs.com. Content already returned to Anthropic or OpenAI is deleted through their own settings and processes.

8. Your Rights (under DPDPA 2023)

As a data principal, you have the right to:

• Access: Request a summary of your personal data we hold
• Correction: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Grievance redressal: File a complaint with our Grievance Officer
• Withdraw consent: Withdraw your consent for data processing at any time (this may affect your ability to use the Service)

To exercise any of these rights, contact us at support@kvalabs.com. We will respond within 48 hours and fulfill your request within 30 days.

9. Data Retention

• Active accounts: Data is retained for the duration of your subscription.
• After cancellation: Data is retained after cancellation so you can reactivate or export it. It is deleted when you ask us to close your account, or on request at any time (see Section 8).
• Payment records: Transaction records are retained for 8 years as required by Indian tax law (Income Tax Act, GST Act).
• Ori conversations and support tickets: Ori conversation records (including attached spreadsheets and import previews) and support tickets are kept for as long as your account is active. They are deleted with your other school data when your account is closed, or earlier on request. Starting a new conversation in Ori stops it from using the earlier one but does not delete the earlier record. To have them deleted sooner, contact us as described in Section 8.
• Connector records: The audit log, import previews from the connector, and the registration and approval of connected apps are kept for as long as your account is active and are deleted with your school's data, or earlier on request. Confirmation codes for publishing are stored only as hashes and expire within minutes; spent or long-expired ones are cleared out when the school next previews a publish.
• Mobile push tokens: Disabled on sign-out, on code revocation or regeneration, or when the device switches to a non-teacher code; deleted with the school's data or on request (see Section 6).
• Server logs: Automatically deleted after 30 days.
• Third-party providers: Content we send to the providers listed in Section 3 is kept by them according to their own policies.

10. Children's Data

TimeIt360 is designed for use by school administrators and teachers, not by children, and you must be at least 18 years old to create an account. The web Service processes only grade/section labels and teacher/subject information — not individual student data — and we do not knowingly collect personal data from children under 18 through it.

The mobile companion app can also be used by students or parents with a grade-section code from their school (see Section 6). These users are not asked for any personal information. The only data associated with that use is the access code and standard server log data (IP address and user-agent); grade-section codes do not register push tokens. We do not use this data for advertising, profiling, or tracking children.

If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 15 days before the changes take effect. Your continued use of the Service after the updated policy takes effect constitutes acceptance.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDPA 2023, the Grievance Officer for the purpose of this Privacy Policy is:

Name: Vishal Amler
Email: support@kvalabs.com
Response time: Acknowledgment within 48 hours, resolution within 30 days.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@kvalabs.com.