Privacy Policy

Last Updated: 31 August 2026

This Privacy Policy explains how Feezy, a product of BRONCO PARTNERS (PRIVATE) LIMITED (“Bronco Partners,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with the Feezy mobile application (the “App”), including its fee payment features, its digital vault feature (the “Vault”), and its KeyRing feature. BRONCO PARTNERS (PRIVATE) LIMITED is a company incorporated under the laws of Pakistan SECP Registration No. 0312497 and is the sole owner and operator of the Feezy application. By using the App, you agree to the practices described in this Privacy Policy.

1. Scope of This Policy

This Privacy Policy applies to Parents and legal guardians (“you,” “Parent”) who register for and use the Feezy mobile application (the “App”). It explains what personal information we collect from you, how we use it, and your rights regarding it. The App is currently intended for use by Parent accounts, who must be at least 18 years of age; further detail is set out in Section 5.

Within Feezy, a Child is a child or ward whose profile is created or managed by a Parent. A Child is not necessarily a Student. A Student is the Institution-linked record associated with a Child when the Child is successfully linked with a Partner Institution.

The App displays limited fee and enrollment information sourced from Partner Institutions after a Student record is linked to the relevant Child profile, helping you manage and pay Institution fees. Details on how this information is sourced and handled are set out in Section 2.2 and Section 5 below.

The App additionally allows you to store documents and information relating to a Child in a digital vault (the “Vault”), whether or not that Child is linked to a Partner Institution as a Student. Feezy uses a hybrid Vault model, as further described in Sections 2.4, 6, and 8 below.

2. Information We Collect

2.1 Information You Provide Directly

Data Type	Purpose	Required?
Mobile phone number and/or email address	Account creation and authentication via OTP. At least one of these two identifiers is required to register, verified via a one-time password sent by SMS (mobile number) or email (email address)	Required (at least one)
Full name	Personalizing your in-app experience (e.g., being addressed by name)	Optional
Email address (where not used for registration)	Sending payment receipts and account-related communication	Optional
Payment phone number (e.g., JazzCash number)	Processing fee payments via USSD transaction	Required (to make a payment)
6-digit PIN code	Securing your account and restoring your session each time you re-open the App	Required

When searching for a Student record to link with a Child, you will enter identifying details such as a name and class. This input is used only to query existing Partner Institution records in real time to find a match, and is not separately stored or retained by us.

2.2 Information We Receive From Partner Institutions

Student records — including full name, class/grade, date of birth, and fee/invoice details — are provided to us directly by Partner Institutions through an administrative dashboard, and reviewed by our platform administrators before being made available within the App.

A Child profile is separate from a Student record and may exist without any Institution link. Parents may create or manage Child profiles within Feezy, but Parents do not create, upload, or submit Student records. A Parent’s role in relation to a Student record is limited to searching for, verifying, and linking an existing Institution-provided record to the relevant Child profile. Student data is received from a business partner (the Institution), not collected directly from you or the Student.

2.3 Information Collected Automatically

Data Type	Purpose
Device/app diagnostic data (e.g., crash logs, performance data)	Maintaining app stability and fixing bugs
Transaction logs (payment status, timestamps)	Maintaining accurate fee and payment records, and calculating FeezyKeys earned or redeemed through KeyRing
Authentication/session tokens (JWT access and refresh tokens issued and managed by Feezy’s NestJS/backend following successful authentication)	Keeping you securely logged in and managing authenticated sessions

2.4 Vault Content You Choose to Store

If you choose to use the Vault, you may upload documents, images, or other information relating to a Child, whether or not that Child is linked to a Partner Institution as a Student, up to your account’s storage allocation, as communicated within the App.

What you store in the Vault is entirely at your discretion — we do not require, request, or specify particular content. We do not review or use Vault content for advertising, profiling, or any purpose unrelated to providing the Vault feature. Uploaded cloud content may be subject to automated malware and security scanning as described in Section 8 (Data Security); this scanning is carried out solely to protect the security and integrity of the Service and is separate from, and does not involve, any review of Vault content for advertising or profiling purposes. Beyond such automated security scanning, we do not otherwise review, inspect, or use Vault content, except where necessary to comply with applicable law.

2.5 Vault Content You Choose to Store

We do not request or store:

Student photographs (avatars shown in the App are procedurally generated using DiceBear and do not represent the Student’s actual appearance);
Full, unobscured Student information during the search process (search results are partially masked, e.g., “Tho*** Ed****, Class 2”);
Payment card numbers or banking credentials (payments are processed via JazzCash USSD, which does not require us to store sensitive financial credentials);
Biometric data (e.g., fingerprint or facial recognition data). Where you choose to enable biometric authentication as a quicker way to enter your App PIN, this is performed and verified entirely by your device’s own operating system; we do not collect, receive, transmit, or store any biometric data on our servers.

3. How We Use Information

We use the information described above to:

Create and authenticate your account, including via your registered mobile number or email address;
Authenticate you each time you re-open the App, using your 6-digit PIN or, where enabled, biometric unlock processed locally on your device;
Create and manage Child profiles within your account;
Match and verify a Student record against your provided details and link it to the relevant Child profile;
Display fee and invoice information relevant to your Linked Student(s);
Facilitate fee payments and generate receipts and transaction history;
Calculate, track, and display FeezyKeys earned and redeemed through KeyRing, based on your fee payment activity;
Store, synchronize, and retrieve Vault content that you choose to upload for a Child, strictly at your instruction, including performing automated malware/security scanning as described in Section 8;
Personalize your experience (e.g., displaying your name, if provided);
Send payment receipts and important account or transaction notifications (e.g., via email, if provided);
Maintain the security and integrity of the Service, including detecting and preventing misuse of the Student search and verification feature, and of the KeyRing feature;
Respond to support requests;
Comply with legal obligations.

We do not use Child, Student, or Vault information for advertising, profiling, or any purpose unrelated to account management, Institution linking and fee payment, and providing the Vault and KeyRing features.

4. How We Share Information

We share information only in the following circumstances:

4.1 With Partner Institutions

Fee payment confirmations and relevant transaction details are shared with the Partner Institution to confirm that a fee has been paid. Vault content is never shared with Partner Institutions.

4.2 With Service Providers

We share information with third-party providers who help us operate the App, including:

Firebase (Google) — for phone-number OTP authentication;
Supabase — for encrypted cloud storage and source-of-truth synchronization of Vault content;
JazzCash — for processing fee payments via USSD transaction.

Email OTP generation and verification are handled by Feezy’s own backend, and JWT access/refresh-token session management is handled by Feezy’s NestJS/backend infrastructure; these are not Firebase authentication functions.

Third-party providers only receive the information necessary to perform their function and are subject to their own privacy and security obligations.

4.3 For Legal Reasons

We may disclose information if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Feezy, our users, or Students (for example, if we detect an attempt to misuse the Student verification feature to gain unauthorized access to a Student’s information).

4.4 We Do Not Sell Data

We do not sell, rent, or trade Parent, Child, Student, or Vault information to third parties for marketing or any other purpose.

5. Children’s Privacy

Feezy is designed to be used by adult Parents or legal guardians, not by children. Parent accounts currently require the account holder to be at least 18 years of age. We do not knowingly permit children to create Parent accounts or directly authenticate as account holders.

Within the Parent account, a Parent may create or manage a Child profile. A Child is not necessarily a Student. Limited Student information (name, class, date of birth) is received exclusively from Partner Institutions — a verified institutional source — when a Child is being linked with a Institution Student record, rather than collected from the Student or general public.

We have designed the App’s Student search feature to minimize exposure of Student information:

Search results display only partially obscured identifying information;
Parents cannot browse a directory of Students;
Linking a Student record to a Child profile requires successful verification against Institution-provided records (e.g., matching date of birth);
Student profile images shown in the App are procedurally generated avatars, not real photographs.

Vault content relating to a Child is uploaded by the Parent at the Parent’s own discretion and does not depend on the Child being linked to a Partner Institution as a Student. It is never collected directly from, or submitted by, the child through a separate child account in the current release.

Note: Should Feezy introduce a separate teen/Child account offering (currently planned for users aged 13 and above) in the future, this Section and the corresponding eligibility provisions of our Terms & Conditions will be updated to reflect the data practices applicable to that account type before it becomes available.

If you believe a Student has been incorrectly linked to a Child profile or account, or if you have concerns about how Student information is being used, please contact us using the details in Section 11.

6. Data Retention

Account information is retained for as long as your account remains active.
Your 6-digit PIN is stored using industry-standard security measures and is retained for as long as your account remains active. As noted in Section 2.5, we do not collect or store any biometric data, so there is nothing biometric for us to retain.
Child profile information and Institution-linked Student relationships are treated separately. Unlinking a Student removes the Institution relationship from the Child profile but does not, by itself, delete the Child profile. The underlying Student record remains under the control of the relevant Partner Institution, as Feezy is not the owner of that record.
Vault content is retained for as long as you choose to keep it stored. Under Feezy’s hybrid Vault model, selected data or files may remain securely on the device for local App functionality, while the synchronized cloud record remains the source of truth for retention and deletion status.
When you delete an item from your Vault, it is removed from your Vault view and the relevant cloud storage quota is released. Underlying cloud data may remain in a restricted soft-deleted or backup state for a limited period where necessary for security, legal, operational, or backup-retention purposes, after which it is permanently and irrecoverably purged in accordance with Feezy’s retention practices and applicable law. Vault content is otherwise deleted, subject to the same process, upon deletion of your account as described below.
FeezyKeys balances within your KeyRing are retained for as long as your account remains active and are deleted upon deletion of your account, subject to Section 7.6 of our Terms & Conditions.
Transaction and payment history is retained as required for financial record-keeping, dispute resolution, and compliance with applicable law, even after account deletion, where legally necessary.
Account deletion requests are processed within 30 days of your request. You may cancel a pending deletion request at any time during this period by logging back into the App. Once the 30-day period lapses, your account, associated personal information, and Vault content will be deleted subject to the limited retention process described above. Notwithstanding the foregoing, certain records or backups may continue to be retained for a limited period where necessary to comply with legal, financial, security, operational, or backup-retention requirements.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you;
Delete your account and associated information, via the in-app deletion flow described in Section 6 as well as through the web page;
Unlink a Student from a Child profile or your account at any time via Settings;
Delete any content stored in your Vault at any time via the App;
Withdraw consent for optional data (name, email) by removing it from your profile.

To exercise any of these rights, or for any request relating to Student data accuracy (which should generally be raised with both Feezy and the relevant Partner Institution), please contact us using the details in Section 11.

8. Data Security

We implement reasonable technical and organizational measures to protect the information we hold. Phone-number OTP authentication is handled through Firebase; email OTPs are generated and verified by Feezy’s backend; and, following successful authentication, Feezy’s NestJS/backend issues and manages JWT access and refresh tokens for session management. We also use your 6-digit PIN, encrypted transmission of data, and access controls limiting who can view Student records on our administrative systems.

Where you enable biometric authentication as a quicker way to enter your PIN, this is processed solely by your device’s own operating system and is never transmitted to or stored by us.

Feezy uses a hybrid Vault model. Selected Vault data or files may remain securely on your device for local App functionality, while synchronized Vault content is stored using Supabase in the cloud and is encrypted. The cloud record remains the source of truth. Cloud content uploaded to the Vault may be subject to automated malware and security scanning to help protect the Service and its users from harmful or malicious content; this scanning is conducted for security purposes only, and Vault content is not reviewed or used for advertising or profiling purposes.

However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Data Transfers

Some of our service providers (such as Firebase and Supabase) may process or store data outside of your country of residence. Where this occurs, we take steps to ensure such providers maintain appropriate safeguards for your information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes through the App or via email (if provided). Your continued use of the App after such changes take effect constitutes your acceptance of the revised Policy.

11. Contact Us

Feezy — A product of BRONCO PARTNERS (PRIVATE) LIMITED

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

Email: hello@feezy.pk

Because they’ll always be your child.