Safe Steps Privacy Policy

Safe Steps is a virtual-reality road-safety training programme used by schools and institutions. A student walks a simulated town in a VR headset and practises real road skills — crossing at a zebra crossing, obeying a traffic signal, walking on the correct side of the road, boarding a school bus safely, and reacting to traffic. The application scores that practice so a teacher or trainer can see how the student is progressing.

Because the programme is used by school-age learners, we keep the data we collect narrow and purposeful: enough to identify the learner to their school and to measure their road-safety performance, and nothing more. We do not sell personal data, we do not use it for advertising, and we do not build profiles for any purpose outside the training programme.

Safe Steps is developed and operated by XpertLab (“we”, “us”). We act as the operator of the platform. The school, institution or organisation that enrols a student decides which students take part and who may view their results — in data-protection terms, that organisation determines the purpose of the processing and we process the data on its behalf and to run the service.

If a student was enrolled by a school, questions about why a particular account exists, who has access to it, or how long the school keeps results should go to the school first. Questions about the platform itself can come straight to us, using the details in section 15.

All of the following is either entered by an administrator when an account is created, chosen by the player in the application, or produced automatically as a training session is played.

VR hardware is capable of sensing a great deal about a person and the room they are in. This application requests none of it. The headset build asks for only two Android permissions — network access and network state — which are what it needs to talk to our server. Specifically, we do not collect:

• Camera images, passthrough video or any photograph of the player or the room
• Microphone audio or voice recordings
• Eye-tracking, face-tracking or facial-expression data
• Hand, body or biometric identification data — hand and controller movement is used to drive the simulation in the moment and is never sent to us or stored
• Room scans, spatial maps or floor-plan data
• GPS or precise location; the city and state on an account are typed in, not sensed
• Advertising identifiers, ad-tracking data or third-party marketing cookies
• Payment card or bank details — the application takes no payments
• Contacts, messages, photos or any other content from the device

We use the information described above only to:

• Create and authenticate a learner’s sign-in on the headset
• Run the training simulation and adapt it to the learner (eye height, movement speed, audio)
• Score road-safety performance and produce the session report a teacher or trainer reviews
• Show progress over time — attempts, best and average score, grade and last played date
• Enforce programme rules, such as requiring the introductory video to be watched before the first session and applying the retry cooldown after a failed assessment
• Let the school’s administrators manage their learners through the administration panel
• Keep the service working: diagnose faults, investigate abuse, maintain security and keep an audit trail
• Produce aggregated, de-identified statistics about road-safety learning outcomes — figures that cannot be traced back to an individual learner

We do not use this data for automated decisions with legal or similarly significant effects. A score in Safe Steps is a training result, not a certification or a judgement about a person.

We process this data on the basis of the consent obtained before a learner is enrolled, and to perform the training service that the school or institution has asked us to provide. Where a learner is a child, consent is obtained from a parent or legal guardian, as required by the Digital Personal Data Protection Act, 2023 in India. Some limited processing — for example security logging and the administrative audit trail — is carried out because we are obliged to keep the service secure and accountable.

Consent can be withdrawn at any time. Withdrawal does not affect processing already carried out, but after withdrawal the account is closed and the data is handled as described in section 9.

Safe Steps is designed for school students, so we assume from the outset that our users may be children. Accounts are not created by children themselves: a school or programme administrator creates each account, and a learner can only sign in with credentials issued to them.

We do not show advertising in the application, we do not track children across other applications or websites, and we do not use their data to profile them or to target them with anything. The data we hold about a child is confined to what section 3 lists.

A parent or guardian may ask, through the child’s school or directly using the contact details in section 15, to see what we hold about their child, have it corrected, or have it deleted. We verify that a request genuinely comes from the parent or guardian — usually through the enrolling school — before we act on it.

We share personal data only in these situations:

• With the learner’s own school or institution — its authorised administrators can see that learner’s profile and results in the administration panel. Access is limited by role and permission, so an administrator only sees what their role allows.
• With service providers who run the infrastructure for us, such as our hosting and database provider. They process data on our instructions only, and may not use it for their own purposes.
• When the law requires it — for example a valid order from a court or a competent authority — or to establish, exercise or defend a legal claim.
• To protect people or the service: to investigate suspected abuse, security incidents or fraud.
• As anonymous, aggregated statistics, which by definition no longer identify anyone.

We do not sell personal data, rent it, or trade it with advertisers or data brokers. Ever.

Account and result data is kept for as long as the learner is enrolled in the programme, so that progress across sessions stays meaningful. When an account is removed by an administrator it is first deactivated and marked as deleted — which hides it from everyday use while allowing an accidental deletion to be reversed — and is then permanently erased, along with its session records and event logs, when the school confirms it or within a reasonable period after the enrolment ends.

Technical server logs are kept for a short period for security and fault diagnosis, and administrative audit records are kept for as long as we need to demonstrate who changed what. Aggregated, de-identified statistics may be kept indefinitely, because they no longer relate to an identifiable person.

Passwords are stored only as salted one-way hashes and are never readable by us or by an administrator. Traffic between the headset, the administration panel and our servers travels over encrypted HTTPS connections. Access to the administration panel requires a sign-in, is issued as a short-lived token, and is restricted by a role-and-permission system, so each administrator sees only what their role allows. Administrative changes are recorded in an activity log.

No system can promise perfect security, but if a breach affecting personal data occurs we will notify the affected schools and the relevant authority as the law requires, and tell them what happened and what to do about it.

In the VR application: after a successful sign-in the headset stores the learner’s session token and basic profile details (user ID, name, email, school) locally on the device, so the learner does not have to type credentials again on every launch. Signing out clears them.

On this website: we set no cookies. If you use the light/dark switch, that choice is remembered in your browser’s local storage and never leaves your device.

Subject to the law that applies to you, you may ask us to do the following with your personal data, or that of a child in your care:

• Access — get a copy of the information we hold and a summary of how it is processed
• Correction — have inaccurate or incomplete details fixed
• Erasure — have the account and its results deleted, where no legal obligation requires us to keep them
• Withdraw consent — stop further processing, which will close the account
• Nominate — name someone who may exercise these rights on your behalf if you are unable to
• Complain — raise a grievance with us, and escalate it to the data-protection authority in your jurisdiction if you are not satisfied with our response

Write to us using the details in section 15. We will verify the request — usually through the enrolling school — and respond within the period the applicable law allows, and in any case without undue delay.

Learner accounts, session results and event logs are held on servers operated for us by our hosting provider. If data is stored or processed outside the country a learner is in, we make sure it stays protected to the standard this policy describes, through the contractual terms we hold our providers to.

We may update this policy as the programme changes — for example if a new feature collects something new. When we do, we revise the “last updated” date at the top of this page. If a change materially affects how a learner’s data is used, we will tell the enrolling schools so that parents and guardians can be informed, and where the law requires it we will ask for consent again.

For any question about this policy, to exercise the rights in section 12, or to raise a grievance about how personal data is handled in Safe Steps, contact us:

If a learner was enrolled by a school, please also contact that school — it decides who takes part in the programme and who may see the results.