Privacy Policy

Information we handle

The information we handle depends on how a person uses the Services and what an educational centre needs to operate.

• Teacher and staff information: name, email address, phone number, profile information, role, category, internal or other required identifiers, and, when provided, date of birth, gender, and blood group. We also handle account and authentication data, including account IDs, password hashes, and session or token records.
• Student and parent or guardian information: names, contact details, date of birth, gender, optional blood group, school, class, centre, interests, and images. Educational and operational records may include attendance, routines, daily Niyam activity, quiz answers and scores, progress, event participation, feedback, leave records and reasons, points, rankings, carts, and orders.
• Technical and security information: authentication and security events and request metadata that may include an IP address, device or browser details, and timestamps. The web apps use local browser storage for session state and preferences. Our systems and service providers may also retain app update and diagnostic records.
• Messages and support information: information included in emails, support requests, WhatsApp messages, or other communications that you choose to send to us.

Optional product analytics

Administrators and teachers may separately choose to enable limited product analytics. The choice is off until the user opts in and can be withdrawn at any time from the analytics control in the relevant service. Withdrawing consent stops future collection and resets the analytics identity active in that browser session. The admin service records the choice in local browser storage and a same-site preference cookie containing only a version marker so committed server outcomes follow the same choice.

When enabled, we use PostHog's United States service to receive manually selected events such as an approved screen template or an aggregate successful operation. We do not enable automatic interaction capture, session replay, person profiles, heatmaps, performance capture, or IP geolocation. Analytics events are not permitted to contain names, email addresses, phone numbers, dates of birth, parent or guardian information, leave reasons, feedback, quiz content, authentication data, form bodies, or raw URLs and query strings. The student PWA does not include the PostHog SDK or project token.

Optional product analytics is used only to understand feature adoption and improve the reliability and usability of the Services. We retain it for no longer than 12 months. To request deletion of previously collected optional analytics, contact us using the details below and identify the browser, account, and approximate dates involved. We may request information needed to verify the request without asking for a password or token.

How we use information

We use information as reasonably needed to:

• authenticate users, manage accounts, roles, permissions, and centres;
• support teaching and educational administration, including attendance, routines, daily Niyam activity, quizzes, progress tracking, events, feedback, leave management, points, rankings, and student orders;
• send service, educational, and administrative communications;
• respond to questions, support requests, and account requests;
• secure, diagnose, maintain, update, and improve the reliability of the Services; and
• comply with applicable legal obligations and resolve disputes.

Children's and student information

Student information, including information about children, is supplied and administered by parents, guardians, teachers, or authorised educational staff for educational and centre operations. Access is limited according to assigned roles and operational need. A parent or guardian may contact us to request access to, correction of, or deletion of a child's information, subject to identity and authority verification and any lawful recordkeeping requirements.

Service providers and where data is processed

We use service providers to operate the Services. These include our application and database hosting providers; Cloudflare R2 for files uploaded through the admin service; Resend for account and password-reset emails; PostHog's United States service when an administrator or teacher opts into limited product analytics; and WhatsApp if a user chooses to contact us through the website link. A provider receives the information needed for the relevant function. Its own terms and privacy notice also apply to its processing.

Some of these providers may process or store information outside India, where privacy laws may differ. Contact us if you would like current information about the providers used for a particular part of the Services.

We do not sell personal information. We do not use personal information for targeted advertising or track people across apps and services owned by other companies.

Security

We use safeguards designed to protect personal information, including role-based access controls, HTTPS for information sent between the apps and our service, password hashing, browser session controls, and server-side token revocation. Access by teachers and staff is intended to be limited to their assigned role and educational responsibilities. No method of transmission or storage is completely secure, so we cannot promise absolute security.

Retention

We do not apply one fixed retention period to every record. Retention is determined by the duration of the account or educational relationship, the centre's operational and recordkeeping needs, security and dispute-resolution needs, and applicable legal requirements. A verified deletion request is reviewed against those criteria; records may be deleted, deactivated, or retained where a continuing need or legal requirement applies.

Your requests and choices

You may ask to access or correct personal information, deactivate an account, or delete personal information by contacting us using the details below. Please identify the person and account or centre concerned and describe the request. We may ask for information needed to verify your identity and, for a child's information, your authority to make the request. We will respond in accordance with applicable law. Some information may be retained or a request may be limited where required or permitted for security, fraud prevention, legal compliance, disputes, or necessary educational records.

Changes to this policy

We may update this Privacy Policy as the Services or legal requirements change. We will update the effective date above. Where appropriate, we may also provide notice through the Services or our usual communication channels.