Privacy policy

Children come first

Every student profile is treated as belonging to a child. Before a child can ask questions, buy tokens or book a teacher, a parent or guardian must give verifiable consent. Until then the child can only see free content.

We do not track children, monitor their behaviour or show them targeted advertising. There are no advertising trackers on student pages.

What we collect

• Account: the email address or mobile number you sign in with, and the roles on it (student, parent, teacher). If you sign in with Google, also your Google account ID (see below).
• Student profile: first name, class, medium of study, app language and a 4-digit PIN (stored only as a hash).
• Consent record: the parent's name, relationship, email address or phone number, how and when they approved, and the IP address and device used.
• Questions: the text, photos or PDFs a student sends, and the answers given.
• Live sessions: a recording of the teacher's video and audio and the student's audio (the student's camera is never used), and the session chat.
• Payments: the pack bought, amount, and Razorpay order and payment IDs. We never see or store card numbers or UPI PINs.
• Teachers: name, subjects, PAN and bank account (we keep only the last four digits after verification), IFSC, DigiLocker verification result and police verification certificate.

Signing in with Google

If you choose "Continue with Google", Google shares only two things with us, with your permission: your Google account ID and your email address (with whether Google has verified it). We do not ask for your name, photo, contacts, files or anything else in your Google account.

• We use them only to sign you in and to recognise the same account when you sign in again, by Google or by a code sent to the same email.
• We store them with your account and nowhere else. We do not sell them, use them for advertising, share them with anyone other than the service providers below that run the service, or use them to train AI models.
• You can remove our access at any time at myaccount.google.com/permissions. To delete your account and the Google data we hold, write to us at the address under "Your rights".

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Why we use it

• To run the service: sign-in codes, answers, sessions, the token wallet and teacher payouts.
• To keep children safe: parental consent, session recordings that parents can watch, a chat filter that blocks contact details, and review of reported sessions.
• To meet legal duties: tax, accounting and law-enforcement requests made under Indian law.

Who processes it for us

We use these service providers, under contract, only to run Shiksit Tutor: Supabase (database, Mumbai region), Vercel (hosting, Mumbai region), Cloudflare R2 (storage of photos and recordings), LiveKit (live sessions), Google ("Continue with Google" sign-in), Resend (sign-in codes and consent emails), Meta WhatsApp Business and an Indian SMS provider (messages), an AI model provider (answers to questions), Razorpay (payments) and a DigiLocker / KYC provider (teacher verification). We do not sell personal data.

How long we keep it

• Session recordings: 365 days, then deleted.
• Question photos: 90 days, then deleted.
• Payment, wallet and payout records: as long as tax and accounting law requires.
• Everything else: while the account is open, and deleted on request unless the law requires us to keep it.

Your rights

You can ask to see the data we hold, correct it, or delete it, and a parent can withdraw consent for their child at any time. Withdrawing consent stops new questions and sessions; it does not undo payments already made. You can also nominate someone to exercise these rights on your behalf.

Write to our grievance officer, [Grievance officer name], at [grievance@shiksit.in]. We acknowledge within 24 hours and aim to resolve within 15 days. If you are not satisfied, you can complain to the Data Protection Board of India.