1. Scope and roles
This Policy applies to the public website, family application, support, billing and related services. The parent or lawful guardian is the Data Principal for their own data and acts for a child where permitted by law. A child means a person under 18 for purposes of India's Digital Personal Data Protection Act, 2023.
2. Data we collect
- Parent and family account data: name, email, family name, password hash, consent evidence, settings, support messages and account status.
- Child profile data: name or chosen display name, avatar, class, medium, school name if provided, PIN hash and family relationship.
- Learning data: answers, scores, attempts, time spent, mastery estimates, plans, progress, exam dates, worksheets, reports and earned rewards.
- Uploaded material: worksheets, papers, images or PDFs and text extracted from them, plus review decisions.
- Future payment data: after paid plans launch, this may include plan, seats, price, order and payment identifiers, payment status, refunds and reconciliation records. Complete card, bank and UPI credentials would be handled by the payment provider and would not be stored by us.
- Technical and security data: IP address, browser user agent, session and CSRF identifiers, timestamps, device or browser storage, error logs and abuse-prevention records.
- Cookieless analytics data: Google Analytics receives sanitised page paths, broad device and browser information, approximate location derived by Google, referral source, and coarse events such as signup completion, login, pricing views, plan interest, checkout stage, aggregate purchase value and practice completion. Checkout analytics may include only the billing interval, number of seats, purchase type, currency, aggregate value, availability and coarse outcome. Analytics storage remains denied, so Google Analytics cookies and persistent analytics identifiers are not used. We do not send names, email addresses, answers, child identifiers, plan, order or payment identifiers, uploaded content, payment error text or other free-text fields.
- Communications: feedback, complaints, privacy requests and records needed to resolve them.
3. Why we use data
We use personal data to create and secure accounts, deliver curriculum-aligned learning, personalise practice, keep separate child progress, show parent reports, provide support, prevent fraud and abuse, improve reliability, meet legal duties and defend lawful claims. After paid plans launch, we may also process payment records to provide paid access. We do not use child data for targeted advertising.
4. Parent consent and children's data
A parent or lawful guardian must provide affirmative consent before a child profile is created. At signup we record the accepted policy version, time, IP address, browser user agent and the server-controlled acceptance wording. We ask parents to provide only the minimum information needed for learning.
We do not sell children's personal data. We do not serve behavioural advertising to children. We do not track or profile a child for advertising. Learning progress and recommendations are used only to operate the educational service for that family, keep it safe and improve it in a manner permitted by law. We do not knowingly allow a child to create an independent account.
5. AI-assisted processing
Artificial intelligence may help classify content, adapt practice, generate or revise educational material, identify possible learning gaps, or extract text from uploaded files. These processes can make mistakes. Parents can report an issue and should not provide sensitive information in prompts, uploads or free-text fields. We do not permit solely automated decisions that produce legal or similarly significant effects on a child.
6. When data is shared
We share only what is reasonably needed with service providers acting for us, such as hosting, database, email, security and error monitoring. Google processes the limited cookieless analytics data described above as our analytics provider. Analytics storage, Google advertising storage, advertising personalisation and Google Signals are disabled for this service. Razorpay is not currently active for customer checkout. After paid plans launch, the disclosed payment provider may receive payment and transaction information under its own privacy terms. Providers must be selected and contracted with appropriate confidentiality, security and data-processing obligations.
We may disclose data where required by law, court order or lawful authority; to investigate fraud, security or child-safety concerns; during a business restructuring subject to appropriate protections; or with your direction or consent. We do not sell personal data or provide it to data brokers.
7. Storage and international processing
The primary production service and database are hosted in India. Some support or technology providers may process limited data in another location where permitted by law and subject to appropriate safeguards. Google Analytics may process limited cookieless analytics data outside India under Google’s applicable data-transfer and privacy terms. Provider locations and material cross-border processing are reviewed when vendors change.
8. Retention
We keep account and learning data while the family account is active and for a reasonable period needed for support, recovery, fraud prevention, legal compliance and dispute handling. Payment and consent records may need to be retained for tax, accounting, legal or evidentiary periods. Uploaded files and operational backups are removed on managed schedules. We delete or anonymise data when it is no longer required, unless law requires retention or a legal claim makes preservation necessary.
9. Security
Safeguards include encrypted transport, password hashing, access controls, secure cookies, CSRF protection, rate limits, restricted infrastructure access, tenant separation, logging and backups. No internet service can promise absolute security. If a personal-data breach requires notice under applicable law, we will take containment steps and notify affected people and authorities as required.
10. Cookies and browser storage
We use essential cookies and browser storage for login sessions, security, theme, offline learning state and application operation. These essential technologies cannot be disabled while using account features. Google Analytics runs in cookieless mode without a separate consent popup. Analytics storage is always denied, Google Analytics cookies and persistent analytics identifiers are not used, and any accessible legacy Google Analytics cookies are removed. The browser sends only the limited traffic and coarse event data described above. We do not use third-party advertising cookies.
11. Your rights and choices
Subject to applicable law, a parent or guardian may request information about processing, access to a summary of personal data, correction, updating, deletion, withdrawal of consent, account closure and grievance redressal. Withdrawal does not make earlier lawful processing invalid, and may require the child profile or service to be disabled where the data is necessary to provide it.
We may verify identity and parental authority before acting on a request. We will explain if data must be retained or a request cannot be completed. Requests can be sent to notuitionin@gmail.com or through the in-app complaint form.
12. Grievances and complaints
Contact our grievance contact using the details below. Consumer complaints will be acknowledged within 48 hours and handled within one month where the Consumer Protection (E-Commerce) Rules, 2020 apply. Privacy requests and grievances will be handled within the period required by applicable data-protection law. You may use a statutory complaint route after first giving us a reasonable opportunity to resolve the matter.
- Service
- NoTuition.in
- Customer support
- notuitionin@gmail.com
- Privacy requests
- notuitionin@gmail.com
- Grievance contact
- notuitionin@gmail.com
13. Changes to this Policy
We may update this Policy when data practices, vendors, features or law change. The version and effective date will change. We will provide notice and obtain fresh consent when required.