Privacy Policy

DRAFT, pending counsel review. This text has not been reviewed by a lawyer and is not yet in force. Version: draft 0.1, 21 October 2026.

Gyanu ("we", "us") is an online learning service for school students in Classes 6 to 12 in India. This policy explains what personal data we hold, why, for how long, and the choices you have under the Digital Personal Data Protection Act, 2023 (DPDP Act). Because our students are children, a parent or lawful guardian is the person who gives consent for a child.

1. Who is responsible

The company that operates Gyanu is the Data Fiduciary. Legal entity name and registered address: to be inserted before launch. Contact for privacy requests and grievances: hello@gyanu.taxifo.com (placeholder mailbox, to be replaced). A named Grievance Officer will be listed here before launch.

2. Children and parental consent

A student under 18 can use Gyanu only with verifiable consent of a parent or lawful guardian. We verify consent by sending a one-time code to the parent's mobile number, and we record who consented, when, for which purposes and against which version of this policy.
We do not track or monitor children's behaviour for advertising, and we do not show targeted advertising to children.
We do not process a child's data in a way likely to cause harm to the child's well-being.
A parent can withdraw consent at any time (section 9). Withdrawal ends the child's account and starts deletion, subject to the legal retention in section 7.

3. The data we hold and why

Data	Examples	Why we use it
Student profile	Name, class, board, school name, section, roll number, mobile number, email (optional), subjects chosen	To run the account, put the student in the right class and content
Parent or guardian	Mobile number, name, the link to the child, consent records	Verifiable consent, parent dashboard and reports
Sign-in data	One-time codes, session records (a hashed token, device, time)	To sign in securely and revoke sessions
Learning activity	Practice answers, chapter test attempts and scores, mastery bands, progress, streaks, XP and badges, bookmarks, study plan	To personalise practice, show progress and produce reports
Live classes	Which class a student joined and when, chat messages, reactions, "I'm lost" signals, answers to class questions, raised hands, team and cohort membership	To run the class and give the teacher feedback on the class
Class recordings	The teacher's audio, the board and the class events. The server records every class. Student cameras are never on. A student who is chosen to speak may be heard in the recording.	To let enrolled students replay a class, and for moderation and quality
Doubts and tutoring	Questions typed or photographed by the student, answers, ratings, tutoring bookings	To answer doubts and deliver tutoring
Payments	Plan, orders, invoices, amounts, payment status and a reference from the payment gateway. We do not store card numbers or UPI PINs.	To sell and bill subscriptions and meet tax law
Devices	Push notification token, platform, app version, language	To send notifications and fix problems
Support	Tickets, messages, attachments	To help you
Technical logs	Server logs, connection quality for live classes (which network path succeeded, time to connect)	Security, reliability and capacity planning

We collect only what these purposes need. Students cannot record live classes; the app blocks screen capture where the platform allows it.

4. Who we share data with

We do not sell personal data. We share it with processors who work for us under contract: the cloud and hosting providers that run our servers and media, the payment gateway, SMS and push-notification providers that deliver one-time codes and notifications, and email or support tooling. We disclose data when the law requires it or a court or authority lawfully orders it. Named processors will be listed here before launch.

Teachers see the students in their own classes (names, participation, answers to class questions). Parents see their own child's data.

5. Where data is stored

Data is stored on servers we control or rent. Any transfer outside India will be to countries not restricted by the Government of India under the DPDP Act, and this section will name the locations before launch.

6. Security

Sessions use random tokens stored only as hashes. Traffic is encrypted in transit. Staff access is through roles with the minimum permissions needed, and staff actions on personal data are written to an audit log. If a personal data breach occurs, we will notify the Data Protection Board of India and the affected people as the law requires.

7. How long we keep data

Data	Kept for	Then
Sign-in codes	1 day	Deleted
Revoked or expired sessions	90 days	Deleted
Class chat	365 days	Author removed (anonymised)
Doubts and their text	730 days after last activity	Anonymised
Uploads by students	730 days	Deleted
Class recordings	365 days after the class	Deleted
Audit log	1,095 days online	Archived, never edited
Tax invoices	8 years, as tax law requires	Archived
Inactive accounts (no sign-in for 3 years, no subscription)	3 years	Anonymised

These are the periods the service is set to today and may change; the current schedule will be kept in step with this page. Data we must keep by law is kept for that period only.

8. Cookies and tracking on this website

This website sets no cookies and uses no analytics, advertising or third-party trackers. The contact form opens your own email program; nothing is sent to us until you send it.

9. Your rights

You, or a parent on a child's behalf, may ask us to:

tell you what data we hold and who we shared it with;
correct or complete data;
erase data, or withdraw consent, which we act on unless the law requires us to keep it;
nominate another person to exercise your rights if you die or become incapacitated;
address a grievance.

Write to hello@gyanu.taxifo.com. We will confirm receipt and aim to respond within a time to be fixed with counsel (the draft target is 30 days). If we do not resolve a grievance, you may complain to the Data Protection Board of India.

10. Changes

When we change this policy in a way that matters, the app asks for consent again against the new version, and the version and date at the top change.