Legal

Privacy Policy

This policy explains what personal data Gyaanverse handles, why we handle it, who we share it with, and the rights you have over it. It is written to meet the notice requirements of India's Digital Personal Data Protection Act, 2023.

Last updated TODO: publication date

1. Who we are

Gyaanverse is a platform that coaching institutes use to run batches, conduct online tests, evaluate answer sheets with AI assistance, and manage fee collection.

  • Legal entity: TODO: registered name and entity type — private limited, LLP or proprietorship
  • Registered address: TODO: full registered address with PIN code
  • Registration number: TODO: CIN / LLPIN / GSTIN, as applicable
  • Contact: TODO: support email address

2. Two different roles we play

This distinction decides who is accountable for what, so please read it before the rest.

  • For institute accounts — when an institute owner or a teacher signs up, we decide how their account data is handled. We are the Data Fiduciary for that data.
  • For student records— when an institute enrols students, uploads answer sheets, or records fees, the institute decides what to collect and why. We process that data on the institute's instructions as a Data Processor. The institute is the Data Fiduciary, and is responsible for having a lawful basis, for issuing its own privacy notice to students and parents, and for obtaining parental consent where required.

If you are a student or a parent and want a record corrected or deleted, contact your coaching institute first — they control that record. We will support them in acting on your request, and you can also escalate to our Grievance Officer in section 10.

3. What data we handle

Account data

  • Name, email address, password (stored only as a salted hash), and role — owner, teacher or student.
  • Email verification status and session records.
  • Institute name, subdomain, and the signup intent that distinguishes a student account from a coaching-owner account.

Academic data entered by an institute

  • Student enrolment records and batch membership.
  • Question banks, exam papers and exam schedules created by teachers.
  • Exam attempts, responses, uploaded or scanned answer sheets, marks, AI evaluation output, and teacher overrides.
  • Performance reports derived from the above.

Fee and payment data

  • Fee structures, invoices, receipts, payment allocations, concessions and adjustments recorded by the institute.
  • Guardian contact details, where an institute records them for fee correspondence.
  • Payment transaction references returned by our payment gateway. We never receive or store card numbers, CVVs, UPI PINs or net-banking credentials — those go directly to the gateway.

Technical data

  • Server logs containing IP address, timestamp, requested route and error traces, used for security and debugging.
  • A session cookie required to keep you signed in. We do not use advertising or cross-site tracking cookies.

4. Children's data and parental consent

Many students on this platform are under 18. The DPDP Act treats children's data as a heightened-risk category, and we follow those rules strictly.

  • Verifiable parental consent is requiredbefore a child's data is processed. The institute that enrols the student is responsible for obtaining and holding that consent, and warrants to us that it has done so.
  • We do not run behavioural advertising of any kind, to any user, and we do not direct targeted advertising at children.
  • We do not track or profile children for any purpose beyond delivering and reporting on their own coursework to their own institute, and to a parent or guardian the institute has linked to them.
  • We do not knowingly allow a child to create a direct account outside an institute or a guardian-supervised signup. If you believe a child has registered without parental consent, contact our Grievance Officer and we will act on it.

TODO: Confirm the exact parental-consent mechanism you will require of institutes — a signed admission-form clause, an in-app guardian confirmation, or both — and describe it here. This is the most heavily penalised area of the DPDP Act, so this paragraph should describe what you actually do, not an intention.

5. Why we handle it

  • To provide the service — authenticating users, running exams, evaluating answers, producing reports, generating invoices and receipts.
  • To keep the service working — monitoring, debugging, backups, and investigating abuse or security incidents.
  • To bill institutes — managing subscription plans and processing payments.
  • To communicate — transactional email such as email verification, password reset, invitations, exam notifications and fee reminders. We do not send marketing email to students.
  • To meet legal obligations — tax, accounting, and lawful requests from authorities.

Processing rests on the consent obtained at signup (and parental consent for children), on performing our contract with the institute, and on our legal obligations.

6. Who we share it with

We do not sell personal data, and we never share it for advertising. We share it only with the service providers needed to run the platform:

  • Railway — application hosting, database and background job processing.
  • Vercel — hosting for the web interface.
  • Cloudinary — storage of uploaded files, including scanned answer sheets.
  • Resend — delivery of transactional email.
  • Razorpay — payment processing for subscriptions and fees.
  • Google (Gemini) — the AI model that evaluates submitted answers. See section 7.

We also disclose data where the law requires it, and to professional advisers under a duty of confidentiality.

Cross-border transfer: some of these providers process data outside India. TODO: Confirm the hosting region of each provider above and state it here, so the transfer disclosure is accurate rather than generic.

7. How AI evaluation works

When an answer is submitted for AI evaluation, the content of that answer — including the image of a handwritten or scanned answer sheet, and the associated question — is sent to Google's Gemini model so it can identify the step where a mistake occurs and generate feedback.

  • We send the academic content of the submission and the question. We do not send the student's name, email address, contact details or fee records to the model.
  • AI output is assistive, not final. It can be wrong. A teacher can review and override any AI-generated mark or comment, and answers the system is not confident about are held for human review before results are published.
  • We do not use your submissions to train our own models, and we do not permit the model provider to use them to train theirs beyond what is needed to return a result.

8. How long we keep it

  • Account data: TODO: retention period after account closure
  • Exam attempts, answer sheets and results: TODO: retention period — institutes typically need these for at least a full academic year
  • Fee records, invoices and receipts: TODO: retention period — Indian tax and accounting law requires books of account to be kept for 8 years, which will likely set this number
  • Server logs: TODO: retention period, typically 30 to 90 days

When an institute closes its account, we delete or return its data in accordance with the terms agreed with that institute, except where we must retain records to meet a legal obligation.

9. Your rights

Under the DPDP Act you may:

  • Ask for access to a summary of the personal data we hold about you and how it is processed.
  • Ask for correction of inaccurate or incomplete data, and for it to be completed or updated.
  • Ask for erasure of your data where we no longer need it for the purpose it was collected for, or where you withdraw consent.
  • Withdraw consent you previously gave, with the same ease as giving it. Withdrawing consent that the service depends on may mean the account can no longer be used.
  • Nominate another person to exercise your rights in the event of death or incapacity.
  • Raise a grievance with us, and escalate to the Data Protection Board of India if our response does not satisfy you.

To exercise any of these, write to our Grievance Officer below. If your data was entered by a coaching institute, we will route the request to that institute, since they control the record.

10. Grievance Officer

A named grievance contact is mandatory under the DPDP Act and the IT (Intermediary Guidelines) Rules. Ours is:

  • Name: TODO: full name of the designated officer
  • Designation: TODO: Grievance Officer, or Data Protection Officer
  • Email: TODO: a monitored address, for example grievance@gyaanverse.com
  • Postal address: TODO: address for written complaints
  • Response time: we acknowledge complaints within 24 hours and aim to resolve them within 15 days.

If we do not resolve your grievance satisfactorily, you may escalate to the Data Protection Board of India.

11. How we protect data

  • Traffic is encrypted in transit with TLS.
  • Passwords are stored only as salted hashes, never in readable form.
  • Every institute's data is isolated by tenant, and requests are checked against the tenant they belong to.
  • Access to production systems is limited to the people who need it.
  • We take regular database backups.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board as the DPDP Act requires.

12. Changes to this policy

If we change this policy, we will update the date at the top of this page and, where the change materially affects you, notify account holders by email.