Privacy Policy

The Service is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], India. Where we decide why and how personal data is processed, we are the Data Fiduciary under the DPDP Act.

General contact: support@yuktilearn.in, [PHONE]. Privacy requests and complaints go to our Grievance Officer (see section 14).

This policy covers:

• visitors to our website;
• school staff, such as principals, teachers and school administrators;
• students who use the Service through their school; and
• people who ask for an account through the “Request access” form.

School-managed accounts

A school that licenses Yukti Learn decides which of its staff and students get accounts, and the school (or our platform administrator, at the school’s request) enters their details. For this data the school decides why and how it is processed, and we process it on the school’s behalf and on its instructions under our agreement with the school. The school is responsible for having a lawful basis for this processing, including the consent of a parent or lawful guardian for every student, and for answering requests from its staff, students and parents. We help the school do so.

Where we decide the purpose ourselves (for example, keeping the Service secure, managing licences and credits, running the shared lesson library and meeting legal obligations), we act as a Data Fiduciary and this policy applies to us directly.

Request-access accounts

The “Request access” form creates an inactive account, which our platform administrator may approve or reject. Only adults (18 or older) may use it. Children must not request access themselves: they may use the Service only through an account created by their school.

We do not ask for or collect dates of birth, photographs, physical location, contact lists, biometric data, health information, Aadhaar or other government identifiers, or payment card or bank details. The Service does not record your camera or microphone. Do not enter any of this information into a request or a file.

• Accounts and sign-in: to create and manage accounts, confirm who you are and keep you signed in (account details, sign-in cookies).
• Providing the Service: to create lessons, add narration, show lessons to your classes and keep your school’s library (what you submit, lessons, school and class details).
• Library matching: to check whether a suitable lesson already exists before creating a new one (the text of your request; see section 6).
• Licences and credits: to manage your school’s licence, credit allowance and billing (activity and credit records, school details).
• Security and enforcement: to keep the Service secure and reliable, prevent misuse, enforce our Terms of Service (including rate limits and credit limits) and investigate problems (technical data, activity records).
• Improving the Service: to improve the quality of lessons and of library matching (request text and lessons, without your name or email address wherever possible).
• Service notices: to tell you about security issues, changes to our policies or your account (account details).
• Legal obligations: to comply with law, respond to lawful requests from authorities, and establish or defend legal claims (only the data needed).

We process personal data on the basis of consent (given by you, or for a child by a parent or lawful guardian through the school) or for a legitimate use allowed by Section 7 of the DPDP Act, such as complying with law. We use personal data only for the purposes listed above. We do not sell or rent personal data, we do not show advertisements, and we do not use personal data to train AI models.

Under the DPDP Act, anyone under 18 is a child. Most students on Yukti Learn are children, so we apply these rules:

• Parental consent through the school. Student accounts are created only by a school (its principal or teachers, or our platform administrator at the school’s request). Before a student account is created, the school must obtain verifiable consent from the student’s parent or lawful guardian for the processing described in this policy, keep a record of that consent and show it to us on request. Our agreement with each school requires this.
• No tracking or advertising. We do not track or behaviourally monitor children, do not build profiles of them, do not direct advertising at them, and do not use their data for analytics or marketing. We record only what is needed to run the Service for the school, such as which lessons a student’s account created and the credits it used.
• No harmful processing. We do not process children’s data in any way that is likely to harm their well-being.
• No personal details in requests. Students must never type their own or anyone else’s personal details into a request or a file. Teachers should supervise how students use the Service.
• Parents can act for their child. A parent or lawful guardian can exercise the child’s rights (section 11) through the school or by writing to our Grievance Officer. We verify the requester’s identity and relationship to the child, and may involve the school.
• Missing consent. If we learn that a child’s data was collected without the required consent, we will suspend the account and erase the data, unless the law requires us to keep it.

Lessons created on Yukti Learn are stored in a shared library owned by Yukti Learn. When anyone asks for a lesson, the Service first checks whether a suitable lesson already exists, and may give an existing lesson to a different school instead of creating a new one. This means:

• The content of a lesson (title, topic, learning objective, code, text and narration) can be shown to users at other schools. Other schools see the lesson, not your name or email address.
• The text of a request that matches an existing lesson may be stored with that lesson as a “sample query”, which is used only inside the Service to improve future matching. Sample queries are never shown to other schools and are stored without your name or account details.
• Your request history (the text of each request, its status and the resulting lesson) is stored with your account so you can follow your requests.
• Lessons created in your school join your school’s library. Other users in your school can see your name and role (for example, on the “Student creators” page), and nothing else about your account. Teachers, principals and school administrators can see the accounts, student IDs, classes, roll numbers, lessons and credit use of their school.

Because requests are sent to AI providers, and their text can shape a lesson that other schools may later see, never include names, roll numbers, contact details, photos, health information or any other personal information in a request or an attached file. If personal information is included, we may remove it, and we may delete or withhold the affected lesson.

We share personal data only with the service providers below, who process it on our behalf to run the Service, and we give each of them only what it needs. They are our Data Processors (or, for data a school provides, our sub-processors).

The AI providers receive what you type, not your name or email address, unless you type them into a request. Library matching also uses a text-matching model that runs on our own server and does not send your request to another company.

We also share personal data:

• with your school, as described in section 6;
• with courts, the Data Protection Board of India, CERT-In, law enforcement or other authorities when the law requires it or a lawful order is made;
• with our professional advisers (such as lawyers and auditors) under a duty of confidentiality, where needed; and
• with a successor, if we merge with or are acquired by another business or transfer the Service. The successor must keep to this policy, and we will tell you before your data is transferred.

We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers.

Some of the providers in section 7 process data outside India, mainly in the United States. The DPDP Act allows this except to countries that the Central Government restricts by notification. If a destination we use is restricted, we will stop or change that transfer. We choose providers that commit by contract to protect the data they process for us.

We use only cookies that are strictly necessary. When you sign in, our authentication provider (Supabase) sets sign-in cookies that keep you signed in. They are refreshed while you use the Service and are removed when you sign out or when they expire. If you block them, you cannot sign in.

We do not use analytics, advertising, social media or other tracking cookies, and we do not use third-party tracking tools. If we ever add any, we will update this policy first and ask for consent where the law requires it. We will never use them for children.

• Account, school and class details: while the account is active and the school’s licence continues. We erase or anonymise them when the account is deleted, or within 90 days after a school’s licence ends without renewal, except as set out below.
• Request history: kept with your account and erased when the account is deleted.
• Sample queries: stored without account details and kept while the lesson remains in the library. If you can tell us the text you used, we will erase it on request.
• Lessons: lessons belong to Yukti Learn and may stay in the shared library after the account that requested them is deleted. Other schools never see them with your name.
• Credit and billing records: for as long as needed for billing, audits and Indian tax and accounting law.
• Logs: server and security logs are kept for the minimum period the law requires (at present at least one year under the DPDP Rules), and longer only if needed for an investigation or by law.
• Legal minimums: where we act as an intermediary, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require us to keep registration information for 180 days after an account is cancelled. We keep it only for that purpose.
• Backups: erased data may remain in backups for a limited period until they are overwritten.

When a purpose has been served or consent is withdrawn, we erase the personal data within a reasonable time and instruct our processors to do the same, unless the law requires us to keep it.

Under the DPDP Act, you have the right to:

• Access information: a summary of the personal data we process about you and of our processing activities, and the identities of the other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared;
• Correction and erasure: have inaccurate or incomplete data corrected, completed or updated, and have data erased when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• Withdraw consent: at any time, as easily as you gave it. Withdrawal does not affect processing done before it. The Service cannot work without basic account data, so withdrawing consent will usually mean closing the account;
• Grievance redressal: have your complaint handled by our Grievance Officer (section 14); and
• Nominate: nominate another person to exercise your rights if you die or become unable to exercise them.

How to make a request. If your account was created by your school, you may contact the school, or write to [GRIEVANCE EMAIL] (from your registered email address, if you have one). A parent or lawful guardian may make requests for a child. We will verify your identity (and, for a child, your relationship to the child) before acting, may ask for more information, and will respond within the times in section 14. We do not charge for requests.

Your duties. Under Section 15 of the DPDP Act you must comply with applicable law, must not impersonate anyone, must not suppress material information when giving us personal data, must not file false or frivolous complaints, and must give only verifiably authentic information when you ask for a correction or erasure. A breach of these duties can attract a penalty under the DPDP Act.

• Connections to the website use encrypted HTTPS.
• Our backend server accepts requests only from the website’s own server, which must present a secret key. Browsers cannot call it directly.
• Database access rules limit what each signed-in user can read, and administrative keys are kept only on our servers.
• Lessons run in a sandboxed frame that cannot read your sign-in session.
• Rate limits and credit limits restrict automated misuse.
• We limit access to production systems to authorised people who need it.

No method of transmission or storage is completely secure. Keep your password secret, and tell us at once at support@yuktilearn.in if you think your account has been misused.

If a personal data breach occurs, we will, as the DPDP Rules require:

• inform each affected person (and, for school accounts, the school) without delay and in plain language: what happened, when, and how much data was involved; the likely consequences; what we have done and are doing to reduce the risk; the steps you can take to protect yourself; and how to contact us;
• inform the Data Protection Board of India without delay, and send it a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows); and
• report cyber security incidents to CERT-In within the time it requires.

Grievance Officer: [GRIEVANCE OFFICER NAME]
[COMPANY LEGAL NAME], [REGISTERED ADDRESS]
Email: [GRIEVANCE EMAIL] · Phone: [PHONE]

We acknowledge every complaint or request within 24 hours and resolve it within 15 days of receiving it. Please include your name, registered email address, your school (if any), what the complaint is about, and what you would like us to do.

If you are not satisfied with our response, you may complain to the Data Protection Board of India through its online platform (details are published by the Ministry of Electronics and Information Technology at meity.gov.in). Under the DPDP Act, you must use our grievance process before approaching the Board.

We may update this policy. The date at the top shows the latest version. If a change is material, we will tell you by email or by a notice in the Service before it takes effect and, where the law requires, ask for fresh consent.

You may ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to support@yuktilearn.in.

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: support@yuktilearn.in. Phone: [PHONE]. For privacy requests and complaints, write to our Grievance Officer at [GRIEVANCE EMAIL].