1. Compliance with Indian Data Protection Law

Vidyaro is committed to full compliance with the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), the Information Technology (SPDI) Rules, 2011, and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Identity: Full name, gender
• Contact: Mobile phone number; email address (optional)
• Academic: Class/grade, competitive exam preference (e.g., JEE, NEET, WBCHSE)
• Profile: Profile photo (if uploaded)
• Payment: Order amounts, payment method type, transaction IDs, coupon codes. We do NOT store card or UPI credentials.
• Communications: Doubt/support messages, feedback

2.2 Data Collected Automatically & Device Permissions

• Device & Technical: IP address, browser type and version, OS, device identifiers, FCM push notification token
• Location: Approximate location (city, state) from IP address — for security monitoring and geo-access controls only
• Camera & Microphone (Mobile App): Accessed ONLY with your explicit runtime permission to participate in Live interactive classes (WebRTC video/audio). Video/audio feeds are processed in real-time and not used for any other purpose.
• Storage & Photos (Mobile App): Accessed ONLY to allow you to upload a profile picture, download study materials, or submit doubts.
• Alarms & Notifications (Mobile App): Exact alarm permissions are used strictly to deliver time-sensitive class reminders locally on your device.
• Session & Login History: Login timestamps, session IDs, IP at login, device/app type, last online timestamp
• Learning & Usage Data: Lectures watched, watch time, study progress, quiz/test scores and answers, XP points, pages visited

2.3 Consent & Verification Data

• Consent Log: At registration we record: name, phone number, IP address, browser/device info, policy version consented to, and exact timestamp — as required by Section 6 of the DPDP Act, 2023. This record is immutable.
• OTP Verification: Your phone number is shared with Fast2SMS solely to deliver a one-time verification password. OTPs are short-lived and not permanently stored.

2.4 Data We Do NOT Collect

3. How We Use Your Personal Data

We process personal data only for the following specified purposes:

• Account Creation & Authentication: Register your account and verify identity via OTP
• Service Delivery: Access to courses, live classes, recorded lectures, tests, and study materials
• Personalisation: Tailor learning based on class, exam preference, and study patterns
• Communications: Course updates, class schedules, results, and announcements via SMS, email, and push notifications
• Payment Processing: Process and reconcile fees through payment partners
• Security & Fraud Prevention: Enforce single-device restrictions, detect unauthorised access, prevent account sharing
• Legal Compliance: Maintain consent records (DPDP Act, 2023); comply with court orders and regulations; maintain financial records per tax law
• Analytics & Improvement: Analyse usage to improve the Platform
• Customer Support: Respond to queries and resolve disputes

4. Marketing Use of Student Information

5. Sharing Your Personal Data

We share personal data with the following third-party processors, only to the extent necessary:

6. Data Security

We implement reasonable security practices as mandated by the SPDI Rules, 2011:

• TLS/SSL encryption for all data in transit
• Secure cloud storage via Cloudflare R2 with strict access controls
• JWT-based authentication with short-lived tokens and refresh token rotation
• OTP-based phone verification before account creation
• Single-device session enforcement against account sharing
• IP-based login history monitoring with geo-lookup for security alerts
• Rate limiting and bot protection on all authentication endpoints

7. Cookies and Tracking Technologies

• Authentication Cookies: Secure, HTTP-only cookies store session tokens. These are essential and cannot be disabled.
• Analytics Cookies: Google Analytics tracks anonymised usage. Opt out via browser settings or the Google Analytics Opt-out Add-on.
• Preference Cookies: Store UI settings for a better experience.

8. Data Retention

• Account & Profile Data: 10 years from collection or until deletion request
• Consent Records: For the duration of data processing plus a minimum of 7 years (DPDP Act audit requirement)
• Login History: 2 years (security audit)
• Payment Records: 7 years (Income Tax Act, 1961 & GST regulations)
• Learning Progress Data: Duration of account plus 2 years post-deletion (dispute resolution)

After the retention period, data is securely deleted or irreversibly anonymised.

9. Your Rights & Account Deletion

Under the DPDP Act, 2023 and Google Play Data Safety policies:

• Account Deletion: You may permanently delete your account and all associated data directly within the app by navigating to Profile > Danger Zone > Request Deletion, or by emailing [email protected]. Data will be erased within 30 days of the request.
• Right to Access (§11 DPDP): Request a summary of your personal data and processing activities
• Right to Correction & Erasure (§12 DPDP): Request correction or erasure of data — contact [email protected]
• Right to Grievance Redressal (§13 DPDP): File a grievance with our Grievance Officer (Section 14). Unresolved grievances may be escalated to the Data Protection Board of India
• Right to Nominate (§14 DPDP): Nominate an individual to exercise your rights in case of death or incapacity
• Right to Withdraw Consent (§6 DPDP): Withdraw consent at any time; withdrawal does not affect prior processing but will cease the applicable service
• Right to Opt-Out of Marketing: Email [email protected] to withdraw marketing consent

10. Children's Privacy

Our Platform serves students of all ages. Users under 18 must use the Platform under parental or guardian supervision. By allowing a minor to use our Platform, the parent/guardian consents to this Policy on the minor's behalf and takes full responsibility for their use.

11. Geographic Scope and Data Localisation

12. Changes to This Privacy Policy

We may update this Policy periodically. Material changes will be posted with a new “Last Updated” date, and fresh consent will be sought where required by the DPDP Act. The consent version in your consent log corresponds to the Policy version in force at registration.

13. Governing Law and Dispute Resolution

14. Grievance Officer

In accordance with the IT Act, 2000, IT (Intermediary Guidelines) Rules, 2021, and the DPDP Act, 2023:

15. Contact Us