Last Updated: April 8, 2025
Introduction
Eduzy ("we," "our," or "us") is committed to protecting the privacy of children and their families. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
Our platform is designed for students in grades 5-8 (ages 10-14). Since our users are children under 18 years of age, we require verifiable parental consent before collecting or processing any personal data.
Data We Collect
Parent/Guardian Information
- Full name
- Phone number (for verification and communication)
- Relationship to child
- Consent records and timestamps
Student Information
- Full name
- Age and grade level
- Subjects of interest
- Learning progress and quiz scores
- Questions asked during learning sessions
Technical Information
- WhatsApp phone number
- Session timestamps
- Device information (for security purposes only)
How We Use Your Data
We use the collected data solely for educational purposes:
- Personalized Learning: Generate age-appropriate educational content based on grade level
- Progress Tracking: Monitor learning progress and provide performance insights
- Communication: Send educational content and respond to questions via WhatsApp
- Service Improvement: Improve our educational content and platform features
- Parental Updates: Provide parents with reports on their child's learning progress
What We Do NOT Do
In compliance with Section 9 of the DPDP Act, we strictly prohibit:
- ❌ Tracking or cross-site monitoring of children
- ❌ Behavioral profiling or psychological analysis
- ❌ Targeted advertising to children
- ❌ Selling or sharing data with third-party advertisers
- ❌ Any processing that may cause harm to the child
Parental Consent
Verifiable parental consent is mandatory before we collect any data from children.
Our consent process includes:
- Parent/guardian must initiate the registration
- OTP verification sent to parent's registered email address
- Clear disclosure of data collection and usage
- Explicit consent acknowledgment before child registration
Verification & Security OTPs
To protect your child's data and account, we use One-Time Password (OTP) verification for sensitive actions:
Registration OTP
- Sent to the parent's registered email address during initial registration
- Valid for 10 minutes
- Required to complete the registration process
Post-Registration Verification OTPs
After registration, verification OTPs can be sent to:
- Registered WhatsApp number
- Registered email address
These OTPs are required for:
- Account modifications or updates
- Password changes
- Consent withdrawal
- Account deletion requests
- Admin-initiated changes (parent must provide OTP to admin)
Account Modifications and Deletions
Important: All account modifications and deletions require OTP verification from the parent.
Parent-Initiated Changes
When you request changes to your child's account:
- A verification OTP is sent to your registered email/WhatsApp
- You must enter the OTP to authorize the change
- For deletions, you will receive a warning that the action is unrecoverable
Admin-Initiated Changes
If you request an admin to modify or delete records:
- A verification OTP is sent to your registered email/WhatsApp
- You must call our support line (+91 9654006470) and provide the OTP to the admin
- The admin cannot make any changes without your verified OTP
- This protects against unauthorized modifications
Account Deletion Warning
Account deletion is UNRECOVERABLE. When you delete an account, the following data will be permanently removed and cannot be restored:
- Student profile and personal information
- All learning progress and statistics
- Assessment history and scores
- Chat history and interactions
- Subscription records
Audit Logging
For security, compliance, and dispute resolution, we maintain audit logs of all significant actions:
- Actions Logged: Account creation, modifications, deletions, login attempts, OTP verifications, consent changes, and admin operations
- Information Recorded: Timestamp, action type, user/admin identifier, IP address (for security), and whether parent notification/OTP verification occurred
- Retention Period: Audit logs are retained for 180 daysas required for DPDP Act compliance and dispute resolution
- Access: Audit logs are accessible only to authorized administrators and can be provided upon legal request
Data Storage and Security
- Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest
- Password Security: Passwords are hashed using bcrypt algorithm
- Access Control: Role-based access ensures only authorized personnel can access data
- Data Location: All data is stored on secure servers in India
- Retention Period: Data is retained only as long as necessary for educational purposes or as required by law
- Audit Logs: All changes and deletions are logged and retained for 180 days
Your Rights (Data Principal Rights)
Under the DPDP Act, parents/guardians have the following rights:
Right to Access
Request a copy of all data we hold about your child
Right to Correction
Request corrections to inaccurate or incomplete data
Right to Erasure
Request deletion of your child's personal data
Right to Withdraw Consent
Withdraw consent at any time; we will stop processing and delete data
How to Exercise Your Rights
To exercise any of your data rights, you can:
- Via WhatsApp: Send "MY DATA" or "DELETE MY DATA" to our WhatsApp number
- Via Parent Dashboard: Log in to view, download, or request deletion
- Via Email: Contact our Data Protection Officer (see below)
We will respond to all requests within 30 days.
Data Retention
- Active Accounts: Data retained while subscription is active
- Inactive Accounts: Data deleted after 12 months of inactivity
- Consent Withdrawal: Data deleted within 30 days of consent withdrawal
- Legal Requirements: Some data may be retained longer if required by law
Third-Party Services
We use the following third-party services to operate our platform:
- Twilio: WhatsApp messaging (processes phone numbers only)
- OpenAI: Educational content generation (no personal identifiers shared)
- MongoDB: Secure data storage
All third-party services are contractually bound to protect data and comply with applicable laws.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify parents of any material changes via WhatsApp and update the "Last Updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.
Contact Us
For any questions, concerns, or to exercise your data rights, please contact:
Grievance Redressal
If you are not satisfied with our response to your data request, you may file a complaint with the Data Protection Board of India as per the provisions of the DPDP Act, 2023.
© 2025 Eduzy by Contentium Tech. All rights reserved.