This Privacy Policy explains how VidyaAI Study (a service by Sunmagma Technologies LLP) (“we”, “us”, or “our”), the operator of vidyaai.study, collects, uses, shares and protects your personal information. We comply with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Who this policy covers

It covers three categories of users: Institute Admins (coaching owners), Students registered through an institute, and Self-Study Students (individual learners). It also covers visitors to our public website.

2. Information we collect

Account info: name, email, password (hashed), role, profile picture (if you sign in with Google).
Institute info: institute name, address, join code, plan tier.
Study materials you upload: PDFs, images of handwritten notes, video files, audio files. We process these to provide AI tutoring; we do not sell or share this content.
Telegram identifiers: chat ID, first name and phone number — only when you opt in by tapping “Share phone number” inside our Telegram bot.
Payment metadata: subscription ID, plan, payment status. Card or UPI details are collected directly by Razorpay and never touch our servers.
Usage telemetry: chats with the AI tutor, quizzes generated, summaries created, login timestamps, IP address, browser & device.

3. How we use your information

To provide the AI tutor and ground its answers in your uploaded materials.
To enforce plan limits (e.g., number of students, monthly video uploads).
To process subscriptions and prevent fraud (via Razorpay).
To send transactional emails (welcome, payment receipts, plan-change notices). We do not send marketing emails without your consent.
To improve product quality through aggregated, anonymised usage analytics.
To comply with applicable Indian law and respond to lawful requests by public authorities.

4. AI processing & third-party LLMs

To generate answers, quizzes and summaries, we send the relevant portion of your uploaded material (and your question) to a Large Language Model API (currently Google Gemini, accessed via the Emergent integrations platform). These third parties act as our data processors and are contractually bound to use the data only to fulfil our requests, not for their own model-training, and to delete it after processing.

5. Children & minors

Many learners on our platform are below 18. Under the DPDP Act we treat learners under 18 as minors. By using VidyaAI Study (a service by Sunmagma Technologies LLP):

If you are a coaching institute or parent, you confirm that you have obtained verifiable parental/guardian consent before allowing a minor to use our service.
We do not engage in tracking, behavioural monitoring or targeted advertising directed at children.
Parents/guardians may write to info@vidyaai.study to inspect, correct or delete a minor's data at any time.

6. Data sharing

We do not sell your personal data. We share it only with:

Service providers (cloud hosting, MongoDB, LLM API, Razorpay, Telegram) strictly to operate the service.
Your institute admin (for institute-registered students) — they can see your enrolled status, your chats with the tutor, and your usage.
Government or regulators, when required by law.

7. Data retention

We retain account and study-material data for as long as your account is active. On account deletion we erase your data within 30 days, except where retention is required by law (e.g., tax invoices for 8 years under GST law).

8. Your rights (DPDP Act)

Access — get a copy of your data.
Correction & erasure — fix or delete what we hold about you.
Grievance redressal — see our Grievance page.
Nominate — appoint someone to exercise these rights on your behalf in the event of death or incapacity.
Withdraw consent — for any non-essential processing, by emailing us.

9. Security

We use bcrypt for password hashing, HTTPS-only transport, server-side rate-limiting against brute force, and signed JWT cookies. Payment processing is delegated to Razorpay (PCI-DSS Level 1).

10. Cross-border transfers

Some service providers (e.g., Google Gemini, MongoDB Atlas) may store or process data outside India. These transfers happen only when the recipient guarantees a level of protection at least equivalent to the DPDP Act.

11. Cookies

We use only essential cookies for authentication (a JWT session cookie). See our Cookie Policy.

12. Changes to this policy

Material changes will be announced inside the product and over email at least 7 days before they take effect.