Legal

Privacy Policy

School Edition · Version 2.1-SE · Effective 10 July 2026

Plain English summary: Your school enrols you and is legally responsible for your data as your school's "Data Fiduciary" under India's DPDP Act 2023. VidyaAI processes it only on your school's instructions, under a signed Data Processing Agreement. We do not currently offer any in-app purchase — no coin store, no paid feature is active in the School Edition. We never sell your data or use it for advertising.

1. Read This First — Scope and Roles Under the Law

School Edition only. Vidya AI is currently offered exclusively through a school's licence. There is no direct-to-consumer, self-signup version of the app available today — you cannot create an account except through your school's enrolment. If we launch a separate consumer product in the future, it will operate under its own, separate privacy policy, and this policy will continue to describe only the School Edition.

Vidya AI for Schools operates in School-Mediated Learning mode. When your school enrols you on Vidya AI, your school is the Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act 2023 (the "DPDP Act"). Your school decides what data is collected, how it is used for teaching, and who has access to it within the school. Vidya AI acts only as a Data Processor for your school — we process personal data strictly according to the school's written instructions, under a Data Processing Agreement signed between us and the school.

Your school is responsible for obtaining verifiable parental consent under Section 9 of the DPDP Act, typically as part of its enrolment paperwork. Vidya AI relies on the school's warranty that consent has been obtained.

No in-app purchases are currently offered. The School Edition does not sell coins, credits, subscriptions, or any other in-app purchase to students or parents today. If we introduce a purchasable feature in the future, we will update this policy, describe exactly what is collected and why, and notify schools at least 30 days in advance (see Section 14) before it takes effect.

2. Who We Are

This service is operated by ABR Traders (trading as Vidya AI for Schools, together with us, "we", "our"). Our office is at Narasaraopet-522601, Andhra Pradesh.

This policy covers the Vidya AI mobile application (School Edition), the website at https://myvidyaai.com, and any related school-facing service we provide.

3. Definitions

School — the educational institution (or trust operating one or more such institutions) that has signed a School Licence Agreement with us.
School Administrator — a staff member of the school authorised to manage the school's account, add or remove students and teachers, and view aggregated reports.
Teacher — a school staff member using the app to assign work, view class-level reports, and communicate with students within the app.
Student — a child enrolled at the school and provisioned an account by the school.
Parent — a parent or lawful guardian of a student.
Data Fiduciary, Data Processor, Data Principal, Child, Personal Data — have the meanings given in the DPDP Act 2023.

4. Personal Data We Process

4.1 Student data provided by the school at onboarding

Full name, class and section, roll number or school ID as issued by the school;
Preferred language of instruction;
Parent's or guardian's contact details as recorded by the school;
Date of birth, if provided by the school.

4.2 Student data generated by use of the app

Quizzes attempted, scores, time spent, subtopics practised, streaks, badges earned;
AI tutor conversations initiated by the student;
Notes and content uploaded by the student for the AI to process;
Voice recordings, only when the student taps the microphone — the raw audio is discarded once transcription completes and is not retained;
Photos submitted to the camera-solve feature — deleted within 24 hours of processing.

4.3 Teacher and administrator data

Name, school email, role (teacher / administrator), classes taught;
Activity within the teacher/admin dashboard — assignments created, reports viewed, students supported.

4.4 Technical data

Device model, operating system version, app version, language setting;
IP address (collected by our infrastructure provider for security);
Crash diagnostics and error logs;
Push notification tokens issued by Google Firebase Cloud Messaging.

4.5 What we do NOT process

No advertising identifiers. We do not embed advertising SDKs of any kind.
No coin, credit, or virtual-currency purchases of any kind — see Section 1.
No Aadhaar, PAN, or other government identifiers. We do not ask for them and do not accept them if offered.
No precise GPS location. No facial recognition on uploaded photos.

5. Optional Purchases — Not Currently Offered

Vidya AI for Schools does not currently offer any parent- or student-initiated in-app purchase. No payment data, purchase records, or purchase-specific consent records are collected in the School Edition today. If this changes, we will publish an updated version of this section describing exactly what is collected, obtain any additional consent required, and notify schools at least 30 days before the feature is enabled (see Section 14).

6. Legal Basis for Processing

The school is the Data Fiduciary and has obtained parental consent under Section 9 of the DPDP Act as part of the enrolment process. Vidya AI processes data as a Data Processor on the school's documented instructions, under a Data Processing Agreement executed between the school and us.

Parents' rights are exercised through the school. If you are a parent and wish to access, correct, or delete your child's data, please contact your school first. If the school is unable to resolve the request or fails to respond within a reasonable period, you may contact our Grievance Officer (Section 13), who will escalate under the escalation protocol in our DPA with the school. In cases involving a safety concern or where the school is materially non-responsive, we will act directly to protect the child, notifying the school of the action taken.

7. How Long We Keep Data

Category	Retention period
Student data (learning history, quizzes, tutor conversations)	Retained for the duration of the school's licence, plus 90 days after the licence ends or the student is marked inactive, then permanently deleted.
Voice recordings (raw audio)	Discarded once transcription completes; not retained.
Camera-solver photos	24 hours after processing, then permanently deleted.
School DPA and licence documentation	Retained for the duration of the relationship plus 8 years.
Consent records	Retained for the account lifetime plus 3 years for audit trail purposes.
Crash logs, security event logs	1 year rolling window.

What happens when a student leaves the school. If a student transfers out or is un-enrolled, the school administrator marks the student inactive. We retain that student's data for 90 days so a re-enrolment can restore learning history, then permanently delete it.

What happens when the licence ends. On termination of the School Licence Agreement, we will either (a) return all school data to the school in a machine-readable format within 30 days, or (b) permanently delete it, at the school's written election.

8. Your Rights Under DPDP 2023

Because the school is the Data Fiduciary, rights are exercised primarily through the school. This includes the right to access a copy of your data, the right to correction, the right to erasure of data no longer required for its purpose, and the right to grievance redressal.

Contact the school administrator first. If the school is unable to resolve the request, or fails to respond within a reasonable period, you may contact our Grievance Officer (Section 13). We acknowledge such escalations within 5 working days and target resolution within 15 working days.

Teachers and administrators are Data Principals for their own account data (name, login credentials, activity within the dashboard) and may exercise DPDP rights directly against us. Their access to student data is granted by the school and governed by the school's internal policies, not by us.

9. Sharing and Sub-Processors

We do not sell, rent, or share personal data. The full list of sub-processors is set out in the Data Processing Agreement and available to the school administrator on request:

Processor	Purpose	Data category & region
Supabase	Database, authentication, storage, edge functions	All account and learning data. Region: ap-south-1 Mumbai, India.
Anthropic (Claude API)	AI tutoring, quiz generation, error analysis	Question content and context needed to answer. No profile identifiers. Region: United States.
Sarvam AI	Speech-to-text, text-to-speech in Indian languages	Voice recordings (transient), text for playback. Region: India.
Bhashini (MeitY, Government of India)	Indian-language translation	Text strings for translation. Region: India.
Firebase Cloud Messaging (Google)	Push notifications for reminders	Push token, notification content. Google global infrastructure.

10. Cross-Border Data Transfers

Vidya AI is operated only for users located in India. However, some sub-processors above may process data outside India — most notably Anthropic (United States) and Firebase Cloud Messaging (Google's global infrastructure).

If the Central Government notifies a restriction under Section 16 of the DPDP Act that affects a sub-processor we use, we will notify the school within 30 days and either migrate the workload or, if migration is not feasible, allow the school to terminate the licence without penalty.

11. Security

Encryption in transit (TLS 1.2 or higher) for all data between the app and our servers.
Encryption at rest (AES-256) for all data stored in our Supabase Postgres database.
Row-level security policies restricting every database row to the account that owns it, with additional row-level scope for school-tenanted data.
Automated redaction of Aadhaar, phone, email, PAN, and credit-card patterns from voice transcripts before persistence.
Access controls limiting our employee access to production data on a need-to-know basis, with audit logging.
Breach notification within 72 hours to affected schools, the Data Protection Board of India as required under Section 8(6) of the DPDP Act, and affected parents where the school so directs or where required by law.

12. Children's Data — Special Protections

The school warrants under our Data Processing Agreement that verifiable parental consent has been obtained for every student it enrols on the app. We do not process children's data in a manner detrimental to the well-being of the child. We do not undertake behavioural monitoring, targeted advertising, or profiling of children.

If a school informs us that consent has been withdrawn for a particular student, we will suspend processing for that student within 24 hours and delete their data within 30 days.

13. Grievance Officer

In accordance with Section 8(9) of the DPDP Act:
Name: Pidugu Sai Krishna Reddy — Designation: Grievance Officer
Email: contact@myvidyaai.com
Postal address: Narasaraopet-522601, Andhra Pradesh
Response time: we acknowledge within 5 working days and target resolution within 15 working days.

14. Changes to This Policy

For material changes, we will notify the school administrator at least 30 days in advance. The school may terminate the licence without penalty if it does not accept the change. The version number and effective date at the top of this policy are updated with every change.

15. Contact

All queries: contact@myvidyaai.com · Postal: Narasaraopet-522601, Andhra Pradesh · Website: https://myvidyaai.com