Privacy policy

Last updated 29 October 2026

Template — have this reviewed before launch

This document is a general starting point written for an Indian online-tutoring service. It is not legal advice. Have it reviewed by a qualified lawyer and add your company's legal name, registered address and Grievance Officer details before going live.

1. Scope

This policy explains how Vidya (“we”, “us”) handles personal data of students, parents and guardians, and teachers who use our website and apps. It is intended to meet the requirements of the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under them.

2. What we collect

  • Account details: name, email address, phone number and password (stored only as a secure hash).
  • Student profile: class, board, school, target exams and guardian contact details you choose to provide.
  • Teacher verification: identity documents, certificates and payout details (UPI ID) uploaded for verification. These are stored privately and seen only by our verification team.
  • Learning activity: enrolments, class attendance, chat messages in class, quiz answers, assignment submissions, grades and AI tutor conversations.
  • Payments: order details and payment references. Card, UPI and bank details are handled by our payment partner and are never stored on our servers.
  • Technical data: device and browser information, IP address and logs needed to keep the service secure and working.

3. How we use it

  • To create your account, run classes, schedule reminders and show your progress.
  • To verify teachers and display the credentials they have earned on their public profile.
  • To process payments, refunds and teacher payouts, and to keep records required by law.
  • To send service notifications — class reminders, enrolment and payment confirmations.
  • To protect students and the platform: preventing fraud, abuse and misuse.

We do not sell personal data and we do not show third-party advertising to students.

4. Children's data

Many of our students are under 18. Where the law requires it, we obtain verifiable consent from a parent or guardian before processing a child's personal data, and we do not track children for advertising or behavioural profiling. Parents and guardians may contact us to review or delete their child's data.

5. Sharing

We share data only as needed to provide the service:

  • With your teacher: your name, class details, attendance and submissions for the batches you join.
  • With service providers acting on our instructions: payment processing, video infrastructure, cloud hosting, email delivery and AI model providers.
  • With authorities when required by law or to protect someone's safety.

6. Live classes and recordings

Live classes may be recorded so enrolled students can revise. Recordings and class chat are available only to the teacher and students of that batch and to our support team when investigating a complaint. Students can turn off their camera at any time.

7. AI tutor

Questions you send to the AI tutor are processed by an AI model provider to generate replies. Conversations are private to your account. Please don't share personal details such as phone numbers or addresses in your questions. You can delete conversations at any time.

8. Retention and security

We keep personal data only for as long as your account is active or as required by law (for example, financial records). Data is encrypted in transit, private files are served only through short-lived signed links, and staff access is limited and logged.

9. Your rights

You can access and correct your information from your profile, ask for a copy, withdraw consent, or ask us to delete your account and associated data, subject to legal record-keeping obligations. You may also nominate a person to exercise these rights on your behalf.

10. Contact and grievances

For privacy questions or complaints, contact our Grievance Officer using the details published by the operator of this service. We aim to acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.