Privacy Policy

1. Legal Mandate & Role of Data Fiduciary

This Privacy Policy is an electronic record published in accordance with the provisions of Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act").

This document governs the collection, processing, storage, and erasure of personal data by MRUTYUNJAYA (hereinafter referred to as the "Data Fiduciary", "Platform", "We", "Us", or "Our"), accessible via our website (mrutyunjaya.online), student web portal, Telegram bot (@Mrutyunjay_StudyBot), and associated educational services.

Individuals accessing our Services—including students, parents, and educators—are recognized under Indian law as "Data Principals" ("You" or "Your"). Where a student is below 18 years of age, their rights and obligations are represented by their Parent or Lawful Guardian.

2. Categories of Personal Data Collected (Data Minimization)

In accordance with Section 6 of the DPDP Act, 2023, we practice strict Data Minimization. We collect and process only the specific data items strictly necessary to provide real-time Socratic doubt resolution, track curriculum progress, and ensure platform security:

• Identity & Account Data: Student's preferred display name, academic grade/target track (Class 9, 10, 11, 12, CBSE, ICSE, JEE, NEET), age declaration, Parent/Legal Guardian’s full name, Parent’s verified mobile number, and optional parent email address.
• Academic Doubt & Learning Submissions: Text queries submitted to the bot/portal, photographs of handwritten or printed textbook problems captured via device camera/gallery, and audio voice clips recorded for spoken doubt resolution.
• Gamification & Progress Metadata: Daily learning streaks, shield counts, Socratic hint disclosure counts, Galti Diary (mistake classification tags for spaced repetition review), and quiz performance scores.
• Technical, Security & Device Telemetry: Anonymized client IP address, device operating system version, crash diagnostics, and cryptographically hashed session tokens required for brute-force lockout protection and rate-limiting (e.g., maximum 10 doubts per 10 minutes to protect computational budgets).
• Subscription & Payment Data: Order IDs, GST billing names, and transaction references. We do not store credit/debit card numbers, CVVs, or UPI PINs on our servers. All financial transactions are processed directly by RBI-authorized and PCI-DSS compliant payment aggregators.

3. Processing of Children’s (Minors') Data (Section 9 DPDP Act)

Any learner under the age of eighteen (18) years is classified as a "Child" under Section 2(f) of the DPDP Act, 2023. Because our primary audience consists of school students and competitive exam aspirants, we enforce industry-leading minor safety safeguards:

1. Mandatory Verifiable Parental Consent (VPC) [Section 9(1)]: Persistent student accounts cannot be fully registered without verifiable parental authorization. Upon onboarding, the Platform initiates a Dual-Channel SMS/WhatsApp OTP Verification Flow to the Parent's mobile number, generating an encrypted consent audit token (/consent/<token>) logged with statutory timestamps.
2. Anonymous Sandbox Evaluation Mode: Prior to parental consent verification, unverified minor accounts are restricted to an anonymous sandbox quota (maximum 2 academic doubts) where no personal profile, phone number, or persistent identity is retained or indexed.
3. Absolute Prohibition on Tracking & Behavioral Profiling [Section 9(3)]: In strict compliance with Section 9(3), we do not monitor, track, or build psychological or commercial behavioral profiles of children. We do not install third-party tracking pixels (e.g., Meta Pixel, TikTok Pixel, Google Ads Remarketing tags) on any student learning interface.
4. Zero Targeted Advertising [Section 9(3)]: MRUTYUNJAYA is completely ad-free. We never serve commercial promotions, sponsored cross-sells, or microtransactions to minors, nor do we sell, rent, or monetize student data under any circumstances.
5. Affirmative Duty of Care & Harm Prevention [Section 9(2)]: In compliance with Section 9(2) prohibiting data processing detrimental to child well-being, the Platform incorporates an automated, client-side multilingual Crisis Distress Interceptor. If an input indicates severe psychological distress or self-harm ideation, the academic solver is paused immediately to surface Government of India Tele-MANAS (14416 / 1800-891-4416) and KIRAN (1800-599-0019) emergency helpline resources. Distress signals are never logged, monetized, or shared with third parties.

4. Socratic AI Processing & PII Scrubbing Architecture

We process academic queries solely for pedagogical doubt resolution under strict Purpose Limitation:

• Pre-Transmission PII Scrubbing: Before any doubt prompt is routed to AI inference engines, our backend executes an automated regex de-identification scrubber (minor_safety.py) that strips Indian 10-digit phone numbers, email addresses, roll numbers, and Aadhaar-formatted identifiers.
• Deterministic Local Math & PYQ Engine: Standard curriculum previous-years questions (PYQs) and algebraic evaluations are verified locally on our servers using deterministic mathematical tools (SymPy) and pre-warmed deterministic SQLite caches (<10ms latency) without transmitting data to external LLMs.
• Media Handling (OCR & STT): Images submitted via camera/gallery are processed strictly via Optical Character Recognition (OCR) to extract mathematical equations. Voice notes are processed via Speech-to-Text (STT) models to extract textual questions. We do not perform facial recognition, biometric voice-printing, or emotion tracking. Audio and image files are purged after transcription.

5. Data Sharing & Third-Party Data Processors (Section 8(2))

Under Section 8(2) of the DPDP Act, 2023, we engage trusted Data Processors bound by contractual confidentiality and data security obligations matching our own:

• Cloud Infrastructure: Hetzner Cloud GmbH (Dedicated Virtual Private Servers with encrypted block storage, strict firewall isolation, and no public database access).
• AI Inference Partners: Google Cloud (Gemini API Enterprise endpoints) and OpenAI (Enterprise API endpoints). Contracts explicitly stipulate that API inputs and outputs are zero-retention and never utilized to train public foundation models.
• Telecommunications & Gateway Gatekeepers: RBI-authorized payment processors (e.g., Razorpay/Cashfree/UPI) and statutory SMS gateways for parental OTP delivery.
• Legal & Statutory Disclosures: We disclose personal data to law enforcement authorities only when compelled by a valid statutory order or court decree issued by a competent Indian court under the IT Act, 2000, or the DPDP Act, 2023.

6. Cross-Border Data Transfers (Section 16 DPDP Act)

All core relational student databases and user profile tables are hosted on secure, isolated cloud servers. Where external AI inference computations (e.g., Google Gemini or OpenAI API gateways) process transient academic payloads, transfers are executed in strict accordance with Section 16 of the DPDP Act, 2023, ensuring compliance with any territory restrictions notified by the Central Government of India.

7. Reasonable Security Safeguards (Section 8(5) DPDP Act)

MRUTYUNJAYA implements enterprise-grade technical and organizational security measures:

• Data in Transit: Mandatory Transport Layer Security (TLS 1.3 / HTTPS) across all web portals, API endpoints, and webhook transmissions.
• Data at Rest: Cryptographic hashing (PBKDF2/SHA-256) of session credentials and parental tokens. Databases are restricted behind hardened OS-level firewalls.
• Brute-Force & Denial-of-Service Defense: In-memory sliding-window rate limiters protecting against credential stuffing, token brute-forcing, and API flooding.
• Role-Based Access Control (RBAC): Administrative access to database backups is strictly limited to authorized system administrators requiring multi-factor authentication.
• Breach Notification Protocol [Section 8(6)]: In the unlikely event of a personal data breach impacting student or parent records, we shall notify the Data Protection Board of India (DPBI) and all affected Data Principals without undue delay, adhering to statutory timelines.

8. Data Retention & Cascade Erasure Policy (Section 8(7))

In adherence to the statutory Purpose Limitation mandated by Section 8(7) of the DPDP Act, 2023, personal data is retained only for the duration necessary to deliver the educational services:

• Active Enrollment: Student profile and Galti Diary mistake history are retained for the duration of the student's active academic year or subscription.
• Inactivity Sunset: If an account remains inactive for more than one hundred and eighty (180) days following the conclusion of the academic session, all associated personal data is automatically queued for permanent cryptographic erasure.
• Immediate Cascade Purge upon Consent Revocation: When a Parent or Data Principal exercises their right to withdraw consent (via the consent management portal or written request), our automated database engine executes a Cascade Purge (cascade_purge_minor_data) permanently deleting student records, doubt histories, mistake notebooks, and session logs across all active databases.

9. Statutory Rights of Parents and Data Principals

Under Chapter III (Sections 11–14) of the DPDP Act, 2023, Parents and adult Data Principals possess the following legal rights:

• Right to Access Information (Section 11): Request a clear summary of all personal data being processed and the identities of all third-party processors.
• Right to Correction & Erasure (Section 12): Request the correction of inaccurate data, completion of incomplete profiles, or complete deletion of data.
• Right to Withdraw Consent (Section 6(4)): Withdraw parental consent at any time with the same ease with which consent was granted, via the self-service portal link or by emailing our Grievance Officer.
• Right of Grievance Redressal (Section 13): Access a speedy, transparent internal grievance redressal mechanism.
• Right to Nominate (Section 14): Nominate an individual to exercise data rights in the event of death or legal incapacity.

10. Data Protection & Grievance Redressal Officer

In accordance with Section 13 of the DPDP Act, 2023, and Rule 3(2) of the IT Rules, 2021, the designated contact particulars of our Grievance Officer are set forth below:

Note on Statutory Escalation: In accordance with Section 13(3) of the DPDP Act, 2023, a Data Principal must first exhaust this internal grievance redressal mechanism before filing a complaint before the Data Protection Board of India.