Privacy Policy
Last updated 2026-10-08-draft
Draft for legal review: not yet in force. Text in [square brackets] is to be completed before launch.
AI Lessons ("we") is operated by [Company legal name], [registered address]. This policy explains what personal data the AI Lessons app and website collect, why, who we share it with, and the choices and rights you have. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary.
Who can have an account
An AI Lessons account is held by an adult: a parent or legal guardian, or a learner aged 18 or over. Children (anyone under 18) study under a parent's account in their own learner profile. A child never needs their own phone number or email address. A parent adds a child and gives consent for the child's data to be processed as described here. If someone under 18 tries to create an account themselves, we ask them to hand over to a parent and erase the number they used.
What we collect
- Account holder: your phone number or the email address and name on your Google account (used to sign in, through Google Firebase Authentication), your confirmation that you are 18 or over, whether you are a parent or an adult learner, and records of the consents you give and when.
- Each learner profile: a first name or nickname, country, curriculum (board), state (for state boards), class or grade, stream (for Classes 11–12) and language. We use these only to show the right lessons.
- Learning activity: progress through lessons and practice results (marks, attempts). We also keep the text of written answers you send for marking ("Check my thinking") and the questions you ask the AI tutor, along with the part of the lesson they relate to.
- Purchases: which plan is active, and the purchase reference from Google Play, the App Store or our payment provider. We never receive or store full card details.
- Security data: IP address and device type when you use our services, used to protect them (for example rate limits and abuse prevention).
We do not collect precise location, contacts, photos or files. We do not use advertising identifiers. We do not show advertising. We do not use third-party analytics or tracking tools in the app.
Children's data
We process a child's data only with the verifiable consent of their parent or legal guardian, and only to teach them. We do not track or monitor children's behaviour, and we do not direct advertising at them. The parent can see and change each child's profile, remove it (which deletes the child's progress and withdraws consent), or delete the whole account at any time from the app. [Confirm with counsel the method of verifying parental consent required under the DPDP Rules, and whether it applies from launch.]
Why we use it
- To provide lessons for the learner's curriculum and class, including offline downloads.
- To save and sync progress across devices.
- To mark written answers and answer questions through the AI tutor.
- To unlock what has been purchased and to manage subscriptions.
- To keep our services secure and to meet legal obligations.
We do not sell personal data.
Who we share it with
We share data only with service providers who process it on our behalf for the purposes above:
- Google Firebase: sign-in.
- OpenAI: marking written answers and the AI tutor. They receive the text of the answer or question and the lesson context, but no name, phone number or email. Under OpenAI's API terms, this data is not used to train their models by default.
- DigitalOcean: servers and database.
- Cloudflare: network security and storage of lesson files.
- Google Play, the App Store and [payment provider]: payments.
Lesson narration is produced in advance and contains no learner data. We may disclose data where the law requires it.
Where it is stored
[Hosting region, e.g. Bengaluru (India)]. Some of our service providers process data outside India. Where they do, it is under contracts that protect it, as permitted by the DPDP Act.
How long we keep it
We keep account and learning data while the account is open.
- Deleting from the app erases it from our live systems straight away, and from backups within [30] days.
- Removing a learner profile deletes that learner's progress.
- Consent records: we keep a record that consent was given and withdrawn, without your phone number, email or names, as proof required by law.
- Purchase records: Google, Apple and our payment provider keep their own records for tax and accounting.
Your rights
You can:
- access the personal data we hold about you and the learners under your account;
- correct or update it;
- have it erased;
- withdraw consent;
- nominate someone to exercise these rights for you;
- raise a grievance.
Most of this can be done in the app under Account. For anything else, contact our Grievance Officer, Syed Hussain, CEO & Founder, at [email protected]. We will respond within [the period required by law]. If you are not satisfied, you may complain to the Data Protection Board of India.
Security
Data is encrypted in transit. Downloaded lessons are encrypted on the device, and their keys are kept in the device's secure storage. Access to our systems is restricted and logged.
Changes
If we change this policy in a way that matters, we will tell you in the app and ask you to accept the new version before you continue.
Contact
Support: [email protected], +971 55 457 3286. Grievance Officer: Syed Hussain, CEO & Founder, [email protected], [postal address].