Privacy Policy
Last updated 2026-10-08-draft
Draft for legal review: not yet in force. Text in [square brackets] is to be completed before launch.
AI Lessons ("we") is operated by [Company legal name], [registered address]. This policy explains what personal data the AI Lessons app and website collect, why, who we share it with, and the choices and rights you have. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary.
Who can have an account
An AI Lessons account is held by an adult: a parent or legal guardian, or a learner aged 18 or over. Children (anyone under 18) study under a parent's account in their own learner profile. A child never needs their own phone number or email address. A parent adds a child and gives consent for the child's data to be processed as described here. If someone under 18 tries to create an account themselves, we ask them to hand over to a parent and erase the number they used.
Teachers and school staff have their own adult accounts. A school that uses AI Lessons may let its students use it at school, on school devices, under the school's own consent arrangements before a parent links them; when a parent links the child, the parent takes over the child's profile. [Counsel to confirm the basis on which a school may enrol students before a parent links them, and the school's and our roles (Data Fiduciary or Data Processor) for school data.]
What we collect
- Account holder: your phone number or the email address and name on your Google account (used to sign in, through Google Firebase Authentication), your confirmation that you are 18 or over, whether you are a parent or an adult learner, and records of the consents you give and when.
- Each learner profile: a first name or nickname, country, curriculum (board), state (for state boards), class or grade, stream (for Classes 11–12) and language. We use these only to show the right lessons.
- Learning activity: progress through lessons and practice results (marks, attempts). We also keep the text of written answers you send for marking ("Check my thinking") and the questions you ask the AI tutor, along with the part of the lesson they relate to.
- Classroom activity: when a learner is in a teacher's class, the classes they belong to, work set and handed in (including any text, photos, videos, voice notes or files they attach), scores, rubric levels and feedback, attendance and behaviour notes a teacher records, class discussion posts, and messages with teachers.
- Journal and goals: notes, photos, videos and voice notes a learner adds to their learning journal, and their goals. These are private to the learner and their parent unless the learner shares them.
- School records: when a school uses AI Lessons, the roster details the school provides (each student's name, admission number, grade and section, and guardians' names and contact details, which are used to send invites), and records of which guardian claimed each invite and from which contact.
- Rewards: badges, certificates and rewards issued to the account. If a parent claims a physical reward, the delivery address is kept encrypted only until it is shipped.
- Purchases: which plan is active, and the purchase reference from Google Play, the App Store or our payment provider. We never receive or store full card details.
- Security data: IP address and device type when you use our services, used to protect them (for example rate limits and abuse prevention).
We do not collect precise location or contacts, and we never read photos or files from the device: photos, videos, voice notes and files reach us only when someone chooses to add them (for example a journal entry or handed-in work). They are kept in private storage and are never used to train AI. We do not use advertising identifiers. We do not show advertising. We do not use third-party analytics or tracking tools in the app.
Children's data
We process a child's data only with the verifiable consent of their parent or legal guardian, and only to teach them. We do not track or monitor children's behaviour, and we do not direct advertising at them. Where a school is linked, the school sees the child's learning progress and classwork as described under "Schools" below, never their browsing, location or private journal. The parent can see and change each child's profile, remove it (which deletes the child's progress and withdraws consent), or delete the whole account at any time from the app. [Confirm with counsel the method of verifying parental consent required under the DPDP Rules, and whether it applies from launch.]
Why we use it
- To provide lessons for the learner's curriculum and class, including offline downloads.
- To save and sync progress across devices.
- To mark written answers and answer questions through the AI tutor.
- To run classes: setting and returning work, feedback, discussions and messages between teachers, students and parents.
- When a parent links a child to a school, to show the school what the parent approved, and to manage school places.
- To issue badges, certificates and rewards.
- To unlock what has been purchased and to manage subscriptions.
- To keep our services secure and to meet legal obligations.
We do not sell personal data.
Schools
A school can see a child only after a parent approves the link: the school sends the parent a personal invite, and nothing is linked without the parent's approval. When linking, the parent sees what the school will see and the school's own privacy notice where it gives one.
- What the school sees: classwork, grades, attendance and behaviour notes from its own classes, and the child's learning progress (lessons, practice and time spent) from the day of the link. Earlier progress is shared only if the parent chooses.
- What the school never sees: the private journal, family chats, the child's conversations with the AI tutor, other children on the account, and the family's billing.
- Messages: the school's owners and administrators can review messages between teachers, students and parents in the school's classes, for safeguarding and complaints. Every review is recorded in the school's audit log.
- Separation: each school's data is kept apart from every other school's. A group of schools (for example a trust) sees totals for each school, not individual students, unless its staff also have a role at that school.
- Leaving or unlinking: a parent can unlink a child from a school at any time in the Family app. The school then stops seeing the child's progress, but keeps the classroom records written while the child was there, for the retention period in its agreement with us. Guardians' contact details are erased after a student leaves, at the end of that period. [Counsel to confirm retention periods.]
- Our support team: to help a school, our support staff can open its dashboard read-only for a limited time. They cannot change anything, contact details are hidden, the message audit is not available to them, and every view is recorded in the school's audit log.
Rewards
Children see only badges, certificates and celebrations. Anything with money value, such as discounts, vouchers, free time or physical rewards, goes to the parent's account, never to the child. Partners whose coupons we hand out are checked as suitable for children, and we do not share any child's or parent's data with them: a coupon is a code you redeem on the partner's own site.
Who we share it with
We share data with the school a parent links their child to (see "Schools"), and otherwise only with service providers who process it on our behalf for the purposes above:
- Google Firebase: sign-in.
- OpenAI: marking written answers and the AI tutor. They receive the text of the answer or question and the lesson context, but no name, phone number or email. Under OpenAI's API terms, this data is not used to train their models by default.
- DigitalOcean: servers and database.
- Cloudflare: network security and storage of lesson files and of the photos, videos, voice notes and files people add.
- [Email and SMS providers]: sending school invites, reminders and sign-in messages.
- Google Play, the App Store and [payment provider]: payments.
Lesson narration is produced in advance and contains no learner data. We may disclose data where the law requires it.
Where it is stored
[Hosting region, e.g. Bengaluru (India)]. Some of our service providers process data outside India. Where they do, it is under contracts that protect it, as permitted by the DPDP Act.
How long we keep it
We keep account and learning data while the account is open.
- Deleting from the app erases it from our live systems straight away, and from backups within [30] days.
- Removing a learner profile deletes that learner's progress, journal, media, goals, submissions and messages.
- School records: classroom records a school keeps are held for the retention period in the school's agreement with us (see "Schools").
- Consent records: we keep a record that consent was given and withdrawn, without your phone number, email or names, as proof required by law.
- Purchase records: Google, Apple and our payment provider keep their own records for tax and accounting.
Your rights
You can:
- access the personal data we hold about you and the learners under your account;
- correct or update it;
- have it erased;
- withdraw consent;
- nominate someone to exercise these rights for you;
- raise a grievance.
Most of this can be done in the app under Account. For anything else, contact our Grievance Officer, Syed Hussain, CEO & Founder, at [email protected]. We will respond within [the period required by law]. If you are not satisfied, you may complain to the Data Protection Board of India.
Security
Data is encrypted in transit. Downloaded lessons are encrypted on the device, and their keys are kept in the device's secure storage. Access to our systems is restricted and logged.
Changes
If we change this policy in a way that matters, we will tell you in the app and ask you to accept the new version before you continue.
Contact
Support: [email protected], +971 55 457 3286. Grievance Officer: Syed Hussain, CEO & Founder, [email protected], [postal address].