Legal

Privacy Policy

Last updated: April 2026  ·  Version 1.0  ·  DPDPA 2023 Compliant

1. Who We Are and Who This Policy Applies To

GyandootAI is operated by GyandootAI Private Limited (company incorporation in progress), India. This Privacy Policy describes how we collect, use, store, protect and share your personal data when you use our service at gyandootai.com.

This policy applies to all users of gyandootai.com including teachers, educators, school administrators, and any person who submits a request or creates an account. It is compliant with India's Digital Personal Data Protection Act 2023 (DPDPA) and the DPDP Rules 2025 notified on 13 November 2025.

GyandootAI is intended for use by adults (18 years and above) who are qualified teachers or educators. It is not intended for use by students or minors.

2. What Data We Collect and Why

We collect only what is necessary to provide our service. Below is a complete list of every category of data we collect:

Data	Why collected	Legal basis (DPDPA)	Retention
Full name	To personalise your paper header and our email to you	Consent	Until you request deletion
Email address	To deliver your generated paper and account communications	Consent	Until you unsubscribe or request deletion
Subject, class, board, topic	To generate your question paper via AI	Consent — voluntarily submitted	Logged for service improvement. Anonymised after 12 months.
Difficulty, marks, paper type	To customise paper generation	Consent — voluntarily submitted	Anonymised after 12 months
Device fingerprint	To manage fair usage of our free trial (stored in your browser only — not on our servers)	Legitimate use — service security	In your browser's localStorage. Clear anytime by clearing browser data.
Payment information	To process paid plan subscriptions	Consent via Razorpay	Not stored by us — handled entirely by Razorpay
Usage logs	To manage paper count limits and detect abuse	Legitimate use — service operation	12 months, then deleted

We do not collect: student data, location data, biometric data, financial account details, government IDs, health data, or any sensitive personal data as defined under Indian law.

3. How We Use Your Data — Purpose Limitation

Under DPDPA 2023, we may only use your data for the purpose for which it was collected. We use your data for:

• Generating and delivering your question paper — primary purpose
• Account management — tracking your plan, usage count, and subscription status
• Service communications — confirming receipt, delivery issues, account updates
• Support responses — when you contact us
• Product updates — informing paid subscribers of new features (opt out anytime)
• Service improvement — anonymised, aggregated analysis of which subjects/boards are most requested

We do not use your data for advertising, profiling, selling to third parties, training AI models, or any purpose other than what is listed above.

4. Data Sharing — Who Sees Your Data

We do not sell, rent, or trade your personal data. We share data only with these three service providers, and only to the extent necessary to operate our service:

Service	What they receive	Why	Their privacy policy
Google (Gmail)	Your email address and generated paper	To send your paper to your inbox	policies.google.com/privacy
Anthropic (Claude AI)	Subject, class, board, topic, marks only — no name, no email	To generate the question paper content	anthropic.com/privacy
Make.com	Full submission data to orchestrate the workflow	Automation workflow between form → AI → email	make.com/en/privacy-notice
Razorpay	Email and payment information for paid subscribers only	Payment processing	razorpay.com/privacy

None of these processors are authorised to use your data for their own marketing or purposes beyond their specific role above. We maintain data processing agreements with each where applicable.

Legal disclosure: We may disclose your data if required by a valid Indian court order, regulatory authority, or law enforcement request. We will notify you of any such request unless prohibited by law from doing so.

5. Your Rights Under DPDPA 2023

Under India's Digital Personal Data Protection Act 2023, you have the following rights as a Data Principal:

To exercise any right: email [email protected] with the subject line "Data Rights Request" and your registered email address. We respond within 7 business days.

6. Consent — How We Obtain and Manage It

In compliance with DPDPA 2023 Section 6, we obtain your consent before collecting personal data:

• Before submitting your paper request, you tick a checkbox confirming: "I understand this is an AI-generated practice paper, not an official board paper. I agree to the Terms of Service and Privacy Policy."
• This constitutes free, specific, informed, and unambiguous consent as required under DPDPA.
• You may withdraw consent at any time by emailing us. Withdrawal does not affect the lawfulness of processing before withdrawal.
• We do not use pre-ticked boxes, bundled consents, or make consent a condition of service beyond what is strictly necessary to operate it.

7. Data Security

We implement reasonable technical and organisational measures to protect your data:

• HTTPS encryption on all data transmission between your browser and our systems
• Access controls — only authorised personnel have access to user data
• No sensitive financial data stored — payment processing handled entirely by Razorpay
• Third-party processors operate under their own security frameworks (Google, Anthropic, Make.com, Razorpay are all enterprise-grade secure platforms)

In the event of a personal data breach that is likely to cause harm to you, we will notify you and the Data Protection Board of India as required by DPDPA, within the timeframe specified by law.

8. Browser Storage and Cookies

We use your browser's localStorage (not cookies) to track your free paper usage count on your device. This data:

• Is stored on your device only — never transmitted to our servers
• Contains only a numerical count linked to your email address (stored in hashed/encoded form)
• Can be cleared at any time by clearing your browser's storage data

We do not use advertising cookies, tracking pixels, third-party analytics scripts, or behavioural profiling of any kind on our website.

9. Children's Data

GyandootAI is strictly intended for use by adults (18 years and above) who are teachers or educational professionals. We do not knowingly collect data from children or students.

• We do not target students or minors with our service.
• If you believe a minor has submitted personal data to us, please contact us immediately at [email protected] and we will delete it promptly.
• Under DPDPA 2023, processing of children's data requires verifiable parental consent — we do not process children's data and have no mechanism for students to submit requests.

10. Data Retention and Deletion

• We retain your name and email while you are an active user of the service.
• If you have not submitted a paper in 24 months, we will delete or anonymise your personal data.
• You may request earlier deletion at any time by emailing [email protected].
• Anonymised, aggregated data (e.g., "X% of requests were for Class 12 Physics") may be retained indefinitely as it cannot be linked to any individual.
• Legal hold: We may retain data for longer if required by a valid legal obligation or court order.

11. Cross-Border Data Transfer

Your data is processed by services that may operate servers outside India:

• Anthropic (Claude AI): US-based. Your subject/topic only (no personal identifiers) is sent. Anthropic operates under SOC 2 Type II certification.
• Make.com: EU-based. Full submission data passes through their servers. They are GDPR-compliant.
• Google: US-based. Email delivery. Google's infrastructure meets enterprise security standards globally.

We take care to ensure these transfers are necessary, minimal, and to reputable processors. As DPDPA cross-border transfer rules are notified, we will update our practices to comply.

12. Changes to This Privacy Policy

We may update this policy as our service grows or as legal requirements change. Material changes will be communicated to active users by email at least 14 days before taking effect. The "Last updated" date at the top always reflects the current version.

13. Grievance Officer and Contact

For any privacy questions, data requests, or complaints under DPDPA 2023:

Privacy Contact / Grievance Officer
GyandootAI Private Limited (incorporation in progress)
Email: [email protected]
Subject line: "Privacy Request" or "Data Rights Request"
Response time: Within 7 business days

If your concern is not resolved within 30 days within 30 days, you may escalate to the
Data Protection Board of India at dpboard.gov.in