Privacy policy

The short version: Tutorfic only uses your child's textbook content to teach. We don't sell data, we don't show ads. This policy explains the personal data we process as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, and the rights you have over it.

1. What personal data we collect

• Account details — the email address used to sign in, and your name if you provide it (cloud plan only).
• Library content — the chapter files you upload and the lessons, quizzes and exams generated from them.
• Learner profiles — the name and grade you set for each child on the account.
• Progress data — scores, streaks, badges and weak-area notes per learner profile.
• Usage & billing — counts and approximate AI cost (for your budget cap), credit balance, and a transaction record of any credit purchases.
• Technical data — a device identifier and approximate timestamps, used to enforce the per-account device limit and to keep your account secure.

2. Why we collect it (purpose)

We process this data only to provide the service: to teach from your uploaded content, save and show progress, run your prepaid credit balance and billing, secure your account, and respond to support requests. We do not use your or your child's data for advertising or profiling.

3. Your consent

We process your personal data on the basis of the consent you give when you create an account (by agreeing to this Privacy Policy and our Terms) and, where applicable, for the legitimate uses permitted under the DPDP Act. You may withdraw your consent at any time by deleting your account (see section 7); withdrawing consent does not affect processing already carried out.

4. What we don't do

• We don't sell or rent your data to anyone.
• We don't show advertising to children.
• We don't store card or UPI details — payments are handled on Razorpay's secure hosted checkout; card data never touches our servers.

5. Who we share data with (processors)

We use a small number of trusted service providers (Data Processors) strictly to run the service, under contractual confidentiality and security obligations:

• Google (Firebase & AI) — hosting, authentication, database/storage, and generating lessons from your uploaded content.
• Sarvam — converting lesson text to speech (read-aloud).
• Razorpay — processing credit purchases.
• Google Analytics — measuring website and app usage (see section 6).

We do not share your data with anyone else except where required by law.

6. Cookies & analytics

We use Google Analytics to understand how our website and app are used so we can improve them. It sets cookies and collects limited technical data — such as a randomised identifier, approximate location (from IP, which Google anonymises), device and browser type, and the pages you visit. We use this only in aggregate to measure usage; we do not use it to advertise to you or to identify individual children.

Visitors in the EU, EEA and UK are shown a consent banner and analytics cookies are not set unless you accept them. Everywhere else you can opt out by using your browser's cookie controls, by installing Google's opt-out add-on, or by enabling "Do Not Track." Essential cookies needed to keep you signed in and run the service are always used and cannot be turned off.

7. Your rights

Under the DPDP Act you have the right to:

• Access — ask for a summary of the personal data we hold about you.
• Correct & update — fix inaccurate or incomplete data. You can edit learner profiles and library content directly in the app, or email us.
• Erase / delete — delete a chapter, a learner profile, or your entire account at any time. In the app, open the 👤 account menu and choose Delete account; this permanently removes your library, learners, progress, uploads and login. You can also email us to request erasure.
• Grievance redressal — raise a complaint with our Grievance Officer (section 11).
• Nominate — nominate another person to exercise your rights in the event of death or incapacity.

8. How long we keep data (retention)

• Account, library and progress data — kept while your account is active. When you delete your account it is erased promptly (typically within 30 days across backups).
• Transaction records — records of credit purchases are retained for up to 8 years after the transaction to meet tax, accounting and audit obligations, even after account deletion. These records hold no card data and are de-linked from your deleted profile.

9. How we protect your data

Data is encrypted in transit (HTTPS/TLS) and at rest. Access to production data is restricted to authorised personnel on a need-to-know basis. If you self-host, everything stays on your own machine. In the unlikely event of a personal-data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

10. Children's privacy

Tutorfic is designed to be used by children under the supervision of a parent, teacher or guardian, who creates and controls the account and provides consent on the child's behalf. There is nothing for a child to browse to and no public profiles, and we do not direct any advertising at children or use their data for profiling.

11. Grievance Officer / contact

For any privacy question, data-rights request, or complaint, contact our Grievance Officer:

Grievance Officer, Tutorfic
Email: privacy@tutorfic.com
We aim to acknowledge requests within 72 hours and resolve them within the timelines set by the DPDP Act.

12. Changes to this policy

We may update this policy as the product or the law evolves. Material changes will be reflected by the "Last updated" date above, and where required we will ask for fresh consent.