Privacy Policy

Introduction

ChapterLens ("we," "our," or "us") is committed to protecting the privacy and security of our users, especially children. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our educational technology platform.

Data Safety for Children

We take children's privacy very seriously. ChapterLens is designed to be safe for students of all ages, including children under 18 years.

• We collect only the minimum data necessary to provide our educational services
• We never sell, rent, or share children's personal information with third parties for marketing purposes
• We show no advertising of any kind in the student app
• All student data is encrypted both in transit and at rest
• Parents and guardians have the right to access, review, and request deletion of their child's information
• Our data practices are designed around the requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, and we are preparing for the DPDP Act's rules as they come into force
• Child device links are protected against unauthorised access: link codes are single-use and expire within 24 hours, and only the parent can generate them

How Children Use ChapterLens (No Child Accounts)

Children never create accounts, never sign in with an email or Google account, and never enter personal information themselves. A parent or guardian creates the child's profile from their own Google-authenticated account and links the child's device using a code or link that only they can generate. We rely on the parent acting through their own account as the consenting adult; we do not independently verify age or identity today, and we will adopt the verifiable-consent mechanisms prescribed under the DPDP Rules as they take effect. This means:

• The parent is the account holder; the child profile has no credentials of its own
• Creating a child profile and linking a device are explicit acts of parental consent, which we record with a timestamp and the policy version in force
• All purchases and billing happen on the parent's account via our website — the student app contains no payment features, prices, or purchase prompts

Information We Collect

Student Information (entered by the parent, or generated by learning activity)

• First name and grade level (provided by the parent)
• Learning activity: quiz and diagnostic answers, concept mastery levels, and session timestamps — this is the educational product itself
• App version and operating-system version, for compatibility and support

We do not collect from children: precise or approximate location, advertising identifiers, contact lists, photos, audio, or any payment information. Network addresses are truncated before storage and used only for abuse prevention.

Parent/Guardian Information

• Name and email address (via Google sign-in)
• WhatsApp number — only if you opt in to receive progress updates; used solely for account and progress notifications, never marketing
• Billing information (processed securely through Razorpay; we do not store card details)
• Communication preferences and consent records

A parent may invite a co-guardian (for example the other parent, or a tutor) to view their child's progress and manage goals. Co-guardians see only the children the account owner assigns to them and can never change billing, add or remove children, or link devices.

How We Use Your Information

• To provide and improve our educational services
• To track learning progress and generate personalized recommendations
• To communicate with parents/guardians about their child's progress
• To process subscription payments securely
• To provide customer support and respond to inquiries
• To ensure platform security and prevent fraud
• To comply with legal obligations

Data Security

We implement industry-standard security measures to protect your information:

• SSL/TLS encryption for all data transmission
• Secure data storage with encryption at rest
• Restricted access to personal information on a need-to-know basis
• Secure payment processing through PCI-DSS compliant providers (Razorpay)

Data Retention

We retain student data for as long as the account is active or as needed to provide services. Explicit deletion requests from a parent or guardian are honored within 30 days. When an account is closed without an explicit request, we delete or anonymize personal information within 90 days, except where we are required by law to retain certain information.

Third-Party Services

We use trusted third-party service providers to support our platform:

• Razorpay: For secure payment processing (parent website only; the student app has no payment features)
• Supabase / Cloud Hosting Providers: For authentication, data storage, and platform infrastructure
• Google Gemini AI: To evaluate free-text learning answers; answers are processed for evaluation only and are not used to advertise to or profile children
• WhatsApp Business (Meta): To deliver progress notifications to parents who opt in

The student app contains no third-party advertising or analytics SDKs.

All third-party providers are carefully vetted and required to maintain the same level of data protection.

Where data is stored

Our database and authentication infrastructure (Supabase) and AI evaluation service (Google Gemini) may store and process data on servers located outside India. Payment processing through Razorpay happens in India. Wherever data is processed, it remains subject to the protections described in this policy and to our agreements with these providers.

Schools and Teachers

ChapterLens may run learning programs in partnership with schools. In a school program, a teacher can see the learning progress of students in their own class — which concepts the class has understood and where it is struggling.

• A teacher sees a child's learning data only if the child's parent or guardian explicitly consents to joining that school's program
• What a teacher sees is limited to learning progress — concept mastery, quiz results, and homework completion. Teachers never see a parent's contact details, billing information, or anything outside their own class
• A parent can withdraw this consent at any time, which removes the child from the school program without affecting the family's own use of ChapterLens
• We never sell or license children's data to schools, and schools may not use it for anything other than teaching their own students

Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users in the form and manner prescribed under the DPDP Act and its rules, including intimation to affected individuals within 72 hours of becoming aware of the breach, along with the nature of the breach and the steps we are taking.

Your Rights

You have the right to:

• Access your personal information
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Opt-out of marketing communications
• Withdraw consent for data processing (where applicable)

Parental Rights and Controls

Parents and guardians can review their child's information, request corrections or deletion, and refuse further collection or use of their child's information at any time:

• Delete a child's profile (and all associated learning data) from the parent dashboard, or by emailing us
• Delete the entire parent account, which removes all linked child profiles
• Deletion requests are honored within 30 days
• Withdraw WhatsApp notification consent at any time from account settings

Grievance Officer (DPDP Act)

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, questions, concerns, or grievances about the processing of personal data may be addressed to our Grievance Officer, Rama Villuri, at support@chapterlens.com (subject line: "Grievance"). We acknowledge grievances within 72 hours and resolve them within 30 days.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on our website and updating the "Last Updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: