Privacy Policy

1. Legal Basis for Processing

EduSathi processes staff personal data based on explicit, affirmative consent as required under Section 6 of the Digital Personal Data Protection Act, 2023. Consent is collected at the time of account creation or first login for accounts created by institutional administrators. You may withdraw your consent at any time through your profile settings. Student academic records are processed on the institution's instructions (see 1A).

1A. Roles under the DPDP Act (B2B)

For staff accounts (institute admins, teachers, scanners), EduSathi is the Data Fiduciary. For student answer sheets, names, roll numbers, and marks, the institution is the Data Fiduciary and EduSathi is a Data Processor acting on the institution's documented instructions, as described in our Data Processing terms.

Institutions must have a lawful basis to upload student data (including verifiable parental consent where the Data Principal is a child under 18). EduSathi does not use student data for advertising, profiling for ads, or tracking pixels.

2. Data We Collect

• Account data: name, email, phone, organisation details.
• Academic data: answer sheets, exam details, and AI-generated grading outputs.
• Usage/security logs: IP address, device info, browser user-agent, requests, and authentication events.
• Consent records: timestamps of consent acceptance, IP at time of consent, consent withdrawal records.
• Payment records: transaction details and invoices.

We do not store full card details. Payments are handled by third-party payment providers.

3. Purpose of Data Processing

We process your data for the following specific purposes:

• Account management: To create, maintain, and secure your account.
• AI-powered grading: To process uploaded answer sheets using AI models for automated evaluation and report generation.
• Operational communication: To send service-related emails, notifications, and support updates.
• Security & abuse prevention: To log access events, detect unauthorized usage, and maintain platform integrity.
• Service improvement: To improve service quality using anonymized, aggregated usage patterns.
• Legal compliance: To meet obligations under applicable Indian laws and respond to lawful government requests.

4. Data Sharing

We do not sell personal data.

We may share limited data with service providers who help us operate EduSathi (hosting, file storage, AI grading, email, and payments). They may process data only to provide that service. Card details are not stored by EduSathi.

We may also disclose data if required by law, valid legal process, or order of the Data Protection Board of India.

5. Cross-Border Data Transfer

Some processing needed to run grading, file storage, or backups may occur outside India, and only in territories not restricted by the Central Government under DPDP Act Section 16(1). We do not load third-party analytics or advertising tags. A demo video loads YouTube only after you click play.

6. Data Security

• Public traffic is encrypted in transit.
• Passwords are stored hashed, not in plain text.
• Access is limited by role so staff only see what their institute and role allow.
• We log security events and block abusive access where we detect it.

7. Data Retention

• Account data: Kept while account is active; deleted within 30 days of a verified erasure request.
• Answer sheets: Retained for up to 180 days after grading, then permanently removed.
• Security/access logs: Retained for up to 90 days for auditing and incident response (CERT-In directions may require longer retention during an investigation).
• Consent records: Retained indefinitely as legal proof of consent under the DPDP Act.
• Tax/payment records: Retained as required by Indian tax and financial regulations.

8. Your Rights Under the DPDP Act

As a Data Principal under the DPDP Act, 2023, you have the following rights:

• Right to Access: Request a summary of your personal data and how it is being processed.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: Withdraw your consent at any time through your profile's "Account & Data" section. Withdrawal does not affect the lawfulness of processing done before withdrawal.
• Right to Nominate: Nominate another person to exercise your rights in the event of your death or incapacity.
• Right to Grievance Redressal: File a complaint with our Grievance Officer (details below). If unresolved within 30 days, you may escalate to the Data Protection Board of India.

To exercise these rights, use the "Account & Data" section in your profile, or email us at [email protected].

9. Consent Withdrawal

You may withdraw your consent at any time by navigating to Profile → Account & Data → Withdraw Consent. Upon withdrawal, you will be logged out and will not be able to access the platform until you re-consent. Your data will be reviewed for deletion within 30 days. You may also email your withdrawal request to [email protected].

9A. Cookies and browser requests

We set an essential session cookie to keep you signed in. We do not use advertising cookies or third-party analytics. Fonts are hosted on EduSathi. Our edge provider may set strictly necessary cookies for HTTPS and bot management.

10. Updates to This Policy

We may revise this policy from time to time and publish the updated version on this page. Material changes will be communicated via email or in-app notification.

11. Grievance Officer

In accordance with Section 8(10) of the DPDP Act, 2023:

12. Escalation to Data Protection Board

If your grievance is not resolved by our Grievance Officer within 30 days, you may file a complaint with the Data Protection Board of India through the official portal: www.dpbi.gov.in or the grievance filing portal at dpdpa-grievance.gov.in.

13. Contact

Email: [email protected]