1. Who this Policy applies to

This Privacy Policy explains how BhashaMitra Edtech Private Limited, having its registered office at 11/3125, Thomas Tower, Infopark Express Highway, Kochi, Kerala 682039, India (the “Operator”, “Bhashamitra”, “we”, “us” or “our”), processes personal data when an adult uses the Bhashamitra mobile application and related services (the “Service”) personally or for a child.

The Service is offered in India. An individual must be at least 18 years old to create and operate an account, purchase a package or accept the Terms of Use (the “Account Holder”). The Account Holder may use the Service personally as an adult learner or may create and manage a learner profile for a child for whom the Account Holder is a parent or lawful guardian. A “Learner” therefore means either the Account Holder when using the Service personally or a child whose learner profile is created and managed by a parent or lawful guardian. A “Child Learner” means a Learner below 18 years of age. The Service is designed primarily for school-age children, particularly those aged 6–15, but that age range describes the product’s principal audience and does not prevent an adult from using the Service personally. A child does not independently create an account, purchase a package or accept the Terms of Use.

This Policy should be read with the Terms of Use and the short, itemised privacy notice shown to the Account Holder when consent is requested.

2. Personal data we process

3. Why we process personal data

4. Parental consent and children

Before we create a Child Learner profile or process a child’s personal data, we ask the parent or lawful guardian to review an itemised notice and provide affirmative consent. The parent or lawful guardian may refuse or withdraw optional consent without losing access to unrelated features. Withdrawal is designed to be as easy as giving consent, although it does not affect processing already lawfully completed or records that must be retained by law. These child-specific consent requirements do not apply when the Account Holder uses the Service solely for the Account Holder’s own learning.

A mobile OTP or Google/Apple sign-in verifies control of an account; it does not by itself establish that the Account Holder is an adult or is a Child Learner’s parent or lawful guardian. We will use a proportionate, legally compliant method to check that the person giving parental consent is an identifiable adult when required. We prefer an age or identity verification result or token over retaining a copy of an identity document.

The Account Holder controls the account and may delete lesson material, a learner profile or the account. A parent or lawful guardian must supervise a Child Learner’s use of the Service.

5. AI, hosting and other service providers

We use contracted processors to provide the Service. These currently include Google services for supported AI or document processing and Sarvam for supported AI or speech processing. We use the specific production products and settings approved by Bhashamitra, require contractual confidentiality and security, and configure inputs and outputs not to be used to train general-purpose models.

We may also use providers for cloud hosting, identity, payments, diagnostics, security and customer support. They may process personal data only for contracted purposes and under our instructions, subject to applicable law. This Policy identifies the categories of providers needed for an informed choice.

Uploaded content and generated output are private to the Account Holder’s account. They are not placed in a shared textbook, audio, question-answer or training repository and are not reused for another user.

6. Storage, retention and deletion

Primary production storage and approved AI processing are configured in India. If a necessary provider permits authorised support access or processing outside India, we will apply required contractual and technical safeguards and update this Policy where the change is material.

7. When we disclose information

• to contracted service providers described above;
• when the Account Holder directs or authorises the disclosure;
• to comply with a binding legal process or lawful government request;
• to investigate fraud, a security incident, unlawful material or a threat to safety;
• as part of a merger, financing, restructuring or sale, subject to confidentiality and continued protection; or
• where otherwise required or permitted by applicable law.

We do not permit another user to access an Account Holder’s uploads, learner profile, generated text, Q & A or audio.

8. Security and administrative access

We use proportionate technical and organisational safeguards, including encryption in transit and at rest, private object storage, access controls, short-lived access links, monitoring, secure development practices, backups and processor contract controls.

Our personnel do not routinely review private learning material. Exceptional access is limited to Account Holder-authorised support, a security investigation, abuse handling or legal compliance. It is role- restricted, purpose-recorded, time-limited where practicable and logged. No electronic service can guarantee absolute security.

9. Data breaches

We maintain an incident-response process. Where applicable law requires, we will notify affected Account Holders and the Data Protection Board of India without delay and provide further information within the prescribed period. Notices will explain the incident, likely consequences, mitigation, recommended protective steps and a contact for questions.

10. Account Holder rights and choices

Subject to applicable law and proportionate identity verification, an Account Holder may exercise rights concerning the Account Holder’s own data and, where the Account Holder is the parent or lawful guardian, data relating to a Child Learner:

• obtain information about the personal data we process and the processors with whom it has been shared;
• correct inaccurate or incomplete account or learner-profile information;
• erase lesson material, learner activity, a learner profile or the account;
• withdraw consent for optional processing;
• raise and escalate a grievance through the published channel;
• nominate another individual to exercise rights in the event of death or incapacity where the law provides; and
• complain to the Data Protection Board of India once the applicable complaint mechanism is operative.

The app will provide a direct route to exercise available choices. Requests concerning a Child Learner may be made only by the Child Learner’s parent or lawful guardian, subject to applicable law. We may retain limited data despite a deletion request where the law requires or permits it, and we will explain the basis where appropriate.

11. SDKs, advertising and rewards

The Service may use strictly necessary software components for authentication, payments, security, crash reporting and operation. Bhashamitra does not permit targeted or behavioural advertising directed at learners. Rewards are based only on approved learning activity and do not involve a public leaderboard, cash gambling feature or sale of Learner data.

12. Changes to this Policy

We may update this Policy when the Service, providers or law changes. We will show the effective date and provide prominent notice to the Account Holder where a change materially affects Learner data or Account Holder choices. We will seek fresh consent where required. We will not introduce targeted advertising, cross-user content reuse, model training, downloads, sharing or materially expanded child analytics through a policy update alone.

13. Contact and grievance redressal

The Operator is BhashaMitra Edtech Private Limited. Registered and correspondence address: 11/3125, Thomas Tower, Infopark Express Highway, Kochi, Kerala 682039, India.