Privacy Policy

At Gurukul Student, we take your privacy seriously. This Privacy Policy explains what information we collect when you use our learning app, why we collect it, how we protect it, and the choices you and your family have. It applies to students and learners, and to the parents or guardians who set up and supervise a learner's account.

Gurukul Student is a learning companion connected to your school. Where your school provides your records - such as grades, attendance, and exam results - your school remains responsible for that data, and we process it to deliver the learning experience to you. We process student data with the consent and under the supervision of your school, parent, or guardian.

By using our Service, you consent to the data practices described in this policy. If you do not agree with any part of it, please discontinue use of the Service.

We collect the following information so the learning app can work for you:

Account information. Name, email or username, phone number, password (stored only as a salted hash), and the school and class you belong to.

Academic data from your school. Your enrolment, grades, attendance, homework, and exam schedules and results shared by your school.

Learning activity. Your AI tutoring conversations with Vidya, practice and quiz answers, study progress, and leaderboard activity.

Payment data. Credit purchases and payment history, processed through our payment provider. We do not store full card numbers.

Parent or guardian information. Contact details where a guardian account is linked to support your learning.

Automatically collected data. Device and browser type, IP address, approximate location, and anonymized usage analytics that help us keep the app fast and reliable.

We use the information we collect only to help you learn and to run the Service:

• To provide, operate, and secure the app, including signing you in.
• To power AI tutoring with Vidya, practice quizzes, and personalised study resources.
• To show you your own grades, attendance, homework, and exam results.
• To process credit purchases and payments.
• To run leaderboards and track your study progress.
• To connect you with your school and, where enabled, your parents or guardians.
• To send notifications and important updates about the Service.
• To improve the app, fix issues, and develop new learning features.
• To detect and prevent fraud, abuse, or security incidents.
• To comply with our legal obligations under the laws of Nepal.

We do not sell your data or use your learning activity for advertising.

We do not sell, rent, or trade your personal information. We share data only in these limited situations:

• With your school - teachers and administrators at your connected school, for educational and progress-tracking purposes.
• With linked parents or guardians - where a guardian account is connected to support your learning.
• With service providers - trusted vendors who help us run the Service under strict contractual obligations, including hosting and storage providers, payment processors, and the AI model providers that power tutoring.
• For legal compliance - when required by a valid court order, law, or government request in Nepal.
• Business transfers - in connection with a merger, acquisition, or asset sale, in which case we will notify you before your data becomes subject to a different privacy policy.

We apply industry-standard safeguards to protect your data:

• SSL/TLS encryption for all data in transit.
• AES-256 encryption for data at rest.
• Access controls and authentication, so each person only sees what they are allowed to.
• Regular security reviews, monitoring, and encrypted backups.

No system is perfectly secure, but we work continuously to protect your learning data and to limit access strictly to authorized personnel.

Gurukul Student is used by learners who may be minors. We collect and process a minor's data only with the consent and under the supervision of their school, parent, or guardian, and in compliance with applicable child-protection laws.

A parent, guardian, or school is responsible for setting up and supervising a minor's account and for providing any consent required for the collection and use of that learner's data. Parents and guardians can exercise a learner's privacy rights - such as access, correction, or deletion - on their behalf.

We take extra care to limit the data we collect from minors to what is needed to deliver the Service, and we never use it for advertising.

We retain your personal data for as long as your account is active and as needed to provide the Service. Academic records and learning history may be retained for longer to preserve your progress or where required by educational regulations.

If your account is closed or your school connection is removed, your data is retained for 90 days to allow for export, after which it is securely deleted unless a longer retention period is required by law. Anonymized, aggregated analytics that cannot identify you may be retained indefinitely to help us improve the app.

Depending on your location, you may have the right to:

• Access - request a copy of the personal data we hold about you.
• Correction - ask us to fix inaccurate or incomplete data.
• Deletion - request deletion of your data, subject to legal and academic-record retention requirements.
• Portability - request an export of your data in a portable format.
• Objection - object to certain processing activities.
• Withdraw consent - where processing relies on consent, withdraw it at any time.

To exercise these rights, contact us using the details in the final section. If you are a minor, a parent, guardian, or your school may exercise these rights on your behalf. We respond to all data-related requests within 30 days.

We store and process data on cloud infrastructure chosen for performance and reliability. Some of our service providers - for example hosting, storage, payment, and AI model providers - may process data on servers located outside Nepal.

Where data is transferred across borders, we take steps to ensure it remains protected to a standard consistent with this policy, including contractual safeguards that require our providers to keep your data confidential and secure. By using the Service, you understand that your data may be processed in the locations where we and our providers operate.

We use a small number of first-party cookies and similar technologies:

• Essential cookies - required for sign-in and core functionality.
• Preference cookies - remember settings such as your theme.
• Analytics - anonymized, aggregated usage measurement to help us improve the app.

We do not use third-party advertising trackers that follow you across the web. You can manage or clear cookies through your browser settings, though disabling essential cookies may prevent you from signing in.

To deliver the Service, we rely on a small set of carefully chosen providers, each engaged under contractual terms that require appropriate security and confidentiality. These typically include:

• Cloud hosting & databases - to run the app and store your records securely.
• File & document storage - for images, documents, and study material.
• Payment processors - to handle credit purchases without exposing card details to us.
• AI model providers - to power tutoring with Vidya and generate practice content.

These providers may only process data on our instructions and for the purpose of supporting the Service. We review our providers periodically and update our practices as the app evolves.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy here, refresh the "Last updated" date, and - where appropriate - notify you in the app before the changes take effect.

We encourage you to review this policy periodically to stay informed about how we protect your data.

If you have questions about this Privacy Policy or our data practices, contact us:

• Email: support@gurukulhq.com
• Phone: +977-1-4567890
• Address: Gurukul Educational Systems, Kathmandu, Nepal

We respond to all data-related requests within 30 days.