TYCHR — Privacy Notice

DRAFT, FOR LEGAL REVIEW. Not reviewed by a qualified Indian advocate. Every [placeholder] must be filled and the whole document signed off by counsel before publication. This is not legal advice.

Document: Privacy notice (notice under section 5, Digital Personal Data Protection Act, 2023) Applies to: app.tychr.com, platform.tychr.com, www.tychr.com and the TYCHR mobile apps Version: 2.0-draft · Effective date: [insert] · Last updated: [insert] Available in: English · हिन्दी

1. Who we are

[VEDANT: registered name] ("TYCHR", "we", "us") is a private limited company incorporated under the Companies Act, 2013.

For the personal data described here we are the Data Fiduciary. You — and, where the learner is a child, the child — are Data Principals.

Grievance Officer and data protection contact Vedant Patnaik · vedant@tychr.com · [insert postal address] · [insert phone] See the Grievance policy.

2. What this notice covers

We offer two things:

1. a content subscription — notes, web books, videos, flashcards, question banks, practice papers, mock exams and AI study help for IB and IGCSE; and
2. hourly one-to-one and small-group tutoring, delivered in live online classes.

Depending on what you buy, you may also use counselling, test series, parent reporting and proctored tests. This notice covers all of it.

Separate, more specific notices sit alongside this one:

• Cookie and tracking notice
• Data retention and deletion policy
• Processor register

3. The personal data we collect

This list is itemised as section 5(1) of the DPDP Act requires. It was built by reading our own code and database schemas, not from a template. Appendix A maps each category to the tables that hold it, so a reviewer can check it.

3.1 Account and identity

Name, email address, phone number, profile photo, role (student, parent, tutor, counsellor, staff), year group and curriculum, time zone, nationality, languages spoken, gender (only if you enter it), dream university and dream profession (only if you enter it).

3.2 Sign-in and security

Password and two-factor authentication secrets (held by our self-hosted sign-in service), one-time codes sent to your email or phone, phone-verification records, device and browser sessions, sign-in and sign-out times, IP address, impersonation records when support staff access an account with authority.

3.3 Learning activity and student work

Enrolments, subjects, topics and subtopics studied, class attendance and the minute-by-minute intervals you were present, homework and its submissions, coursework drafts and every saved version, notes you type, highlights, bookmarks, flashcard reviews, quiz and test attempts and answers, question attempts, mastery and confidence scores, study streaks, points, badges, experience points, leaderboard position (only if you switch it on), planner tasks and study goals, reading progress, glossary and language exercise attempts, peer reviews.

3.4 Assessment and marking

Test and mock-exam papers you sit, your written answers, scanned answer pages, marks, grade boundaries applied, examiner-style feedback and annotations, second-marking and moderation records, disputes you raise, academic-integrity and collusion signals, results released to you.

3.5 Live classes, recordings and transcripts

Audio and video of the live class, screen shares, whiteboard snapshots, class chat messages, doubts and replies, polls and reactions, class recaps, recordings of the session, transcripts of the session, AI-generated summaries and insights from the class, join and eviction logs, lobby presence, feedback and ratings you give a class or tutor.

Recordings and transcripts are only made where you have separately agreed to them at the point of buying a classroom or tutoring. See section 6.

3.6 Proctored tests

Where a test is proctored, and only where you have agreed on the consent screen for that test:

• a live photograph of you and a photograph of your student ID, taken before the test starts, which a member of our staff compares by eye. There is no automated face recognition.
• still photographs from your webcam during the test, taken at an interval we set per test (60 seconds by default).
• proctoring events — the camera being switched off, and, where your browser can work it out on your own device, no face or more than one face in view. These are advisory and are reviewed by a person.
• chat with the proctor.

No video is recorded and your screen is not recorded. Every photograph is deleted automatically after 90 days by default (section 9), or sooner if we set a shorter period for that test.

3.7 AI features

Your questions to our AI study assistants, the answers given, the parts of your work sent for AI marking or feedback, AI chat threads and messages, AI-generated nudges, AI feedback on counselling essays, saved AI items, a per-student "tutor memory" the assistant keeps so it can follow your progress, and usage logs (which feature, when, how much).

3.8 Payments

What you bought (a classroom, a unit, a content plan, an add-on, recording access, an application fee), amount, currency, date, order and payment identifiers from our payment gateway, payment status, refunds, invoices, GST details, subscription start and end dates. We never see or store your full card number, UPI PIN or bank credentials — those go directly to the payment gateway.

3.9 Parent and guardian data

A parent's or guardian's name, email address and phone number; the link between parent and student; weekly and periodic reports sent to the parent; messages between TYCHR and the parent; the parent's notification and marketing choices. A parent is a Data Principal for their own contact details.

3.10 Health, wellbeing and accessibility — sensitive

Wellbeing check-ins and self-reported mood, wellbeing alerts and risk flags raised by staff or by the system, escalation records and the audit log of who looked at them, exam accommodations and access arrangements (which may reveal a disability or a health condition), and psychometric results where you take a psychometric test as part of counselling.

We treat this as the most sensitive data we hold. Access is restricted and every access is logged.

3.11 University counselling

Academic profile and predicted grades, exam scores, activities, honours and experiences, essays and every draft and comment, recommenders and recommendation requests, application targets and offers, scholarships and funding entries, affordability and family-finance information where you choose to enter it, meeting notes, counsellor assignments, post-admission tasks, documents you upload, and what you choose to share with a parent.

3.12 Messages and support

Messages in class threads, direct messages with tutors and counsellors, support and enquiry conversations, complaints and grievances, feedback and testimonials, notification preferences.

3.13 Files you upload

Documents, images, scans of handwritten work, coursework files, counselling documents, and anything else you attach.

3.14 Enquiries before you sign up

If you book a demo or send an enquiry: name, email, phone, country, curriculum and subject of interest, how you found us, and the notes our team makes while following up.

3.15 Device and usage

Device and browser type, operating system, app version, push-notification tokens for mobile apps, pages and features used, session length, error reports.

3.16 Tutor, counsellor and staff data

If you work with us or for us: everything in 3.1 and 3.2 plus CV, qualifications, teaching certifications and certificate files, an introduction video, LinkedIn profile, hourly rate and pay-period approvals, leave, availability, quality statistics, cancellation penalties, and testimonials.

3.17 Marketing and consent records

Your consent choices and when and how you made them, your marketing opt-ins and opt-outs for email, WhatsApp and SMS, referral records, and — only where you separately agree — your name, photo, video or result used in our marketing.

4. Why we use it, and on what legal footing

We do not use your personal data for any purpose outside this table. If we ever want to, we will ask you first.

5. Children and students under 18

Most of our learners are under 18. This is what we do today.

a. Today, the person who signs up is the account holder and the paying party, and that is usually the student. Anyone who registers on the platform gets a student account and pays at the checkout from it. A parent or guardian account exists, and is linked to the student's, but TYCHR creates it on request — the sign-up form does not. Where a parent or guardian account is linked, the parent can do everything in paragraph c.

b. The consent choices described in section 6 are made on whichever account is signed in, which today is usually the student's own. Where a parent or guardian account is linked, the parent can see and withdraw those consents too. We do not today confirm that the person giving a consent for a learner under 18 is that learner's parent.

c. A parent or guardian may at any time see the student's data, ask for it to be corrected, withdraw any consent, or ask for the account to be deleted, using the contacts in section 10.

d. We do not do behavioural tracking of students, we do not run session replay or product analytics on student accounts, and we do not send advertising or promotional messages to a student account. Promotional email, WhatsApp and SMS go only to a parent, guardian or adult account that has opted in.

e. We do not process a student's personal data in a way we believe is likely to have a detrimental effect on their wellbeing.

f. The same protections apply to a person with a disability who has a lawful guardian.

g. Where you tell us a learner is 18 or over, we act on that statement. If a child's data has reached us without a parent or guardian knowing, tell the Grievance Officer and we will delete it.

What we have not built yet, stated plainly. Section 9(1) of the DPDP Act and Rule 10 require a specific, checkable way of confirming that the person consenting for a child is that child's parent and is an identifiable adult. TYCHR has not built that. This notice therefore describes only what actually happens — whoever signs up holds the account, pays, and gives the consents — and makes no claim that any parental consent has been verified. [LAWYER: this is the central open item; the Act requires verifiable parental consent before a child's data is processed on consent, and we are relying on the account holder's own statement of age.]

6. Consent: what we ask, when, and how to take it back

6.1 At sign-up

• Core service — a single clear agreement to this notice, so we can run your account, deliver the content and your classes, mark your work and take payment. Without it we cannot provide the service.
• Marketing — a separate, optional consent, recorded separately from the one above and never bundled with it. Refusing or never giving it changes nothing about your service. It is not asked for on the sign-up form today, because the sign-up form creates a student account and section 9(3) of the Act bans advertising directed at children outright — so there is no marketing consent we could lawfully act on there. It is asked for on an adult account. [VEDANT: you asked for a sign-up box; it can only be offered once sign-up can create a non-student account.]

6.2 When you buy a classroom or tutoring

Taken at the checkout for that purchase, not at sign-up, because it is only relevant once there is a live class:

• Class recording — "Record my live classes so I can rewatch them." Optional and separate.
• AI use of voice, video and chat — "Use the audio, video and chat from my classes to produce transcripts, recaps and AI feedback." Optional and separate.
• Cross-border disclosure — we tell you, at that point, that the AI and video services we use may process this data outside India, and name them (section 8).

6.3 Other separate consents

• Proctoring, asked for the specific test.
• Use of your name, photo, video or result in our marketing.
• Psychometric testing and affordability information in counselling.

6.4 Withdrawing consent

Withdrawal is as easy as giving it. One switch in Settings for each consent above, and one click in any marketing email, WhatsApp or SMS to stop that channel. No phone call, no form, no reason needed.

• Withdrawing an optional consent (marketing, recording, AI) stops that activity and leaves the rest of your service working.
• Withdrawing consent for the core service means we can no longer provide the platform, and your account is closed under the retention and deletion policy.
• Withdrawal does not undo what was lawfully done before it, and it does not reach data we must keep by law (for example payment and invoice records).

7. Who we share it with

We do not sell, rent or trade personal data.

a. Tutors, counsellors and academic staff — a student's name, year group, subject, work, progress and the class record, so they can teach and support them. Many tutors are independent contractors; each is bound by a written data clause in their contract.

b. Processors acting only on our instructions. The full list, with where each one is located and what it receives, is in the Processor register. In summary:

c. Professional advisers — lawyers, auditors, accountants, insurers, under a duty of confidence.

d. Authorities — where the law, a court order or a lawful request requires it, and to establish or defend a legal claim.

e. A buyer or successor in a merger, acquisition or restructuring, subject to this notice.

Our sign-in service (Zitadel) is software we run ourselves on our own infrastructure. It is not a third party and your credentials are not shared with anyone.

8. Where your data goes

Our primary storage is in India. Databases, file storage, backups and content delivery run in Amazon Web Services' Mumbai region (ap-south-1).

Some services necessarily process data outside India:

Section 16 of the DPDP Act permits transfer outside India except to a country the Central Government restricts. We transfer only to unrestricted countries and put a written data processing agreement in place with each processor.

9. How long we keep it

The table below is the full statement of our retention periods for now. A separate retention and deletion policy goes into more detail per data type; it is not published yet, and until it is, these are the periods that apply. You may ask us for a copy of either at any time using the contacts in section 15.

10. Your rights

Under the DPDP Act you may:

a. See what we hold — a summary of your personal data, what we do with it, and the identity of every other fiduciary and processor it has been shared with and what was shared; b. Correct and complete it — have wrong or misleading data corrected, incomplete data completed, data brought up to date; c. Have it erased — where it is no longer needed for the purpose and no law requires us to keep it; d. Raise a grievance with us — see section 11; e. Nominate someone to exercise these rights for you if you die or cannot act yourself. There is no form for this yet — email the Grievance Officer and we will record it; f. Withdraw consent at any time, as easily as you gave it (section 6.4).

How to use a right. By emailing vedant@tychr.com from your registered address — that route always works. Some rights also have a page in Settings; where you cannot see it, use the email. We will confirm we have it within 48 hours, and answer within 30 days, and in no case later than the 90 days the DPDP Rules allow. We may ask you to confirm who you are. There is no charge; we may refuse a request that is clearly unfounded or repeated, and we will tell you why and how to complain.

Before we delete an account there is a 7-day cooling-off period. We tell your registered email, and your phone where you have given one, and you can cancel the request at any time during it — so a mistaken or malicious request can be stopped. We may hold a request for up to 30 days longer where something must be settled first, such as an open payment dispute, and we tell you the date by which it will be decided.

11. Complaints

First, come to us. Grievance Officer: Vedant Patnaik, vedant@tychr.com. We confirm every grievance within 48 hours and resolve it within 30 days, and never later than 90 days.

Then, the Board. If we do not resolve it, or do not answer within that period, you can complain to the Data Protection Board of India — [insert Board address and web link]. Quote the reference number we gave you.

Full detail in the Grievance policy.

12. Security

We use measures appropriate to the risk, including encryption in transit, access controls on a need-to-know basis, two-factor authentication for staff, a self-hosted sign-in service, audit logging of staff access to sensitive records, signed and time-limited links to files and recordings, separate databases per service, and a written breach response plan.

If a personal data breach happens we tell every affected person and the Data Protection Board without delay, and give the Board a full report within 72 hours. See the Data breach response plan.

No system is perfectly secure. Keep your password private and tell us at once if you think someone else has it.

13. Your duties

The DPDP Act asks you to give accurate information, not to impersonate anyone, not to file a false or frivolous grievance, and not to suppress material information when applying for something. Breaching these duties can attract a penalty under the Act.

14. Changes

We will post any change here and update the "last updated" date. If a change is material we will tell you by email before it takes effect, and where the law requires it we will ask for your consent again.

15. Contact

Appendix A — where each category lives (for the reviewing lawyer and for audit)

Derived from the migrations and schemas in the TYCHR platform repository. Table names are given so a reviewer can check the claim.

Draft, for legal review.