What personal data we process, exactly why, and how to see it, correct it, take it with you, withdraw your consent, or complain — each explained on its own, in plain language.
Effective: August 1, 2026. Who is giving this notice: Khypri AI, acting as Data Fiduciary under the DPDP Act 2023 for the personal data described below (except where a school or institution has independently determined the purpose of processing for its own students — in that case, the school is the Data Fiduciary and Khypri AI processes data on its instructions). Only a verified parent or guardian can register and consent on a child's behalf; a child cannot create an account or give consent directly.
Every item below is processed only for the specific purpose stated next to it. We do not repurpose any item beyond what's listed here without asking you again.
| Data item | Specific purpose | Status |
|---|---|---|
| Full name | Identify the account holder; personalise communication | Required |
| Email address | Account login, security alerts, service and (opted-in) marketing communication | Required |
| Mobile number | Identity/OTP verification, account recovery, WhatsApp support | Required |
| Date of birth | Confirm you are an adult able to give consent on your child's behalf | Required |
| Billing / payment token | Process subscription charges (full card details are held only by our payment processor, not by us) | Only if you subscribe |
| Data item | Specific purpose | Status |
|---|---|---|
| Display name / nickname (chosen by the parent — not the child's legal name, which we never ask for) | Identify the child within the platform without exposing their real identity | Required |
| Grade/school, board | Personalise and curriculum-align the child's practice content | Required |
| Question responses & scores | Evaluate understanding, generate the child's own progress report, adapt question difficulty | Required |
| Generated practice papers | Give the child material to study from; show the parent what was practised | Required |
We never collect photos, audio, video, or precise (GPS-level) location from a child, and we never use a child's data for advertising or to build a behavioural profile.
| Data item | Specific purpose | Status |
|---|---|---|
| IP address, device/browser type | Security, fraud prevention, keeping the service reliable | Required |
| City-level location (from parent's IP only, at signup) | Suggest which country's age-of-consent rule applies to you — a default you can correct, never used to track anyone's movement | Required |
| Aggregated analytics cookies | Understand which features are used, on the public website only | Optional — off by default |
Full detail on legal basis, retention, and the third parties each category is shared with is in Sections 2, 5, and 6 of our Privacy Policy, and in our Sub-Processors list.
Withdrawal does not affect the lawfulness of processing that already happened before you withdrew, and it does not affect the school's own basis for processing where an institution (not you) is the Data Fiduciary. If you subscribed to a paid plan, withdrawing consent also ends the service; it does not by itself cancel a billing cycle already in progress — email support@khypri.com for billing.
Each of the following is exercised the same way — one email to our Data Protection Officer, no forms or account login needed:
See exactly what personal data we hold about you or your child, or correct anything that's wrong or out of date.
Get a copy of your data in a structured, machine-readable format (JSON or CSV) to take elsewhere.
Ask us to permanently delete your or your child's personal data, subject to any legal retention requirement.
If something about how we've handled your data feels wrong, raise it with us directly first — we acknowledge within 3 business days.
We verify you are the account holder (or the account holder's parent/guardian) before acting on any request, to stop anyone else from accessing a child's data. Access/correction/portability requests are fulfilled within 15 days; erasure within 30 days. Full process detail is in Section 8 of our Privacy Policy.
If you raise a grievance with us and are not satisfied with our response, you have the right under Section 13 of the DPDP Act to complain to the Data Protection Board of India.
As of this notice's effective date, the Board's public complaint portal is still being stood up by the Government of India and is not yet operational for citizen complaints. Until it is, we ask that you first give us the chance to resolve your grievance directly via the button above — we treat that as seriously as we would a Board complaint. Once the Board's portal is live, we will publish the direct link here and in our Privacy Policy, and we will not remove or obscure this section in the meantime.
If you have an active Khypri AI account, your consent history and current consent status for each purpose are viewable inside your account settings at app.khypri.com. This notice describes what that consent covers; it does not itself require you to have an account.
Contact our Data Protection Officer, Gaurav Chodnekar, at dpo@khypri.com, for anything on this page — including if any part of it was unclear, which is itself something we want to fix.