What personal data we process, exactly why, and how to see it, correct it, take it with you, withdraw your consent, or complain — each explained on its own, in plain language.
Effective: September 20, 2026. Who is giving this notice: Khypri AI, acting as Data Fiduciary under the DPDP Act 2023 for the personal data described below (except where a school or institution has independently determined the purpose of processing for its own students — in that case, the school is the Data Fiduciary and Khypri AI processes data on its instructions). Only a verified parent or guardian can register and consent on a child's behalf; a child cannot create an account or give consent directly.
Every item below is processed only for the specific purpose stated next to it. We do not repurpose any item beyond what's listed here without asking you again.
| Data item | Specific purpose | Status |
|---|---|---|
| Full name | Identify the account holder; personalise communication | Required |
| Email address | Account login; account, security and payment alerts and critical child-safety alerts; progress updates and offers only if you opt in | Required |
| Mobile number | Identity/OTP verification, account recovery, WhatsApp support, and WhatsApp alerts (account, security and payment alerts and critical child-safety alerts; progress updates only if you opt in) | Required |
| Camera image / ID document image (age check, at registration) | Estimate your age, or read your date of birth from an ID document you choose to upload, to confirm you are an adult. This runs only in your own browser, on your own device — nothing is uploaded to our servers or stored | Required at sign-up |
| Date of birth | Confirm you are an adult able to give consent on your child's behalf | Required |
| Billing / payment token | Process subscription charges (full card details are held only by our payment processor, not by us) | Only if you subscribe |
| Data item | Specific purpose | Status |
|---|---|---|
| Display name / nickname (chosen by the parent — not the child's legal name, which we never ask for) | Identify the child within the platform without exposing their real identity | Required |
| Grade/school, board | Personalise and curriculum-align the child's practice content | Required |
| Question responses & scores | Evaluate understanding, generate the child's own progress report, adapt question difficulty | Required |
| Generated practice papers | Give the child material to study from; show the parent what was practised | Required |
| AI tutor conversations (the child's messages and the replies) | Tutor the child; let the parent review conversations; detect serious safety concerns and alert the parent, with a short AI-written summary (see Privacy Policy Section 4.3) | Required |
We never collect photos, audio, video, or precise (GPS-level) location from a child, and we never use a child's data for advertising or to build a behavioural profile. We do not collect or store photos, audio or video from parents either: the registration age check runs on your own device and nothing from it is uploaded or stored.
| Data item | Specific purpose | Status |
|---|---|---|
| IP address, device/browser type | Security, fraud prevention, keeping the service reliable | Required |
| City-level location (from parent's IP only, at signup) | Suggest which country's age-of-consent rule applies to you — a default you can correct, never used to track anyone's movement | Required |
| Aggregated analytics cookies | Understand which features are used, on the public website only | Optional — off by default |
Full detail on legal basis, retention, and the third parties each category is shared with is in Sections 2, 5, and 6 of our Privacy Policy, and in our Sub-Processors list.
Withdrawal does not affect the lawfulness of processing that already happened before you withdrew, and it does not affect the school's own basis for processing where an institution (not you) is the Data Fiduciary. If you subscribed to a paid plan, withdrawing consent also ends the service; it does not by itself cancel a billing cycle already in progress — email support@khypri.com for billing.
Each of the following is exercised the same way — one email to our Data Protection Officer, no forms or account login needed:
See exactly what personal data we hold about you or your child, or correct anything that's wrong or out of date. You can download everything yourself with "Export my data" in your profile (a JSON file; it is not encrypted, so keep it safe).
Get a copy of your data in a structured, machine-readable format (JSON or CSV) to take elsewhere.
Ask us to permanently delete your or your child's personal data, subject to any legal retention requirement. You can start this yourself with "Delete my account" in your profile settings.
If something about how we've handled your data feels wrong, raise it with us directly first — we acknowledge within 3 business days.
We verify you are the account holder (or the account holder's parent/guardian) before acting on any request, to stop anyone else from accessing a child's data. Access/correction/portability requests are fulfilled within 15 days; erasure within 30 days. Full process detail is in Section 8 of our Privacy Policy and in our Grievance Redressal Policy, which also explains how to complain to the Data Protection Board of India.
If you raise a grievance with us and are not satisfied with our response, you have the right under Section 13 of the DPDP Act to complain to the Data Protection Board of India.
As of this notice's effective date, the Board's public complaint portal is still being stood up by the Government of India and is not yet operational for citizen complaints. Until it is, we ask that you first give us the chance to resolve your grievance directly via the button above — we treat that as seriously as we would a Board complaint. Once the Board's portal is live, we will publish the direct link here and in our Privacy Policy, and we will not remove or obscure this section in the meantime.
If you have an active Khypri AI account, you can see the current status of each of your consents inside your account settings at app.khypri.com (Profile → Consents), and change the optional ones there; we keep a dated record of every change. This notice describes what that consent covers; it does not itself require you to have an account.
Contact our Data Protection Officer, Debasmita Maharana, at dpo@khypri.com, for anything on this page — including if any part of it was unclear, which is itself something we want to fix.