Data Retention and Erasure Policy

How long personal data is kept, what happens when an account is deleted, and what we keep by law.

Effective date and version: September 20, 2026 (Version 1.0). This document is available in English only and forms part of, and shall be read together with, the Terms of Service and the Privacy Policy.

1. Purpose and Scope

1.1 This Policy describes how long Khypri AI (the “Company”) retains Personal Data and how it erases it, and expands Section 6 of the Privacy Policy. It applies to every Account, including each Student profile under it.

2. Retention While the Account Is Active

2.1 Personal Data is retained for so long as the Account remains active and is used to provide the service, to enable the Account Holder to review a Student’s progress, and for the other purposes stated in the Privacy Policy.

2.2 The Company does not sell Personal Data and does not retain it in order to advertise to a child.

2.3 The end of a subscription or of a trial does not by itself lead to the erasure of an Account or of a Student profile. When a plan or trial ends, the features that come with it stop until the Account Holder renews or upgrades, and the Account and the Student profiles remain as they are. Personal Data is erased on a deletion request as described in Part 3, or as otherwise stated in this Policy. The Company does not run an automatic erasure of Accounts because a plan has ended.

3. Deletion of an Account

3.1 An Account Holder may request deletion of the Account within the Platform (“Delete my account” in the profile settings, confirmed by typing the registered email address) or by writing to the Data Protection Officer at dpo@khypri.com.

3.2 On a deletion request: the Account and every Student profile are deactivated immediately and sign-in stops; every consent is treated as withdrawn and the withdrawal is recorded; any subscription is cancelled so that no further charge is made; and a confirmation is sent to the registered email address.

3.3 The Company then holds the request for a cooling-off period of seven (7) days (or another period of not more than twenty-one (21) days set by the Data Protection Officer on a written request), during which the Account may be restored on a written request sent from the registered email address. A subscription that has been cancelled is not reinstated by restoration.

3.4 When the cooling-off period ends, the Personal Data is erased. Erasure is completed in any event within thirty (30) days of a Verified Request, save as provided in Part 5.

3.5 If a step of the erasure cannot be completed immediately (for example, due to a temporary failure of a third-party service), the Company retries the failed step periodically and completes erasure within the overarching thirty (30) day statutory deadline, with DPO manual intervention if required.

4. What Is Erased

4.1 The following are erased:

  1. the Account and Student profile details: name, email address, phone number, date of birth, photograph, password hash, address and location, which are erased or replaced so that they no longer identify a person;
  2. learning and chat data: chat conversations and their safety-check results, practice and examination records, question history, module and attendance records, certificates, personal settings and uploaded files, together with the text and vectors derived from uploaded files;
  3. login history (including IP addresses), profile-change history, verification codes and audit entries of mobile verification;
  4. messages sent through the contact form from the registered email address, copies of emails sent to that address, and any waiting-list sign-up made with it;
  5. the Support PIN and the record that a support person had verified it;
  6. the sign-in credentials held with the Company’s authentication provider; and
  7. the uploaded files themselves, which are removed from storage before the database records are erased.

4.2 Safety-incident records and message-delivery records are kept in de-identified form only: severity, type, template, status and time are retained, and the conversation text, contact details and message content are erased.

5. What Is Retained and Why

5.1 The following are retained, for the purpose stated, and used for no other purpose:

  1. payment, order, subscription and credit-ledger records, for the period required by applicable tax and accounting law;
  2. the record of consents given and withdrawn (identifiers and answers only), the dated history of each change and the wording shown at the time, as evidence of consent and of its withdrawal;
  3. cancellation and refund-review records (plan, last payment reference, reason category, status and amounts), from which the email address and any free-text notes are erased;
  4. the log of Support PIN use by staff (which employee verified or renewed a PIN, when, and the result), which holds identifiers only;
  5. fraud and security block-lists; and
  6. the record of the deletion request and the log of what was erased, containing no personal data other than a one-way hash of the email address, as evidence that the request was carried out.

5.2 Support correspondence is reviewed individually on an erasure request and is erased unless retention is necessary for a purpose permitted by law.

5.3 Statutory Record Preservation and Evidence Certification (BSB 2023 & BNSS 2023). In accordance with Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSB), all retained audit logs, cryptographic hashes, and transaction logs are maintained as certified electronic records for evidentiary purposes. Where applicable law, court orders, or lawful directions issued by law enforcement agencies under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) concerning a criminal investigation or child-safety matter require specific records to be preserved, routine erasure of those specific records is suspended for as long as the statutory requirement continues, as described in the Safety Policy.

6. Direct-to-Consumer Scope

6.1 Khypri AI operates as a direct-to-consumer platform for individual families and students and does not offer institutional or school-administered accounts. Retention and erasure of all Personal Data are governed strictly by Parts 2 through 5 of this Policy and the Privacy Policy.

Select Language