Privacy Policy

Effective date and version: September 20, 2026 (Version 3.0). This Privacy Policy sets out the manner in which personal data is processed by Khypri AI through the Platform and, where a safeguard is still being put in place, states so expressly and does not represent it to be complete. It shall be read together with the Terms of Service, the Safety Policy and the Notice to Data Principal, the last of which constitutes the itemised notice contemplated by Section 5 of the Digital Personal Data Protection Act, 2023.

This is the English original of this Policy. It is also made available in Hindi, Bengali, Marathi, Telugu, Tamil, Gujarati, Urdu, Kannada, Malayalam and Punjabi by means of the language selector above. The translated versions were last synchronised to an earlier version dated August 1, 2026 and are in the course of being updated; until they are, and in the event of any conflict or inconsistency between a translation and this English version, this English version shall prevail.

1. Introduction, Roles and Constitutional Privacy Basis

1.1 Khypri AI (referred to in this Policy as “Khypri”, “the Company”, “we” or “us”) operates the Platform. Anchored in the fundamental Right to Privacy under Article 21 of the Constitution of India (as affirmed in K.S. Puttaswamy v. Union of India, 2017), Khypri acts as the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and as the controller for the purposes of the General Data Protection Regulation (GDPR). Khypri operates exclusively as a direct-to-consumer service for individual families and does not process data under third-party institutional or school instructions.

1.2 In this Policy, unless the context otherwise requires:

1. “Act” means the Digital Personal Data Protection Act, 2023 and the rules made under it, each as amended and in force from time to time;
2. “Account” means the account registered on the Platform by an Account Holder, and includes every Student profile created under it;
3. “Account Holder” means the adult parent or legal guardian who registers an Account, and “you” shall be construed accordingly;
4. “Student” means a child whose profile is created and managed by an Account Holder under the Account;
5. “Platform” means the websites, applications, application programming interfaces and related services of Khypri AI;
6. “Personal Data”, “Data Principal”, “Data Fiduciary” and “Data Processor” have the meanings given to them in the Act, and “processing” includes collection, recording, storage, use, sharing, restriction, erasure and any other operation performed on Personal Data;
7. “Sub-Processor” means a third party engaged by Khypri to process Personal Data on its behalf, as listed in Section 5;
8. “DPO” means the Data Protection Officer of Khypri identified in Section 16; and
9. “Verified Request” means a request that the Company has confirmed to have been made by the Account Holder in accordance with Section 8.

1.3 A reference to a statute or regulation includes that statute or regulation as amended, re-enacted or replaced from time to time. Headings are for convenience only and shall not affect interpretation.

2. Personal Data Processed

2.1 The Company shall process the following categories of Personal Data:

1. Parent/Guardian Identity Data: the Account Holder's full legal name, email address, mobile number and date of birth. The email address and mobile number are also used to send the alerts described in Sections 4.3 and 12.
2. Child Identity Data: the Company does not ask for or collect the legal name of a child. The Account Holder selects a display name or nickname to identify the child within the Platform, together with the child's grade and educational board. The Account Holder also creates a username and password which the child uses to sign in; the password is stored only in hashed form. That display name, and not a legal name, is used wherever the child's profile appears, including in any content sent for AI processing (see Section 5), so that the real identity of a child is not exposed if that data were ever compromised.
3. Educational Data: question responses, performance metrics, generated papers and learning activity within the Platform, associated with the child's display name or profile and not with a legal name.
4. Technical Data: IP address, device identifiers, browser type, and city-level (not precise) geolocation inferred from IP address. Such geolocation and IP-based country detection is collected only during the Account Holder's own registration and login, in order to prevent fraud and to suggest the country whose age-of-consent rules apply to the registering Account Holder (a default suggestion which the Account Holder may correct, and not a final determination). The IP address is also recorded, and city-level location may be inferred from it, when a child signs in, for security and fraud prevention only; it is never used to track the location or movement of a child.
5. Age-Verification & Client-Side Biometric Data Processing (Account Holder, at registration): on registration the Company estimates the Account Holder's age using the device camera (which involves client-side biometric facial feature analysis under the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011 and DPDP Act 2023) and, for some users, reads the date of birth from an identity document image which the user elects to provide. This processing occurs entirely ephemerally within the user's own browser on their local device: the camera feed, facial vectors, biometric templates, and document images are not uploaded to the Company's servers and are not stored. Only the numerical pass/fail outcome of the check is used to permit registration to proceed.
6. AI Conversation Data: a child's messages to the AI tutor and its replies, retained so that the Account Holder may review them and so that serious safety concerns may be detected (see Section 4.3).
7. Payment Data: processed directly by the Company's payment provider; the Company does not store full card numbers.
8. Cancellation and Deletion Data: when an Account Holder cancels a subscription or deletes an Account, the reason chosen from a list and any explanation typed in, together with the plan, the last payment reference and the outcome of the refund review.

2.2 The Company does not collect, record, or store audio recordings, photographs, video, biometric templates, or precise (GPS-level) geolocation from any user, whether parent or child. The registration age check referred to in Section 2.1(e) uses transient client-side biometric feature estimation on the user's own device only, and no biometric data, facial vectors, or raw media derived from it are uploaded or stored on the Company's servers.

2.3 Purpose and Legal Basis

2.3.1 The Company shall process each category of Personal Data only for the purpose, and on the basis, stated against it below:

1. Parent/Guardian Identity Data — purpose: creation of the Account, verification of parental consent and communication. Basis: consent of the Account Holder.
2. Child Identity Data (display name, grade, board) — purpose: personalisation and curriculum alignment of content without exposing the child's real identity. Basis: consent of the Account Holder.
3. Educational Data — purpose: generation and evaluation of academic content and tracking of learning progress. Basis: consent and the Company's legitimate interest in providing the core educational service.
4. Technical Data — purpose: security, fraud prevention, service reliability and suggestion of the applicable age-of-consent rules at registration. Basis: legitimate interest in keeping the Platform secure and operational and in correctly applying jurisdiction-specific child-protection rules.
5. Payment Data — purpose: processing of subscription charges. Basis: contract with the paying party.
6. Alert and Contact Data (the Account Holder's email address and mobile number) — purpose: sending account, security and payment alerts and critical child-safety alerts by WhatsApp and email, and sending progress updates and offers solely where the Account Holder has opted in. Basis: consent (the required “Essential alerts” consent and the optional progress-update and offers consents).
7. AI Conversation Data — purpose: tutoring, enabling the Account Holder to review conversations, and detecting serious safety concerns so that the Account Holder may be alerted. Basis: consent of the Account Holder and, in respect of safety concerns, the protection of a child who may be at risk of serious harm.
8. Age-Verification & Client-Side Biometric Processing Data — purpose: confirming that the registering Account Holder is an adult via transient facial feature estimation. Basis: explicit consent; processed solely and ephemerally on the user's own device.
9. Cancellation and Deletion Data — purpose: reviewing a refund request, keeping the record required for accounting, and understanding why the service is left so that it can be improved. Basis: contract with the paying party and the Company's legitimate interest in improving the service.

3. Cookies and Tracking

3.1 The Company uses only those cookies which are strictly necessary to maintain the login session and security preferences of the user. The Company does not use third-party marketing or advertising cookies and does not build behavioural advertising profiles. Further detail is set out in the Cookie Policy.

3.2 The categories of cookies used are:

1. Strictly necessary: session and authentication cookies required for login and security, which cannot be disabled without loss of the ability to use the Platform;
2. Functional: preference cookies (for example, theme selection) which retain the user's settings between visits;
3. Analytics: privacy-conscious, aggregated usage analytics which may be used to understand feature usage and which do not build individual behavioural profiles or feed advertising; and
4. Advertising: none. No third-party advertising or cross-site tracking cookies are used.

4. Automated Processing, Learning-Support Reports and Child Safety

4.0 The Platform uses artificial intelligence to generate practice content and to provide automated evaluation and feedback on a Student's responses. Where an automated evaluation could have a significant effect on a Student (for example, where it is used as part of a graded assessment), a human teacher shall retain the ability to review, override or disregard the AI-generated evaluation. A Data Principal may request human review of any automated evaluation that materially affects them by writing to dpo@khypri.com. The use of artificial intelligence is described further in the Responsible AI & AI Usage Policy.

4.1 Learning Support Reports — Purpose and Lawful Basis

4.1.1 The Platform is designed to provide transparent academic performance evaluation to individual Account Holders, and records a Student's test and question responses in order to generate an analysis of performance which is visible to the Account Holder. In this respect:

1. Function: the processing is a learning-support function, limited to the Student's own academic activity within the Platform, and is used only (i) to give the Student and the Account Holder an accurate and unbiased picture of the Student's understanding of concepts and test performance, and (ii) to assist the Student's learning, for example by identifying weaker topics and adjusting question difficulty;
2. Exclusions: the processing shall not be used for targeted advertising, marketing, maximisation of engagement or any purpose directed at the child outside the academic workspace; the Company does not build a behavioural or advertising profile of a child, and this data is never shared with or sold to advertisers;
3. Lawful basis: the processing is necessary to perform the core educational service requested by the Account Holder on the child's behalf. The Company seeks the express consent of the Account Holder before any data of the child is processed and, where consent is not given, no data of that child shall be processed; and
4. Parental visibility: the Account Holder may access the Student's progress reports at any time, and this data shall not be used to make decisions about the Student, outside the support of the Student's learning, without the knowledge of the Account Holder.

4.2 Support Team Access

4.2.1 Access by the Company's customer support team to a Student's academic record (progress, certificates and activity) is controlled by a Support PIN. Every Account Holder has a six-character Support PIN (letters and digits), which is generated when the Account is registered, is shown to the Account Holder in the profile, and is replaced automatically every ten (10) days. Support staff cannot see the PIN: the Account Holder gives it to a member of the support team only when help is wanted, and that person types it in. Only where it is correct is the Student's academic record opened, for that Account only and for a limited period of thirty (30) minutes, and a new PIN ends that access at once. Repeated wrong entries are blocked, and every entry, verification and renewal of a PIN is recorded with the employee concerned. Administrators of the Company can see a PIN, and administrators and support staff can generate a new one. Support access is otherwise limited by role (see Section 13.1).

4.3 Child Safety Monitoring and Alerts

4.3.1 In order to help keep children safe, the AI tutor's conversations with a child are automatically checked for indications of serious risk to the child's safety or wellbeing, including self-harm, abuse, violence, bullying or severe distress. Other than assisting the child's learning, this is the sole purpose for which conversations are checked; the checking is not used for advertising or to build a behavioural profile.

4.3.2 Where a serious concern is detected, the AI shall respond with supportive guidance, the concern shall be logged against the child's profile, and the Company shall alert the Account Holder without delay by WhatsApp and email, stating the severity and type of concern. Where an alert is not acknowledged, further reminders shall be sent over the following hours. Approximately fifteen (15) minutes after the first alert, the Company shall also send a short summary of one or two sentences, prepared with the assistance of one of the AI providers listed in Section 5, of the matter concerned. The Company's support team may also contact the Account Holder regarding an alert.

4.3.3 Alerts shall be sent only to the mobile number and email address recorded on the Account, under the required “Essential alerts” consent and for the protection of a child who may be at risk of serious harm. Alerts are not a substitute for emergency services; where a child is in immediate danger, the local emergency number should be contacted. Because these alerts are essential to the safety of a child, that consent is a required consent and remains in place for as long as the Account exists (see Section 8A).

5. Disclosure to Sub-Processors and Others

5.1 The Company does not sell Personal Data. Personal Data shall be disclosed only to the following categories of service provider, and only to the extent necessary to operate the Platform:

1. Hosting and email: BigRock, for hosting and for the delivery of account and marketing email. The Company may add Amazon Web Services (AWS) or Google Cloud as additional or replacement hosting infrastructure as it scales, and this Policy shall be updated before that occurs.
2. Messaging: Meta Platforms (WhatsApp Business Platform), for delivery of one-time passcodes, account and security alerts and child-safety alerts to the Account Holder's mobile number on WhatsApp. Meta receives the Account Holder's mobile number and the content of the message. Messages are sent only to the Account Holder and never to a child.
3. Authentication: Firebase Authentication (Google), used solely to verify and log in the Account Holder, and receiving the email address, mobile number and credentials of the Account Holder. A child signs in with a username and password created by the Account Holder, which are verified by the Company's own systems, and no data of a child is sent to Firebase; all data relating to a child is stored and processed only in the databases of Khypri AI and/or My Paper Genie.
4. AI processing: OpenAI and Google (Gemini / Vertex AI), for the generation and evaluation of academic content and for the preparation of the short safety summaries described in Section 4.3. Educational inputs, and the text needed for a safety summary, may be sent to these providers for inference, identified only by the child's display name or profile (see Section 2). As the Company never collects the legal name of a child, there is no real name to remove before content is sent for processing. The Company engages these providers under their standard enterprise data protection terms and published API privacy commitments, which explicitly exclude API inputs from model training.
5. Payments: Razorpay, for processing subscription payments.
6. Analytics: Google Analytics, for aggregate usage analytics on the Company's public marketing website only (and not within the learning Platform), which operates only where the user has accepted analytics cookies in the cookie banner and is denied by default.

5.2 The service providers listed in Section 5.1 process data pursuant to their binding enterprise data protection terms and data processing addenda. This list shall be kept current as the Company's vendor relationships change. The full current list, with details of data location, is set out on the Sub-Processors page.

5.3 The Company may also disclose Personal Data where required by law, by order of a court or competent authority, or where necessary to protect a child from serious harm.

6. Retention and Erasure

6.1 Retention. Personal Data shall be retained for so long as the Account remains active and, thereafter, only as provided in this Section 6. The detail is set out in the Data Retention and Erasure Policy.

6.2 Deletion by the Account Holder. An Account Holder may at any time request deletion of the Account, which includes every Student profile under it, (a) within the Platform, by selecting the “Delete my account” option in the profile settings and confirming the request by typing the email address registered on the Account; or (b) by written request to the DPO in accordance with Section 8.

6.3 Immediate effect. Upon a deletion request being made within the Platform, or being verified by the Company: (a) the Account and every Student profile shall be deactivated forthwith and sign-in shall cease; (b) every consent recorded on the Account shall be treated as withdrawn and the withdrawal shall be recorded; (c) any subscription shall be cancelled so that no further charge is made; and (d) the Company shall send a confirmation to the registered email address stating the date on or after which erasure will be carried out.

6.4 Cooling-off period and time limit. Erasure shall be carried out after a cooling-off period of seven (7) days from the request (or such other period, not exceeding twenty-one (21) days, as the DPO may set on a request made in writing), during which the request may be cancelled and the Account restored upon a written request sent to the DPO from the registered email address. A subscription cancelled under Section 6.3(c) is not reinstated by restoration of the Account. Erasure shall in any event be completed within thirty (30) days of a Verified Request, save to the extent that Section 6.6 applies. A request for restoration made after erasure has been carried out cannot be given effect.

6.5 Scope of erasure. On erasure: (a) the Personal Data in the Account and in every Student profile, including learning activity, chat conversations, examination and practice records, uploaded files and the text and vectors derived from them, login history, verification codes, messages sent through the contact form from the registered email address, and copies of emails sent to that address, shall be deleted; (b) the identity details on the Account and each Student profile (name, email address, phone number, date of birth, photograph, password hash and location) shall be irreversibly erased or replaced so that any record retained under Section 6.6 no longer identifies a person; (c) the login credentials held with the Company's authentication provider shall be removed; and (d) safety-incident records and message-delivery records shall be retained in de-identified form only (severity, type, template, status and time), the conversation text, contact details and message content being erased.

6.6 Records retained by law or for legitimate accountability. Notwithstanding the foregoing, the Company shall retain, and shall use solely for the purpose for which they are retained: (a) payment, order, subscription and credit ledger records, for the period required by applicable tax and accounting law; (b) the record of consents given and withdrawn, comprising identifiers and answers only, together with the dated history of changes and the wording shown at each time, as evidence of consent and of its withdrawal; and (c) fraud and security block-lists. Support correspondence is reviewed individually on an erasure request and is erased unless retention is necessary for a purpose permitted by law.

7. International Transfers

7.1 Personal Data may be processed on servers located outside the Data Principal's home country, including by the Company's messaging (Meta/WhatsApp) and AI providers.

7.2 Where data of persons in the European Union or European Economic Area is transferred outside the EEA, such transfer is governed by Standard Contractual Clauses (SCCs) incorporated within standard vendor data processing addenda.

7.3 Where Personal Data of Indian Data Principals is transferred outside India, the Company shall apply safeguards consistent with the requirements of the Act in respect of cross-border transfer. Further detail is set out in the Cross-Border Data Transfer Policy.

8. Exercise of Rights by Data Principals

8.1 To exercise any right described in this Policy (including access, correction, erasure, restriction, portability or objection), a Data Principal shall send a request to dpo@khypri.com from the email address associated with the Account or, in the case of a request made on behalf of a child, from the verified email address of the Account Holder. The following procedure shall apply:

1. Acknowledgement: the Company shall acknowledge receipt within three (3) business days.
2. Identity verification: the Company may require information sufficient to confirm that the requester is the Account Holder, or the parent or guardian of the Account Holder's Student, so as to prevent unauthorised access to a child's data.
3. Fulfilment: requests for access, correction and portability shall be fulfilled within fifteen (15) days, and requests for erasure within thirty (30) days, consistently with Section 6.
4. Format: where a copy of data is requested, it shall be provided in a structured, commonly used and machine-readable format (JSON or CSV).
5. Escalation: where the requester is not satisfied with the response, residents of the EU/EEA may lodge a complaint with their local supervisory authority, and residents of India may approach the Data Protection Board of India once it is operational.

8.2 An Account Holder may also exercise the right of erasure directly within the Platform as provided in Section 6.2, and may view and correct the details of the Account and of each Student profile in the profile settings. An Account Holder may also download a copy of the Account's data, and of the data of every Student profile under it, as a single file in JSON format, by selecting “Export my data” in the profile. Before the download the Account Holder is warned that the file is not encrypted; the download may be made once every five (5) minutes, and each download is recorded (who and when, never the content of the file).

8A. Withdrawal of Consent

8A.1 An Account Holder may withdraw consent as easily as it was given. The manner of withdrawal depends on the nature of the consent:

1. Optional consents — progress updates and weekly summaries by email and by WhatsApp, offers and reminders by email, and analytics cookies — may be withdrawn at any time in the account settings (in the profile, for the Account Holder's own consents, and in the child's settings panel, for progress updates concerning that child). Withdrawal shall take effect immediately, and the consent may be given again later.
2. Required consents — agreement to the Terms of Service and this Policy, confirmation that the Account Holder is an adult, the “Essential alerts” consent, and consent to the analysis of the child's academic data — are necessary to operate the service and to keep the child safe. They remain in place for as long as the Account exists and are displayed as locked in the account settings. Withdrawal of a required consent is effected by deleting the Account, following which all further processing of the child's data shall cease.

8A.2 To withdraw consent altogether and close the Account, the Account Holder may (a) use the “Delete my account” option within the Platform as described in Section 6.2, (b) use the “Withdraw All & Close Account” option on the Notice to Data Principal, or (c) write to the DPO, Debasmita Maharana, at dpo@khypri.com with the subject line “Withdraw Consent” from the verified email address of the Account Holder. Upon confirmation of identity the Company shall cease all further processing of the child's data and shall, unless the Account Holder separately requests retention, proceed to erasure in accordance with Section 6.

8A.3 Withdrawal of consent shall not affect the lawfulness of any processing carried out on the basis of consent before its withdrawal. The Company maintains a dated record of when each consent was given or changed and of the wording displayed at that time, so that it may show a Data Principal what was agreed.

9. Digital Personal Data Protection Act, 2023 & IT Intermediary Framework (India)

9.1 Verifiable parental consent. Only a parent or legal guardian may register on the Platform; a Student cannot create an Account directly. Registration captures the Account Holder's date of birth, a self-declaration of adult status and an on-device age check, followed by verification of the Account Holder's email address and mobile number. A Student profile may be added only once the Account Holder's own profile is complete, and no Student profile can exist without a verified Account Holder behind it. The method is described further in the Verifiable Parental Consent Policy.

9.2 No behavioural profiling. The Company does not track the browsing or behaviour of a Student outside the academic workspace and does not serve targeted advertising.

9.3 Correction and erasure. An Account Holder may view, correct or request erasure of a child's data at any time, in the manner provided in Sections 6 and 8.

9.4 Grievance redressal and nomination. Queries and grievances under the Act may be addressed to the DPO at dpo@khypri.com, as provided in Section 16. A Data Principal may also exercise any right of nomination available under the Act by writing to the DPO.

9.5 Information Technology Act, 2000 & Intermediary Rules, 2021. In accordance with Section 79 of the IT Act 2000 and Rule 3(1)(b) of the IT Intermediary Rules 2021, the Company exercises due diligence over user-uploaded content in the Vault. Pursuant to Section 70B of the IT Act, reportable cybersecurity incidents are reported to CERT-In within six (6) hours of confirmation.

9.6 MeitY AI Safety & Ethics Advisory (2024–2026). In alignment with advisories issued by the Ministry of Electronics and Information Technology (MeitY), the Platform explicitly identifies artificial intelligence interactions (e.g., displaying prominent UI indicators when interacting with AI tutor Olli) and applies provenance metadata watermarks to AI-generated synthetic text and audio content.

10. General Data Protection Regulation (European Union)

10.1 Lawful basis. Processing occurs on the basis of consent of the Account Holder and the Company's legitimate interest in providing the requested educational service.

10.2 Rights. Requests for access, correction, restriction, portability and erasure may be sent to dpo@khypri.com and shall be handled in accordance with Section 8.

10.3 Breach notification. The Company undertakes to notify affected users and the relevant supervisory authorities within seventy-two (72) hours of discovering a personal data breach, in accordance with Section 14.

11. Children's Online Privacy Protection Act (United States) & Extraterritorial Disclaimers

11.1 Scope. The Children's Online Privacy Protection Act applies to children under the age of thirteen (13) in the United States.

11.2 Minimal collection. The Company collects no audio, visual media or precise geolocation from children under thirteen.

11.3 Verifiable parental consent. Because only a parent or guardian may register, and must verify their own identity before adding a child to the Account, no child under thirteen is able to give their own consent or to create an independent account.

11.4 Parental rights. A parent may review, or request deletion of, the data of their child at any time by contacting dpo@khypri.com or by deleting the Account as provided in Section 6.2.

11.5 No conditioning. Participation shall not be conditioned on the disclosure of more data than is reasonably necessary.

11.6 Extraterritorial Alignment for NRI Families. Non-Resident Indian (NRI) families accessing the Platform from international jurisdictions benefit from strict alignment with US COPPA (16 CFR Part 312) and EU GDPR Article 8 child protection baselines.

12. Marketing and Service Communications

12.1 The Company shall send promotional or marketing communications (including offers, plan-renewal offers and product updates) only where the Account Holder has opted in through the optional “Offers and reminders by Email” consent. That consent may be withdrawn at any time in the account settings; every promotional email contains a link to the account settings, and the Account Holder may also write to dpo@khypri.com. Progress updates and weekly summaries concerning a child shall be sent only where the Account Holder has turned them on for that child, by email and/or WhatsApp, and may be turned off in the same manner.

12.2 Certain messages are not marketing and shall be sent irrespective of the Account Holder's marketing choices, because they form part of the operation of the Account and the safety of a child: billing receipts, security notices, plan-expiry and balance notices, and critical child-safety alerts (see Section 4.3). Such messages are sent by WhatsApp and email under the required “Essential alerts” consent. Further detail is set out in the Communications Policy.

13. Security Safeguards & Payment Tokenization

13.0 Personal Data is encrypted in transit using TLS 1.3 and at rest using AES-256. The Company is working toward ISO 27001 certification of its information security management practices; that certification is in progress and has not been obtained.

13.0.1 Payment Tokenization (Payment and Settlement Systems Act, 2007). In compliance with RBI Digital Payment Security Guidelines, full credit/debit card numbers are tokenized directly through Razorpay (PCI-DSS Level 1 compliant); raw payment card numbers are never stored on Company servers.

13.1 Access Control (Role-Based Access and Least Privilege)

13.1.1 Internal access to Personal Data, including a child's academic records, an Account Holder's details and payment information, is governed by role-based access control founded on the principle of least privilege. The default access of every member of staff is none, and access is granted only to the specific data that a role requires in order to perform its function.

1. Roles, not individuals: access is granted to defined roles (for example Support, Engineering, Content/Curriculum and the DPO) and not to individuals directly, so that what a person may see is determined by function.
2. Least privilege: the access of a role is limited to the data categories and actions it requires. Support access is limited to the roles and functions concerned, and support staff can open a Student's academic record only after the Account Holder's Support PIN, described in Section 4.2, has been entered correctly.
3. Segregation of duties: engineering access needed to operate the Platform is separated from the ability to export or bulk-view Personal Data, and routine engineering work does not require viewing the data of individual children.
4. Time-bound and revocable access: role-based access is removed on a change of role or departure, and temporary or elevated access (such as a Support PIN session) expires automatically.
5. Access logging: access to Personal Data by internal roles is logged so that it may be traced to a role and a reason.
6. Periodic review: access is reviewed periodically to remove any access broader than currently required; this review is being formalised into a fixed cadence and is not yet fully mature.

13.1.2 This Section governs the Company's own internal access controls. Sub-Processors listed in Section 5 receive only the pseudonymised and filtered data described there.

13.2 Authentication, Passwords and Credentials

13.2.1 A child signs in to the Platform with a username and password that the Account Holder creates for the child; these credentials are verified by the Company's own systems, are never sent to Firebase, and the password is never stored as entered: it is converted on the Company's servers into a salted, one-way hash using a deliberately slow, industry-standard function (PBKDF2), so that the password cannot be read back by anyone, including the Company, and a copy of the stored values cannot be reversed with pre-computed lists. A password held in an older, weaker format is converted to this format the next time the child signs in, and an older-format password that has not been converted by the date the Company sets for retiring the older format must be set again by the Account Holder in the profile settings. A child cannot register or create an Account. Authentication of the Account Holder is handled by Firebase Authentication (Google), which manages credential storage, password hashing and login security on the Company's behalf, and the Company does not itself store parent passwords. No data of a child is sent to Firebase, including the child's display name and academic activity (and, as stated in Section 2, the Company never collects a child's legal name). Once the Account Holder's identity has been verified through Firebase, all data relating to a child (profiles, responses, progress and generated papers) is created, stored and processed exclusively in the databases of Khypri AI and/or My Paper Genie, separately from the authentication layer.

1. Passwords: passwords are never stored or handled in plain text by the Company; Firebase applies industry-standard hashing and salting on its behalf.
2. Multi-factor authentication: the Company supports and encourages multi-factor authentication on the Account (for example, email or mobile one-time-passcode verification at registration, available as an additional login step). Enforcement of multi-factor authentication as a mandatory requirement on every login is planned and is not yet universally enforced.
3. API keys and service credentials: credentials used to connect the Company's systems to its Sub-Processors (Section 5), including AI providers, payment processing and hosting, are held in encrypted secrets management and not in source code or plain-text configuration, and are limited to the minimum permissions each integration requires, consistently with Section 13.1.
4. Session security: login sessions use secure, time-limited tokens, and sessions may be revoked (for example on a change of password or suspected compromise).

14. Personal Data Breach & Statutory Conflict Harmonization

14.1 In the event of a personal data breach, the Company shall follow the process below, which is described further in the Personal Data Breach Response Policy:

1. Containment: identify and contain the breach as soon as it is discovered;
2. Assessment: assess the scope of the data and the individuals affected;
3. Notification: notify affected users and the relevant authorities (including the Data Protection Board of India, where applicable) within seventy-two (72) hours of discovery, describing the nature of the breach and the data involved; and
4. Remediation: take corrective action to prevent recurrence and, where appropriate, offer affected users guidance on protective steps.

14.2 Statutory Harmonization & Legal Conflict Resolution Protocols. Where statutory provisions across applicable Indian and international acts appear to overlap or conflict, the following binding legal principles and statutory hierarchy shall govern:

1. Criminal Evidence & Child Safety Override: Pursuant to Section 8(7) of the DPDP Act 2023, the mandatory statutory duty to preserve evidence and report child safety apprehension under POCSO Act 2012 (Sec 19/21) and BNSS/BSB 2023 (Sec 63) legally overrides routine DPDP erasure requests for flagged safety records.
2. Dual Intermediary Scope: Vault file uploads are governed by Section 79 of the IT Act 2000 (Intermediary Safe Harbor), whereas interactive AI Tutor conversations are governed by MeitY AI Safety Advisories (2024–2026) and explicit Terms of Service AI Output Disclaimers.
3. Criminal Code Transitional Continuity: Dual citation of BNS 2023 alongside legacy IPC 1860 ensures complete legal continuity under Article 20(1) of the Constitution of India (protection against ex-post-facto laws).
4. Strictest Baseline Supremacy: Extraterritorial access by non-resident Indian (NRI) families enforces India's strictest DPDP Act 2023 baseline (mandatory adult parent account for all under-18 minors), automatically satisfying US COPPA (<13) and EU GDPR (<16) requirements without statutory shortfall.
5. Pre-Debit Billing Protection: RBI E-Mandate 24-hour pre-debit notifications provide instant 1-click auto-debit cancellation before funds are drawn, operating harmoniously with Consumer Protection Rules 2020 grievance SLAs.

15. Amendments

15.1 The Company may amend this Policy from time to time. Where a material change is made, the effective date and version stated above shall be updated and, where required by law, affected users shall be notified directly.

16. Contact and Grievance Redressal

16.1 Any question, correction, erasure or grievance request under the Act, the General Data Protection Regulation or the Children's Online Privacy Protection Act shall be addressed to the Data Protection Officer, Debasmita Maharana, at dpo@khypri.com.

16.2 The Company shall acknowledge every request within three (3) business days and shall resolve Verified Requests for erasure within thirty (30) days, in accordance with Section 8. The manner of raising and resolving a grievance is set out in the Grievance Redressal Policy.