Privacy Policy

NivShiksha is operated by NivShiksha Nurture Private Limited (the “Data Fiduciary”, “Company”, “we”, “us” or “our”), which determines the purpose and means of processing personal data collected through the Service. This Privacy Policy explains, in plain terms, what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you and, where applicable, your child have under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), when you or your child use the NivShiksha mobile application and website (together, the “Platform” or the “Service”).

Because NivShiksha is built for school-going children, this Policy pays particular attention to how we manage Children’s Personal Data and how parents and guardians can stay informed of, and involved in, that processing. Please read this Policy carefully together with our Terms of Use.

1. Who We Are

NivShiksha is operated by NivShiksha Nurture Private Limited, the Data Fiduciary that determines the purpose and means of processing personal data under the DPDP Act and the DPDP Rules.

Registered office: Electronics City, Bangalore South, Bangalore – 560100, Karnataka.

CIN: U85500KA2026PTC221293.

2. A Few Terms Used in This Policy

To keep this Policy readable, we use a few defined terms consistently:

• “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
• “Data Principal” means the individual to whom the Personal Data relates for a Child’s Account, this includes the Child and, in respect of the exercise of rights, the parent/guardian who has provided verifiable consent.
• “Data Processor” means any person who processes Personal Data on our behalf.
• “Child” means an individual who has not completed the age of 18 years, as defined under the DPDP Act.
• “Consent” has the meaning given to it under Section 6 of the DPDP Act.
• “Platform” or “Service” means the NivShiksha mobile application and website.

3. Personal Data We Collect

We practice data minimization and collect only what is reasonably necessary to provide, personalize, secure and improve the Service. Depending on how you or your child uses the Platform, this may include:

• Full name - to personalize the learning experience;
• Email address - for account creation and authentication;
• Date of birth - to confirm age and apply appropriate child protection;
• Parent/guardian email address and mobile - to obtain verifiable parental consent, deliver progress reports, and communicate with parents/guardians;
• School name and class/grade - to tailor content to the student’s curriculum level and, where applicable, to enable school-linked programmes;
• Learning progress data - scores, streaks, badges, practice history, assessment results, and daily or weekly usage/screen-time data;
• Device and technical information - device type, operating system, unique device identifiers, and app version, used to keep the Service reliable and secure;
• Login history and authentication logs - including sign-in timestamps, used for account security;
• IP address - used for security, fraud prevention and to approximate network-level location; we do not collect precise GPS location;
• Activity and usage logs - necessary for the functioning, security and improvement of the Service;
• Notification preferences - to honor the choices users and parents make about the communications they receive;
• Parent/guardian’s delivery (postal) address - collected only where the Platform offers a physical prize, medal, certificate or item of merchandise, and used solely to fulfil that reward (see Clause 9 below); and
• Limited crash and diagnostic data - to identify and fix technical issues.

Where the Service involves payment (for example, a subscription), billing details are collected and processed on our behalf by our RBI-authorized payment partner, Razorpay; we do not store full card or bank account numbers on our own systems.

We do not collect contacts, photos, camera or microphone data, or advertising identifiers, and we do not run any product-analytics or behavioral-tracking SDK on the Platform. However, during examinations or proctored assessments, the Platform may require temporary access to the device camera and microphone for the purpose of monitoring the examination and maintaining assessment integrity.

4. How We Use Your Personal Data

We process Personal Data, on the basis of consent (given by you or, for a Child, by a parent/guardian) or where otherwise permitted under the DPDP Act, for the following purposes:

• to create, operate and authenticate your Account;
• to track learning progress, and to recognize and award achievements, streaks and badges;
• to provide parent, guardian and (where applicable) teacher dashboards and progress reports;
• to fulfil rewards, prizes, certificates and merchandise earned through the Platform;
• to send important accounts, service and security-related notifications, including study reminders, assessment reminders, progress reports, subscription/renewal reminders and security alerts;
• to operate a parent referral programme, where the Company offers one, and only with the specific consent described in Clause 10;
• to respond to customer support queries and to receive, investigate and resolve grievances;
• to detect, prevent and investigate fraud, abuse and unauthorized access, and to monitor and maintain the security and integrity of the Platform; and
• to comply with applicable law, regulatory requirements, and lawful requests from government or judicial authorities.

Service-related notifications (such as study reminders, assessment reminders, progress reports and security alerts) are sent as an integral part of providing the Service and are not treated as promotional communications. Where we or the Company propose to send promotional or marketing communications, these will be clearly distinguished from service communications, sent only with appropriate consent, and accompanied by a straightforward opt-out mechanism (see Clause 10).

We do not use Personal Data for targeted advertising, sale to third parties, or behavioral profiling.

5. Consent and Your Right to Withdraw

Where we rely on consent, you (or your parent/guardian, if you are a Child) may withdraw that consent for any non-essential purpose at any time, withdrawing consent is designed to be as easy as giving it. You can withdraw consent through Settings → Privacy & Data in the app, or by writing to our Grievance Officer (Clause 18). Please note that withdrawing consent will not affect the lawfulness of processing carried out before withdrawal and may mean that certain features of the Service (for example, personalized dashboards or reward fulfilment) can no longer be provided.

6. Children’s Personal Data and Verifiable Parental Consent

NivShiksha is built for school students, and we recognize the heightened responsibility that comes with processing Children’s Personal Data. Under the DPDP Act, a Child is anyone under 18 years of age. For every Child’s Account, and in line with Section 9 of the DPDP Act, we:

• obtain verifiable consent from a parent or lawful guardian, through a consent link sent to a parent-controlled email address (and, where provided, mobile number), before creating the Child’s Account or processing the Child’s Personal Data;
• collect only the minimum Personal Data necessary to provide the Service to the Child;
• do not carry out behavioral tracking, profiling, or targeted advertising directed at Children, and do not undertake any processing that is likely to cause detrimental effect on the well-being of a Child;
• allow parents/guardians to review, correct, or request deletion of their Child’s Personal Data at any time, through the mechanisms described in Clause 16; and
• where we intend to introduce a new purpose, category of Personal Data, or category of recipient in relation to a Child’s Personal Data that was not covered by the original parental consent, we will seek fresh verifiable parental consent before undertaking such processing, in addition to any notification required under Clause 20 (Changes to this Policy).

7. Parent Dashboard and Parental Communications

Parents and guardians play a vital role in a child’s education, and the Platform is designed to keep them informed.

7.1 Parent Dashboard. A verified parent/guardian may access a dashboard that displays their child’s educational progress, assessment results, achievements and badges, learning history, and daily or weekly screen time. This access is provided solely for the purposes of educational monitoring and parental supervision and is limited to the parent/guardian verified as associated with that Child’s Account.

7.2 Proactive Parent Communications. In addition to dashboard access, we may proactively share with parents/guardians’ information relating to the Child’s learning progress, assessment performance, achievements, certificates and rewards earned, attendance (where the Platform tracks this), and screen time, solely to facilitate parental involvement in the Child’s education.

8. Cookies and Similar Technologies

Where the Platform uses cookies, local storage, device identifiers, or similar technologies, these are used only for essential and functional purposes such as keeping you signed in, remembering preferences, and maintaining the security of your session and not for third-party advertising or cross-site tracking.

9. Reward Fulfilment

Where the Platform offers physical rewards, medals, certificates, or merchandise to eligible students, we collect the parent/guardian’s delivery address solely for the purpose of dispatching that reward. This information is:

• used exclusively for reward fulfilment and not for any unrelated purpose;
• shared only with the courier or logistics partner engaged to deliver the reward, and only to the extent necessary (name and address); and
• retained only for as long as necessary to complete delivery and to meet any applicable statutory record-keeping requirement (for example, under tax or accounting law), after which it is deleted or anonymized.

10. Parent Referral Programme

If the Company operates a parent referral programme, the following applies. Referrals are initiated voluntarily by the referring parent, who provides the contact details of the person(s) they wish to refer. We do not access, import, or process a user’s phone or email contact list without the user’s specific, prior consent to do so. Personal Data of a referred individual (such as name and contact details) is used only to extend the referral invitation and, where the referral results in a successful sign-up, to administer the associated incentive in accordance with the terms of the referral programme then in force.

11. Notifications and Your Preferences

We distinguish between two categories of communication:

• Service communications, which include account notifications, study reminders, assessment reminders, learning progress reports, achievement notifications, subscription/renewal reminders, and security alerts. These are sent as part of operating the Service and cannot be switched off, because they are necessary for the Account, the Child’s learning experience, or the security of the Platform to function properly.
• Promotional or marketing communications, which are sent only where separately contemplated and only with appropriate consent. Every such communication will include, or be accompanied by, a clear and simple way to opt out.

Users and parents/guardians can manage their notification preferences under Settings → Notifications in the app, subject to the position above, that is, essential service, security, and compliance-related notifications may continue to be sent notwithstanding a general opt-out, because they are necessary to provide or protect the Service.

12. How We Share Your Personal Data

We do not sell your Personal Data, or your Child’s Personal Data, to anyone. We share Personal Data only in the following circumstances:

12.1 Data Processors. We engage vetted Data Processors, acting strictly on our written instructions, to help us operate the Service:

12.2 Other categories of recipients. Depending on the context, Personal Data may also be shared with:

• Schools, where a Child is enrolled through an institutional or school-linked programme, and limited to the categories of learning-progress data agreed with the relevant school for that purpose;
• Parents/guardians, as described in Clause 7;
• Courier and logistics partners, solely for the delivery of rewards as described in Clause 9;
• Professional advisers, including lawyers, auditors and consultants, who are bound by confidentiality and who require access to advise us; and
• Government, regulatory, judicial or law-enforcement authorities, where required or permitted under applicable law, in response to a valid legal process, or where necessary to protect the rights, property or safety of the Company, our users, or others.

13. Cross-Border Transfer of Personal Data

Some of our Data Processors (for example, in relation to database hosting, crash diagnostics, and email delivery) may process Personal Data on servers located outside India. Such transfers may involve the categories of Personal Data described in Clause 3 that are relevant to the processing activity concerned (for example, account, authentication, usage and crash-diagnostic data), are made for the purposes described in Clause 12.1 (namely, hosting, storage, authentication, crash diagnostics and email delivery), and are made to categories of overseas recipients limited to our cloud infrastructure and service providers, acting under contractual confidentiality and security obligations.

Such cross-border transfers are permitted under Section 16 of the DPDP Act, except to any country or territory restricted by the Central Government by notification. Payment data continues to be localized in India in accordance with applicable RBI requirements.

14. Fraud Prevention and Platform Security

We may process Personal Data, including device information, login history and IP address, for the purposes of preventing and detecting fraud and abuse, monitoring the security of the Platform, investigating suspicious activity, protecting the integrity of the Service, and complying with our applicable legal obligations.

15. Storage, Security and Retention

Your data, and your Child’s data, is stored on secured cloud infrastructure with row-level security and is transmitted over encrypted HTTPS/TLS connections. Passwords are hashed via Supabase Auth. Learning data may be cached on your device for offline use.

We retain Personal Data and Progress Data only for as long as the Account is active, or as otherwise required to provide the Service. On account deletion, we permanently erase Personal Data (including a Child’s Personal Data) and Progress Data within 30 days, except that certain Personal Data may be retained for a longer period where necessary to comply with statutory or regulatory record-keeping requirements, for audit purposes, for fraud prevention, to resolve a dispute, to investigate a security incident, or to establish, exercise or defend a legal claim. Personal data deleted from our active systems will be securely deleted or rendered irretrievable from archived or backup systems within 90 days of such deletion unless a longer retention period is required under applicable law. During this period, such data will not be used for any purpose other than backup, disaster recovery, business continuity, or legal compliance.

16. Your Rights as a Data Principal

Under the DPDP Act, you (or, for a Child, the parent/guardian who provided consent) have the right to:

• Access a summary of the Personal Data we process about you or your Child;
• Correct, complete, update, or erase that Personal Data;
• Withdraw consent for any non-essential processing, at any time;
• Raise a grievance with our Grievance Officer (Clause 18); and
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

You can exercise most of these rights directly in the app, under Settings → Privacy & Data, or by contacting our Grievance Officer. Before acting on a request, we may need to verify the identity of the person making it and, where the request relates to a Child, the requester’s relationship as the Child’s parent or guardian using reasonable means such as confirming the registered email address or mobile number on the Account or requesting further reasonable proof of identity or authority. We may decline to act on a request where we are unable to reasonably verify the requester’s identity or authority.

17. Grievance Redressal Mechanism

For any privacy concern, or to exercise your rights, please contact our Grievance Officer:

• Grievance Officer: Onkar Nath Kesherwani
• NivShiksha Nurture Private Limited
• Email: grievance@NivShiksha.com
• Website: https://NivShiksha.com

We will acknowledge your grievance within 7 days of receipt and aim to resolve it within 90 days from the date of receipt, in accordance with the applicable provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. If your grievance remains unresolved within this period, or if you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.

18. Data Protection Board of India

If you remain dissatisfied after exhausting our grievance redressal mechanism, you may approach the Data Protection Board of India, established under the DPDP Act, for further recourse.

19. Changes to This Policy

We may update this Privacy Policy from time to time, to reflect changes in our practices, the Service, or applicable law. We will notify users of material changes through an in-app notification or email, and the “Last updated” date and version number at the top of this Policy will indicate the most recent revision. Where any such change materially affects the processing of a Child’s Personal Data, we will additionally seek fresh verifiable parental consent as described in Clause 6.

20. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to the DPDP Act and the jurisdiction of the Data Protection Board of India in respect of matters within its remit, the courts at Bangalore, Karnataka shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

21. Contact Us

If you have any questions about this Policy or how we manage Personal Data, please write to us at grievance@NivShiksha.com or through the contact details in Clause 17.