Legal
Privacy Policy
Effective date: 28 September 2026 Last updated: 13 October 2026
Changes in this version. Section 11 (how a parent's consent is obtained), Section 12 (analytics is now opt-in) and the data, purposes and retention tables were updated on 6 October 2026. All of these changes apply from 6 October 2026. On 10 October 2026 we added the Meta Pixel (advertising measurement) to Sections 7 and 12 and updated the statements about advertising in Sections 3 and 12; this applies from 10 October 2026. On 12 October 2026 we added Microsoft Clarity (usage analytics and screen recordings) to Sections 7 and 12; this applies from 12 October 2026. We also added the one-time Trial Pass to Sections 2, 3 and 5 (what we record when you buy one, why, and how long we keep that record); this applies from the day the Trial Pass is first offered. On 13 October 2026 we shortened how long the Trial Pass record is kept (Section 5) from up to 8 years to 1 year after the pass ends, which only reduces the time we keep it.
This Privacy Policy explains how VidyaLoop ("VidyaLoop", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you use https://vidyaloop.app, https://vidyaloop.in, our web application, our mobile applications and related services (the "Service").
We are the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"). This Policy is also published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
This Policy should be read together with our Terms of Use. Capitalised terms not defined here have the meanings given in the Terms of Use.
1. Summary
- We collect only what we need to run the Service: your account details, the documents you upload, the study material we generate, your study activity, and billing records.
- Documents you upload are processed only to generate your study material. We do not sell them, show them to other users, or use them to train AI models.
- To generate study material, we send the text of your document to AI model providers who process it on our behalf and do not train their models on it.
- Payments are handled by Razorpay (or Apple, for iOS purchases). We never see or store your full card number, CVV or UPI PIN.
- Some of our service providers store or process data outside India, including in the United States (Section 8).
- You are responsible for any personal data of other people contained in documents you upload (Section 4).
- You can access, correct and erase your data, and raise a grievance, at any time (Section 10).
- Users under 18 need verifiable consent from a parent or guardian, given through a link we email to them. We do not track children's behaviour, we do not run analytics for signed-in users under 18, and we do not show them targeted advertising (Section 11).
2. Personal data we collect
2.1 Data you give us
| Category | Examples | When |
|---|---|---|
| Account data | Name, email address, date of birth, class and board, password (stored only in hashed form by our identity system), sign-in method (for example, Google or Apple, if offered) | When you register or sign in |
| Profile data (optional) | Full name, education level, institution, grade or year, study reminder and email digest preferences | When you complete or edit your profile |
| Parent/guardian data | Parent's name, email address and mobile number | When a user under 18 signs up or updates their profile |
| Parental consent records | The parent email address a consent request was sent to, when it was sent, the parent's answer (confirm or refuse), and when and from which IP address they answered | When a parent uses the link we email them |
| Uploaded documents | PDF, DOCX and TXT files, and the text we extract from them. These may contain personal data if you include it. | When you upload a document |
| Generated Content | Notes, flashcards, recaps, quizzes and decks produced from your documents, and any edits you make | When the Service generates or you edit content |
| Payment and billing data | Plan, amount, billing period, subscription status, renewal date, Razorpay order, payment and subscription IDs, GSTIN (if provided), invoices. Your card, UPI or bank details are collected directly by Razorpay or Apple, not by us. | When you buy or manage a Subscription or a Trial Pass |
| Communications | Name, email and message content that you send through our contact form, email or support channels, and any feedback | When you contact us |
| Grievance and rights requests | The information in your request and our correspondence about it | When you raise a request |
2.2 Data collected automatically
| Category | Examples |
|---|---|
| Study activity | Cards reviewed, ratings (Again/Hard/Good/Easy), review times, spaced-repetition schedules, streaks |
| Usage data | Documents uploaded per billing cycle, generation status, features used, pages visited |
| Technical and log data | IP address, device and browser type, operating system, time zone, date and time of access, error reports, security and access logs |
| Cookies and similar technologies | Session and authentication cookies, and preference cookies (Section 12) |
2.3 Data from third parties
- Sign-in providers: if you sign in with Google or Apple (where offered), we receive your name, email address and a unique identifier from that provider, as permitted by your settings with them.
- Payment partners: Razorpay and Apple tell us whether a payment succeeded, failed or was refunded, along with transaction identifiers and subscription status.
2.4 Data we do not intend to collect
We do not ask for, and you should not upload, government identity numbers (such as Aadhaar or PAN), bank or card details, passwords, biometric data, health records, or other sensitive personal data. Please remove such data from documents before uploading.
3. How and why we use personal data
We process personal data only for lawful purposes, on the basis of your consent (Section 6 of the DPDP Act) or for legitimate uses allowed under Section 7 of the DPDP Act, such as complying with law or processing data you have voluntarily provided for a specific purpose.
| Purpose | Data used | Basis |
|---|---|---|
| Create and manage your Account, and authenticate you | Account data, technical data | Consent; voluntarily provided data |
| Extract text from your documents and generate notes, flashcards, recaps and quizzes | Uploaded documents, Generated Content | Consent |
| Run the spaced-repetition engine and show your progress | Study activity, Generated Content | Consent |
| Process payments, manage Subscriptions, apply plan limits and the Fair Usage Policy, and issue invoices | Billing data, usage data | Consent; legal obligation (tax and accounting law) |
| Sell and deliver the one-time ₹9 Trial Pass (one document of up to 5 pages, 7 days) and allow one pass per person | Account ID, email address, Razorpay order and payment IDs, purchase and expiry dates, whether the pass was used | Consent; legal obligation (payment records); our legitimate need to prevent repeat or abusive purchases |
| Send service messages (payment confirmations and failures, renewal and overdue notices, a reminder two days before a Trial Pass ends, password resets, security alerts, changes to terms), including to a parent or guardian (once they have confirmed their email address) where the user is under 18 | Account data, parent/guardian data, billing data | Consent; voluntarily provided data |
| Work out whether a user is under 18, ask the parent or guardian to confirm their consent, record their answer, and tell them about a purchase | Date of birth, parent/guardian data, parental consent records | Consent; legal obligation |
| Send study reminders, email digests and a birthday greeting (to the user only, never to a parent) | Account and profile data, date of birth, class and board, exam date and daily goal (if you add them), study activity (including your study streak) | Consent (you can turn these off at any time by switching off the email digest) |
| Email the parent or guardian of a user under 18, once they have confirmed their consent, a weekly summary of study activity (days studied, cards reviewed, quizzes, subjects, streak, exam date) (this is part of how we keep parents informed for under-18 users, so it is not optional; a parent can write to us to correct their details or withdraw consent) | Study activity, parent/guardian email and name | Consent; legitimate interest in keeping parents informed |
| Respond to support requests, feedback and grievances | Communications | Consent; legal obligation |
| Keep the Service secure, prevent fraud and abuse, and enforce our Terms, including our anti-terrorism rules | Technical and log data, usage data, uploaded documents where necessary | Legitimate uses; legal obligation |
| Show a public preview (quick recap and a few flashcards) of a deck when you create a share link | Generated Content of that deck, share link records | Consent (you create and can stop the link) |
| Monitor quality, fix bugs, and measure and improve performance (for example, generation time and error rates) | Usage and technical data, in aggregated or de-identified form where possible | Consent |
| Comply with law, court orders and lawful requests from government agencies | Any relevant data | Legal obligation (Section 7 of the DPDP Act) |
We do not:
- sell or rent your personal data;
- use your uploaded documents or Generated Content to train our own or third-party AI models;
- show your documents or Generated Content to other users, except a short preview (the quick recap and the first few flashcards of one deck) that you choose to share with a link. The preview shows no name or other personal details of yours, works for 30 days, and you can stop it at any time;
- share your documents or Generated Content with advertising platforms, or use your data for targeted advertising to users under 18. If you accept advertising measurement cookies (Section 12), the Meta Pixel sends Meta limited information about your visit, as described in Sections 7 and 12; or
- make decisions that produce legal or similarly significant effects about you based solely on automated processing.
4. Documents you upload
4.1 Your responsibility for content. You decide what documents to upload. As explained in Section 7 of the Terms of Use, you are solely responsible for the documents you upload, including making sure you have the right to upload them.
4.2 Other people's personal data. If a document contains personal data about someone else (for example, names or marks of classmates), you are responsible for making sure you are lawfully allowed to share it with us, including obtaining any consent required under the DPDP Act. Where possible, remove or redact other people's personal data before uploading. For such data, we act only to provide the Service to you.
4.3 How documents are processed. When you upload a document: (a) the file is sent to our servers over an encrypted connection (TLS); (b) it is stored in encrypted cloud storage; (c) we extract its text and remove repetitive material such as headers, footers and page numbers; (d) the text is sent to an AI model provider (Section 7) to generate your study material; and (e) the Generated Content is saved to your Account.
4.4 Automated safety checks. We may use automated tools, and in limited cases authorised human review, to detect malware and content that breaches our Terms or the law. This includes material relating to terrorism, child sexual abuse, or threats to the security of India. Access is limited to authorised personnel who need it for this purpose.
5. How long we keep personal data
We keep personal data only for as long as needed for the purposes in this Policy, or as long as the law requires.
| Data | Retention period |
|---|---|
| Original uploaded files | Kept for up to 30 days after processing, so that you can regenerate content, and then deleted, unless you delete them earlier. |
| Extracted text and Generated Content | Kept while your Account is open, so that you can continue to study your decks, including after your Subscription ends. Deleted within 30 days after you delete the content or your Account. |
| Accounts with an unpaid renewal | If a plan is not renewed within 7 days after its renewal date, the Account is suspended. If it is still not renewed 30 days after suspension, the uploaded files, extracted text, Generated Content, study activity and profile are permanently deleted (Terms of Use, Section 13.9; deletion applies from 20 October 2026). Billing and payment records are kept as set out below. |
| Parental consent records | Kept while the child's Account is open and deleted with it. If a parent refuses consent, we keep that parent's email address (without the child's details) so that we do not contact it again. |
| Account and profile data | Kept while your Account is open. Deleted within 30 days after Account deletion, except as set out below. |
| Study activity | Kept while your Account is open. Deleted or irreversibly de-identified within 30 days after Account deletion. |
| Billing, payment and invoice records | Kept for up to 8 years, as required by tax and accounting laws, including the Companies Act, 2013 and GST law. |
| Trial Pass record (account ID, email address, order and payment IDs, purchase and expiry dates) | Kept for 1 year after the pass ends, even if you delete your Account, and then deleted. We keep it only to make sure one person cannot buy repeated passes. It holds no documents or study content. The payment itself is also part of the billing and payment records above, which are kept for up to 8 years. |
| Security, access and processing logs | Kept for at least 1 year, as required by the DPDP Rules, and for at least 180 days as required by CERT-In directions under Section 70B of the Information Technology Act, 2000. |
| Inactive Accounts | If you do not sign in for 3 years, we may delete your Account and data. We will email you at least 48 hours before deletion, so that you can sign in to keep it. |
| Data subject to legal hold | Kept for as long as required by a court order, an investigation by an authority, or to establish, exercise or defend legal claims. This includes data connected with suspected terrorism or other serious offences. |
Backups are overwritten on a rolling cycle. Deleted data may remain in backups and in the version history of our file storage for up to 45 days before it is permanently removed.
6. Security
We implement reasonable security practices and procedures, as required by Section 8(5) of the DPDP Act and the Information Technology Act, 2000. These include:
- encryption in transit (TLS) and encryption at rest for stored documents;
- access controls, so that each user can access only their own content, and staff can access data only where needed;
- passwords stored only in salted and hashed form, and signed, short-lived session tokens;
- storage credentials limited to the minimum permissions needed;
- signature verification for all payment confirmations;
- logging and monitoring to detect and investigate unauthorised access; and
- regular review of our security measures.
No system is completely secure. Please use a strong, unique password and keep it confidential.
Personal data breaches. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users, as required by the DPDP Act and DPDP Rules. We will also report cyber security incidents to CERT-In within the time required by law. Our notice to you will describe the breach, its likely consequences, the steps we are taking, and what you can do to protect yourself.
7. Who we share personal data with
We share personal data only as described below. We require our service providers (Data Processors) to process personal data only on our instructions, keep it confidential, and protect it with appropriate security measures.
These service providers include providers of cloud hosting and storage, AI model processing, payment processing (such as Razorpay and, for iOS purchases, Apple), sign-in services, and email delivery.
Usage analytics and screen recordings (Microsoft Clarity). If you accept analytics cookies, we load Microsoft Clarity, a tool from Microsoft Corporation. It records how you use our pages (clicks, scrolling, mouse movement and an anonymised replay of the screen) so we can find confusing screens and fix bugs. It also receives your IP address, browser and device details and cookie identifiers (_clck, _clsk). Microsoft processes this data for us as our Data Processor under its own terms, and may also use it as described in the Microsoft Privacy Statement. We configure Clarity to mask text and inputs, so what you type and your uploaded documents and Generated Content should not appear in recordings. It does not load unless you accept the banner and never loads for a signed-in user under 18.
Advertising measurement (Meta). If you accept analytics and advertising cookies, we load the Meta Pixel, a tool from Meta Platforms, Inc. (and its affiliates). It sends Meta the pages you visit on our site, your IP address, browser details and a cookie identifier (_fbp). We use this to measure how well our ads on Facebook and Instagram work and to show our ads to people who may be interested. Meta acts as an independent data fiduciary for its own use of that data, under its own privacy policy. We do not send Meta your name, email, documents or Generated Content through the pixel. The pixel never loads for a signed-in user under 18, and it does not load unless you accept the banner.
AI providers. We send the text needed to generate your study material to our AI providers through their commercial business APIs. Under their terms, they may not use this content to train their models. They may keep it for a limited period for abuse monitoring and legal compliance, as their policies allow.
Other sharing. We may also share personal data:
- with law enforcement and government agencies, where required by law, a court order or a lawful direction. This includes requests under Section 69 of the Information Technology Act, 2000, Rule 3(1)(j) of the IT Rules, the Bharatiya Nagarik Suraksha Sanhita, 2023, and the Unlawful Activities (Prevention) Act, 1967, and cases where we reasonably believe disclosure is needed to prevent terrorism, a threat to national security, or harm to any person;
- with professional advisers (lawyers, auditors, accountants) under confidentiality obligations;
- in a business transfer, such as a merger, acquisition or sale of assets, in which case the recipient must protect your data in line with this Policy; and
- with your consent or at your direction.
We do not sell personal data.
8. International transfers
Some of our service providers described in Section 7 store or process personal data outside India, including in the United States. Section 16 of the DPDP Act allows such transfers, except to countries the Central Government has restricted. We will not transfer personal data to any country or territory where the Central Government has restricted such transfers, and we will follow any conditions the DPDP Rules place on transfers. When we transfer data, we take steps to ensure it remains protected, including through contracts with our providers.
9. Your choices
- Profile information is optional. You can edit or remove it at any time.
- Study reminders and email digests can be turned off in your profile settings.
- Cookies: you can control non-essential cookies as described in Section 12.
- Withdrawing consent: you can withdraw consent at any time (Section 10). Withdrawal does not affect processing that took place before it. If you withdraw consent needed to provide the Service, we may not be able to continue providing it, and your Account may need to be closed.
10. Your rights
Under the DPDP Act, you have the right to:
- Access information (Section 11): a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with, with a description of the data shared.
- Correction, completion and updating (Section 12): correct inaccurate or misleading data, complete incomplete data, and update your data.
- Erasure (Section 12): have your personal data erased when it is no longer needed for the purpose for which it was collected, unless we must keep it by law. You can delete individual decks in the app, or delete your entire Account from your profile settings.
- Withdraw consent (Section 6(4)): as easily as you gave it.
- Grievance redressal (Section 13): raise a grievance with us, and, if you are not satisfied, complain to the Data Protection Board of India.
- Nominate (Section 14): nominate another person to exercise your rights if you die or become incapable.
How to make a request. Use the settings in your Account where available, or email our Grievance Officer at hello@vidyaloop.app from your registered email address. We may need to verify your identity before acting. We will respond within the time required by law, and in any case within 90 days. For access and erasure requests, we aim to respond within 30 days.
Your duties. Under Section 15 of the DPDP Act, you must not impersonate another person, suppress material information, or file false or frivolous grievances, and you must provide only verifiably authentic information when exercising your rights.
11. Children's privacy
11.1 The Service is designed for students from Class 3 to university, many of whom are under 18.
11.2 Parental consent. When you register we ask for your date of birth. If you are under 18, we also ask for your parent's or guardian's name, mobile number and email address, and we do not accept a parent email that is the same as the child's. We do not assume the parent has consented. We email the parent a one-time link, valid for 7 days, that shows who is asking and what the Service is, and the parent confirms or refuses on that page. We record the parent's answer, when they gave it and the IP address it came from. Until the parent confirms, the child cannot take out a Subscription, and after 14 days the child cannot upload new files or generate new study material (they can still study what is already in their Account). We send nothing to a parent's address other than the consent request until the parent has confirmed. If a parent refuses, the child cannot subscribe, upload or generate, and we do not contact that address again. A child cannot change their date of birth themselves once it is recorded, so that it cannot be used to avoid this step. The parent can withdraw consent, or ask us to delete the child's data, at any time by writing to hello@vidyaloop.app. We may ask for further steps to confirm that the person giving consent is an identifiable adult, in a manner permitted under the DPDP Rules.
11.3 Protections for children. We do not:
- process children's personal data in a way likely to have a harmful effect on their well-being;
- track or monitor the behaviour of children, except as needed to deliver the Service's core study features that the child and parent have signed up for (such as scheduling flashcard reviews). In particular, analytics cookies never run for a signed-in user under 18; or
- direct targeted advertising at children.
11.4 Parents' rights. A parent or guardian may exercise the rights in Section 10 on behalf of their child, and may withdraw consent at any time by contacting us.
11.5 If we learn otherwise. If we learn that we have collected personal data from a user under 18 without verifiable parental consent, we will delete it promptly, except where the law requires us to keep it.
12. Cookies and similar technologies
We use cookies and similar technologies for the following purposes:
| Type | Purpose | Can you turn it off? |
|---|---|---|
| Strictly necessary | Keep you signed in (encrypted session cookies), secure your session, protect against fraud, and make checkout work | No. The Service will not work without them. |
| Preferences | Remember your settings, such as display preferences | Yes, through your browser |
| Analytics and advertising measurement (Google Analytics; Microsoft Clarity; Meta Pixel) | Understand how the Service is used, including through anonymised screen recordings, so we can improve it, and measure the results of our ads on Meta's platforms (Facebook and Instagram) | Yes. They are off unless you accept them in the banner, and you can change your choice at any time with "Cookie settings" in the page footer. They never run for a signed-in user under 18. If you are under 18 and not signed in, please decline. |
Apart from the Meta Pixel described above, which loads only if you accept the banner, we do not use advertising or cross-site tracking cookies. If you decline or later withdraw consent through "Cookie settings", the Meta Pixel stops loading and we clear the _fbp cookie; you can also manage ad preferences in your Facebook and Instagram settings. Our payment partner, Razorpay, may set its own cookies within its checkout window, under its own privacy policy. You can manage cookies through your browser settings. Blocking strictly necessary cookies will stop parts of the Service from working.
13. Third-party links
The Service may contain links to third-party websites or services, including payment and sign-in pages. We are not responsible for their privacy practices. Please read their privacy policies.
14. Changes to this Policy
We may update this Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes, including any new purpose for processing, we will notify you by email or in the Service and, where required, ask for your consent again.
15. Grievance Officer and contact
If you have any questions, requests or complaints about this Policy or your personal data, please contact:
Email: hello@vidyaloop.app
We will acknowledge your grievance within 24 hours and resolve it within the time required by law.
If you are not satisfied with our response, you can complain to the Data Protection Board of India in the manner prescribed under the DPDP Act.
General contact: hello@vidyaloop.app | https://vidyaloop.app/contact
© 2026 VidyaLoop. All rights reserved.