In Plain Language
- We collect the information needed to run the LMS: names, emails, roles, course activity, and — for students who need it — learning-support (IEP) notes recorded by teachers.
- If you're a student under 18, your parent or guardian manages your account and its data.
- We share data with a small number of trusted services that help run the platform — never with advertisers, never sold to anyone.
- Learning-support (IEP) information is treated as extra-sensitive: only your teacher and school admin can see it, never shown as a label to the student or other students.
- We don't use tracking cookies or advertising analytics anywhere on the platform.
- If your account becomes inactive after you've formally left the institute, we keep your data for a bounded period, then delete it — not indefinitely.
- You (or your parent/guardian) can ask to see, correct, or delete your data at any time.
1. Introduction
This Privacy Policy explains how CatchyMinds ("we," "us") collects, uses, shares, and protects personal information through the CatchyMinds Learning Management System (the "Platform"). It should be read together with our Terms and Conditions.
This Policy applies to all Users — Students, Parents/Guardians, Teachers, Admins, and Writers — with jurisdiction-specific rights addressed in Section 9.
2. Information We Collect
2.1 Account and Identity Information
- Name, email address, and password (stored as a salted cryptographic hash — we never store or can see your actual password).
- Role, and for Students, program/division and academic year.
- For Parent/Guardian accounts, the identity of the Student(s) they are linked to.
- If you sign in with Google, your name, email, and profile picture as provided by Google.
2.2 Educational and Support Information
- Course enrollment, assignments, submissions, results, and progress records.
- Learning-support information recorded by Teachers for Students who need it (an "IEP Tracker") — treated as sensitive personal data, never displayed to the Student, other Students, or Parents as a diagnostic label.
- Files you upload — assignment attachments, guess papers, gist papers, writer-authored briefs, profile pictures, and similar content.
2.3 Automatically Collected Information
- Login activity and session information, used to keep you signed in securely.
- Basic technical information used for security — for example, rate-limiting repeated failed login attempts.
We do not use advertising cookies, third-party analytics trackers, or behavioural tracking anywhere on the Platform. The only cookie set is a functional session cookie required to keep you logged in.
3. How We Use Your Information
- To operate the Platform — authenticate accounts, deliver course content, and track progress.
- To send operational communications — assignment due-date reminders, password reset emails, administrative notices.
- To maintain the security and integrity of the Platform.
- To fulfil our educational obligations to Students and their Parents/Guardians.
We do not use personal information for advertising, and we do not sell personal information to any third party.
4. Legal Basis for Processing
- Consent — for example, a parent/guardian's consent to a Student's account.
- Performance of a contract — processing needed to provide the educational services you're enrolled in.
- Legitimate interest — for example, platform security, balanced against your rights.
- Legal obligation — where we are required to retain or disclose information by law.
5. Children's Data and Parental Consent
- A parent or legal guardian creates or approves the Student's account and consents to this Policy on the Student's behalf.
- We collect only the information reasonably necessary to provide the educational service — never used for tracking, profiling, or targeted advertising.
- A parent/guardian may request access to, correction of, or deletion of their linked Student's data at any time (Section 12).
6. Third Parties We Share Data With
- Cloudinary — stores uploaded files and serves them back to the Platform.
- Google — provides Google Sign-In as an optional authentication method.
- Our email provider (Gmail/Google Workspace) — sends verification, password-reset, and notification emails.
- Discord — receives internal operational alerts (e.g. "a new exam result was uploaded"), which may include a Student's name. Internal team channel, not public.
- Payment processing — to be confirmed — processes payments where fees apply; we do not store your full card details ourselves.
We may also disclose information where required by law, or to protect the rights, safety, or property of CatchyMinds, our Users, or others.
7. International Data Transfers
Some service providers above operate infrastructure outside India. Where personal information is transferred internationally, we rely on those providers' own safeguards and take reasonable steps to ensure appropriate protection.
8. Data Retention
We retain personal information for as long as an account is active, and for 2 years after the institute confirms a Student has formally left or graduated — not from temporary inactivity such as a school holiday or academic break, which does not by itself trigger deletion.
After that period, we delete or anonymise personal information, except where required for legal, academic-record-keeping, or accounting obligations.
9. Your Rights
9.1 If You Are in India (Digital Personal Data Protection Act, 2023)
- The right to access a summary of the personal data we hold about you (or your linked child).
- The right to correction and completion of inaccurate or incomplete personal data.
- The right to erasure of personal data no longer necessary for its original purpose.
- The right to grievance redressal, including escalation to our Grievance Officer (Section 12) and, if unresolved, the Data Protection Board of India.
- The right for a parent/guardian to nominate another individual to exercise these rights in the event of their death or incapacity.
9.2 If You Are Outside India
- Access, rectification, erasure, restriction and objection, and portability, broadly consistent with GDPR-style rights, extended as a matter of practice.
To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before actioning a request.
10. How We Protect Your Information
- Passwords are hashed with bcrypt — a salted, industry-standard algorithm — never stored in plain text.
- Login attempts are rate-limited to blunt automated credential-guessing.
- The Platform is served over HTTPS, with secure, first-party session cookies.
- Access to learning-support (IEP) records is restricted to the Teachers and Admins who need it.
11. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated through the Platform or by email before they take effect.
12. Contact Us / Grievance Officer
Email: to be confirmed · Grievance Officer: to be confirmed · Address: to be confirmed
This page still has a few institute-specific details — payment processor, contact email, Grievance Officer name, and address — marked "to be confirmed." Everything else is complete.