Privacy Policy

1. Introduction & Statutory Framework

Learning Buddha (“we”, “our”, or “us”) is committed to maintaining the highest degree of confidentiality, security, and statutory data protection for personal information and sensitive personal data processed across our learning and tele-counselling infrastructure.

This Privacy Policy establishes our data handling policies in strict adherence with:

• The Information Technology Act, 2000 (including Section 43A and Section 72A);
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”);
• The Digital Personal Data Protection Act, 2023 (“DPDP Act”); and
• The Consumer Protection (E-Commerce) Rules, 2020.

Under the DPDP Act 2023, Learning Buddha acts as a Data Fiduciary regarding all digital personal data collected directly from users (“Data Principals”). We process personal information solely on lawful grounds, ensuring purpose limitation, data minimization, and technical integrity.

2. Categories of Information We Collect (Role-Specific Matrix)

We collect only the minimum necessary information required to deliver academic tutoring, professional tele-counselling, KYC compliance, and platform administrative operations:

3. Cryptographic Safeguards & PII Masking Standards

To guarantee that sensitive personal data remains insulated from unauthorized exposure, Learning Buddha enforces technical and cryptographic safeguards across all software layers:

• AES-256 Database Encryption: In our production databases, all telephone numbers and sensitive KYC data are encrypted at rest utilizing industry-grade AES-256 cryptography (using dedicated system environment keys). Plaintext contact numbers are never transmitted in public client-side payloads.
• Universal UI Display Masking: Across all public interfaces, tutor scheduling screens, counsellor case profiles, and sales management views, customer contact numbers are permanently masked:
  Display Format: +91 •••••• 4521
• Mandatory PII Masking Consent Gate: Before any user uploads a case history document, school test paper, or reference medical brief, the system triggers an unskippable PII Masking Consent Prompt. The user must confirm that personal telephone numbers, private residential addresses, and third-party markers have been expunged prior to file transmission.
• Anonymized Tax Invoicing: Official invoices and payment receipts cite unique platform identifiers (Student ID or Counselee ID) rather than private full names or sensitive contact details.

4. Video Recording Governance & 48-Hour Purge Architecture

Live interactive academic classes and tele-counselling consultations are conducted over encrypted WebRTC infrastructure and recorded strictly for child safeguarding, quality auditing, dispute resolution, and student learning review:

• In-Portal Streaming Security: In-portal playback of recorded sessions is conducted through short-lived, cryptographically signed storage tokens via an embedded video player that actively restricts direct local downloading.
• 48-Hour Download Purge Architecture: When a completed session download link is furnished to an enrolled student or counselee via email, that link remains valid for exactly 48 hours. Upon the expiration of the 48-hour window, the distribution link is permanently invalidated, and temporary copies are purged from external delivery servers to prevent unauthorized redistribution.
• Auditor Telemetry Standards: Designated auditors evaluating recorded sessions must keep their webcam active throughout the audit. The system verifies active auditor presence during the entire session review.

5. Legitimate Purposes of Information Processing

We process personal information strictly for legitimate, declared operational purposes:

• Scheduling, authenticating, and delivering live classes, demo sessions, and tele-counselling consultations;
• Generating statutory tax invoices in full compliance with Indian GST regulations (GSTIN: 19ARZPV8189R1ZQ, SAC Codes: 999293/999299);
• Calculating educator and counsellor monthly payouts, executing statutory TDS tax deductions, and issuing annual TDS certificates;
• Auditing instructional excellence, verifying safety compliance, and maintaining platform integrity;
• Transmitting critical transactional updates, session joining links, IVR reminders, and reschedule alerts; and
• Preventing unauthorized platform circumvention, identity spoofing, and financial fraud.

6. Data Sharing & Third-Party Service Providers

Data is shared exclusively with verified operational partners bound by strict data protection agreements:

• Payment Gateway Partner: Razorpay Software Private Limited processes online payments under PCI-DSS Level 1 compliance. Learning Buddha never captures, stores, or processes debit/credit card CVVs, full card numbers, or online banking passwords.
• Secure Cloud Infrastructure: Amazon Web Services (AWS) and Cloudflare R2 provide encrypted object storage with access control policies for syllabus assets, KYC documents, and session video links.
• Real-Time Video & Telephony: 8x8 JaaS (Jitsi) and secure IVR telephony gateways provide encrypted audio-video conferencing and class reminder calls.
• Statutory Authorities: Personal information may be disclosed to government bodies or courts solely when required by lawful summons, formal statutory notices, or judicial orders under Indian law.

7. Data Principal Rights (DPDP Act, 2023)

In compliance with the Digital Personal Data Protection Act, 2023, users (“Data Principals”) hold the following statutory rights:

• Right of Access: The right to request an itemized summary of personal data processed by Learning Buddha and the identities of data processors with whom data has been shared.
• Right to Rectification: The right to request the correction of inaccurate, incomplete, or outdated personal information.
• Right to Erasure: The right to request deletion of personal accounts and non-statutory data, subject to mandatory Indian tax retention mandates (e.g., maintaining financial transaction and GST records for 6 years).
• Right of Nomination: The right to designate an individual who, in the event of death or incapacity of the Data Principal, shall exercise data protection rights.
• Right of Grievance Redressal: The right to lodge formal grievances regarding data processing with our designated Grievance Redressal Officer.

8. Statutory Grievance Redressal Officer

In compliance with Rule 5(9) of the SPDI Rules, 2011, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the contact coordinates of the designated Statutory Grievance Redressal Officer are as follows: