Privacy Policy

1. Who we are

Sorora Learning is operated by Geminal Tech Private Limited, C-240, Sector 37, Greater Noida, Uttar Pradesh 201310, India ("we", "us"). We are the Data Fiduciary for the personal data described in this policy under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000. This policy covers our website, our Android app and our Android TV app (together, the "Service").

2. Information we collect

We collect only what we need to run the Service:

• Account details — name, email address, password (stored only as a one-way hash), optional phone number, and your role (student, parent, teacher or school staff). Students also give their class (5–12), board, preferred language and study preferences. If you sign in with Google, we receive your verified name and email address from Google.
• Parent or guardian details — when a student under 18 signs up, the name, email address, optional phone number and relationship of the parent or guardian they name. We use these only to ask that parent or guardian for consent, to record their answer and, once they have confirmed, to send them the invoices for the student's purchases.
• Learning activity — lessons watched and where you stopped, quiz and practice answers, scores, notes, highlights, bookmarks, flashcards, study schedules, goals, streaks and points, and time spent in focus sessions.
• AI tutor conversations — the messages you exchange with the AI tutor, stored so you can return to them and so the tutor can follow the conversation.
• Voice input — when you speak to the tutor, the audio is sent to a speech-to-text provider to produce text. We keep the text; we do not store the audio recording.
• Purchase records and invoices — what was bought, for which student, the amount, the date, and Razorpay's order, payment and refund references. Indian tax law requires a GST invoice for every purchase, so at checkout we also ask for the payer's name and state (and a postal address for orders of ₹50,000 or more), and the invoice records them with the payer's email address. Card, UPI and bank details are entered on Razorpay's checkout and never reach us; an invoice shows only the payment method.
• Messages to us — your name, email address and message when you use the contact form, along with the IP address it was sent from (to block spam).
• Usage and technical data — which pages and features you use while signed in, and standard server logs (IP address, device and browser type, time of request) used for security and troubleshooting.

We do not ask for date of birth, gender, photographs or any government ID, and we ask for a postal address only when the law requires one on an invoice.

3. How we use it

• To create and run your account and deliver the courses you have access to.
• To power the AI tutor, practice, schedules and progress reports, personalised to the student's class and progress.
• To show linked parents and teachers how a student is doing (see section 5).
• To process payments, refunds and payment requests sent to a parent.
• To answer support requests and send service messages, such as a payment link a student asked us to send to a parent.
• To keep the Service secure, prevent fraud and abuse, and fix problems.
• To understand, in aggregate, which features help students learn, so we can improve them.
• To meet our legal obligations, such as tax and accounting record-keeping.

We do not sell personal data. We do not show advertising, and we do not use anyone's data — least of all a child's — for targeted advertising or to build advertising profiles. We do not use your conversations or learning data to train AI models.

4. Children and parental consent

Most of our students are under 18 and are therefore children under the DPDP Act. When a student signs up, they either tell us they are 18 or older, or give us the details of a parent or lawful guardian. We email that parent or guardian a link to a page that explains what we collect and why; they confirm that they are the student's parent or lawful guardian, that they are 18 or older, and that they agree to the Terms and this Privacy Policy on the student's behalf — or they decline. We record their answer together with the version of these documents, the date and time, and the IP address and browser it came from, as evidence of consent. Purchases for a student under 18 must be authorised by a parent or guardian.

Until a parent or guardian confirms, invoices for the student's purchases go to the student; once they confirm, we send them the invoices from the previous 90 days and every invoice after that. If a parent or guardian declines, we stop emailing that address about any student.

We process a child's data only to provide the learning service. We do not track a child's behaviour for advertising, and the AI tutor applies child-safety filters to its replies.

A parent can link to their child's account using the child's invite code to follow their progress. If you are a parent and believe your child has registered without your consent, write to [email protected] and we will suspend the account and, at your request, erase it. A linked parent can also delete their child's account themselves, from the child's card on the Family page.

5. Who can see your data

• Linked parents can see their child's progress, reports, schedule, activity, points and an AI-written weekly summary. Parents cannot read their child's AI tutor conversations.
• Teachers and schools that a student is connected to can see that student's progress, and class rankings show students in the class by name.
• Service providers who process data for us under contract, only to provide their part of the Service (listed below).
• Authorities, when the law requires it or to protect the safety of a user or the public.

Our service providers:

• Google Cloud — hosting, database and file storage, in the Mumbai (India) region.
• Razorpay — payment processing and refunds (India).
• Cloudflare — secure network delivery of the website.
• Google — Sign in with Google, and Gemini speech-to-text for voice input.
• Sarvam AI — speech-to-text for voice input (India).
• Mistral AI — generates the AI tutor's replies.
• Voyage AI — converts search and tutor questions into a form we can match against the curriculum.

AI and speech providers receive only what they need to answer a request — for example, the question, the recent conversation, the student's class and subject. They do not receive your email address, phone number or password.

6. Where your data is stored

Your account and learning data are stored in India. Some AI and speech providers listed above process the content of a request on servers outside India (in the European Union or the United States) for the moment it takes to answer it. We transfer data abroad only as permitted under the DPDP Act and never to a country the Government of India has restricted.

7. Cookies and local storage

We set one cookie, which protects lesson videos and expires after 30 minutes. Your sign-in session and preferences (such as theme, captions and where you left a lesson) are kept in your browser's local storage. We do not use advertising cookies or third-party analytics trackers; the usage data in section 2 is collected by our own systems. Razorpay's checkout and Google's sign-in may set their own cookies when you use them.

8. How long we keep it

• Account and learning data: for as long as the account is open. When you delete an account in the app (Settings → Delete account), we erase it straight away; when you ask us by email, we erase it within 30 days.
• Invoices and credit notes: for 8 years after the end of the financial year in which they were issued, because the GST law (section 36 of the CGST Act, 2017) and company law (section 128 of the Companies Act, 2013) require us to keep them. Each one keeps what the law requires it to show, including the payer's name, email address, state and, where given, postal address, and it is kept even if the account is deleted. We use them only for tax, accounting and legal purposes.
• Parent or guardian details and the record of their consent: for as long as the student's account is open; they are erased with the account. If a parent or guardian declines, we keep a one-way hash of their email address — not the address itself — so that we never email them a consent request again.
• Other purchase and refund records: for the same period. Once the account is erased, these are no longer linked to any account and no longer hold your name, email address, phone number or postal address. Razorpay keeps its own payment records under its privacy policy.
• Database backups: overwritten on a rolling basis within about 7 days.
• Server and security logs: only as long as needed for security and troubleshooting.

9. Security

We protect your data with encryption in transit and at rest, hashed passwords, short-lived sign-in sessions and a private database network. No system is perfectly secure; if a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires. See our Security page for details.

10. Your rights

Under the DPDP Act, you (or a parent, for a child) have the right to:

• get a summary of the personal data we hold about you and who we have shared it with;
• correct, complete or update inaccurate data — most of it you can edit in your profile;
• have your data erased, except the invoices and records the law requires us to keep (section 8), and withdraw consent, which closes the account;
• nominate someone to exercise these rights if you die or become unable to;
• have a complaint about our handling of your data resolved (section 12).

You can erase your account yourself at any time in Settings → Delete account (we ask for your password first), and a linked parent can delete their child's account from the Family page. Erasing an account is permanent and also withdraws consent.

To use any of these rights by email instead, write to [email protected] from the email address on the account. We may ask you to confirm your identity, and we respond within 30 days. Withdrawing consent does not affect processing that happened before it.

11. Changes to this policy

If we change this policy, we update the date at the top of this page. If a change is significant, we will also tell you in the app or by email before it takes effect.

12. Grievance Officer and contact

For any question or complaint about your personal data, contact our Grievance Officer:

Prabhat Kumar Pannu
Geminal Tech Private Limited, C-240, Sector 37, Greater Noida, Uttar Pradesh 201310, India
[email protected]

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.