Privacy Policy

[Company legal name] ("EvalGain", "we", "us") runs the EvalGain service and is the Data Fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023 and its rules ("DPDP Act"). This policy explains what we collect, why, who we share it with, and the rights you have.

The Service is used by children under 18. Under the DPDP Act, we process a child's personal data only with the verifiable consent of their parent or legal guardian. That is why accounts are created by the parent or guardian, who confirms their role and gives consent at sign-up. We record when consent was given, the version of this policy it applied to, and the IP address it came from, and we email a confirmation to the account address.

We do not:

• track children's behaviour across other websites or apps;
• show targeted or behavioural advertising to children;
• sell personal data, or use it for any purpose that could harm a child's wellbeing.

We deliberately collect as little as we need:

• Account details: the parent's email address and password (stored only as a secure hash), and the child's first name.
• Academic details: the child's class, board and the subjects enrolled.
• Uploads: images of answer sheets and question papers you upload. These may show anything written on the page, such as a name or roll number.
• Results we generate: transcribed answers, scores, feedback, mistake analysis and reports.
• Payment and billing details: order and payment references from Razorpay, and any billing address or GSTIN you choose to add. We do not store card or bank details.
• Consent and technical data: consent records (time, policy version, IP address), login and security logs, and the session cookie or browser storage needed to keep you signed in.

We do not ask for the child's date of birth, school, home address or phone number.

We use personal data, based on the consent you give, to:

• create and secure your account and verify your email address;
• evaluate uploaded answer sheets and show scores, feedback, reports and practice suggestions;
• send you verification codes, reports, receipts and important service messages by email;
• process payments and meet tax and accounting obligations;
• fix errors, prevent misuse and keep the Service secure;
• improve the accuracy of our evaluation, for example by reviewing results you report as wrong.

We may also process data where the law requires it, for example to comply with a court order or legal obligation.

Evaluation is performed by automated systems, including large language models run by third-party providers. To evaluate an answer sheet we send the page images, the text extracted from them, and the related questions and marking schemes to those providers for processing ("inference"), and we receive the results back.

• We do not include account details such as the parent's email or the child's name in these requests. Anything written on the uploaded page itself, such as a name, is part of the image.
• AI results can be wrong. See the Terms of Use for the limits of AI evaluation.
• Providers process the data under their own terms and security measures to return results to us.

We share personal data only with service providers that process it on our behalf (Data Processors), and only as needed for the purposes above:

Our own servers, database and file storage are hosted in [country/region where our servers are hosted]. We may also disclose data to authorities where required by law, or to a successor if our business is transferred, subject to this policy. We do not sell personal data.

Some of the providers above, in particular AI model providers and the OCR service, process data outside India, including in the United States. By giving consent you agree to this transfer for the purposes described in this policy. We transfer data only as permitted under the DPDP Act, and will stop transfers to any country the Government of India restricts by notification.

• We keep account data, uploads and results while your account is active.
• When you delete your account or withdraw consent, we delete or anonymise your personal data within a reasonable period, unless we must keep it longer by law.
• We keep payment and invoice records for as long as tax and accounting laws require.
• We keep a record of your consent and its withdrawal for as long as needed to show we complied with the law.
• If an account is inactive for a long period, we may delete it after notifying you, as permitted under the DPDP Act.

As the parent or guardian (the Data Principal acting for your child), you can:

• Access a summary of the personal data we hold and how we process it, and the providers we share it with;
• Correct or update inaccurate or incomplete data;
• Erase data that is no longer needed, or delete the account entirely;
• Withdraw consent at any time. It is as easy as giving it: write to us and we will stop processing and close the account. Withdrawal does not affect processing already done;
• Nominate another person to exercise these rights if you die or become incapacitated;
• Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, email contact@evalgain.com from your account email address. We may need to verify your identity before acting.

We use reasonable security safeguards, including encrypted connections (HTTPS), hashed passwords, access controls on our systems and time-limited links to stored files. No system is completely secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Act.

We use a secure session cookie and your browser's local storage to keep you signed in and remember basic preferences. We do not use advertising or cross-site tracking cookies.

We will post any update on this page with a new effective date and version. If a change affects how we use your child's data, we will tell you by email and, where required, ask for your consent again.

Grievance Officer: [Grievance Officer name]
[Company legal name], [Registered office address]
Email: contact@evalgain.com

We will respond to requests and grievances within the time limits set under the DPDP Act and its rules.