Privacy Policy

WisdomJr Learning Pvt Ltd ("we", "us") operates the WisdomJr platform for students aged 8–15. This policy explains what we collect, why, and how we protect it. It is written to comply with the Digital Personal Data Protection Act, 2023 (DPDP), the Information Technology Rules 2021, and the POCSO Act.

1. Who we are

Data Fiduciary: WisdomJr Learning Pvt Ltd
Data Protection Officer: dpo@wisdomjr.com
Grievance Officer: grievance@wisdomjr.com (responds within 24 hours)

2. What we collect

• Identity: first name, last name (optional), email, date of birth, grade, city
• Parent contact: parent email (required for users under 18)
• Learning activity: puzzle/quiz answers, XP, streak, module progress
• Class activity: attendance, recorded video (with consent), chat messages
• Payment: handled by Razorpay — we do not see card numbers
• Device: hashed IP, user agent, device fingerprint (for security)

We do not collect: location, phone number, school name, family income, or any sensitive personal data.

3. Why we collect it

• Provide the service (classes, puzzles, progression)
• Verify parental consent (legal requirement for under-18)
• Protect against fraud and abuse
• Send transactional emails (receipts, class reminders)

We never sell your data. We never use it for targeted ads.

4. Parental consent

Per DPDP §9, verifiable parental consent is required for every user under 18. Parents can revoke consent any time by writing to the DPO; the account becomes read-only within 24h and is deleted within 30 days.

5. Your rights

• Access: download your data as JSON from Settings → Privacy → Download my data
• Correction: edit profile any time
• Erasure: delete account from Settings → Privacy → Delete account. Hard delete within 30 days
• Grievance: email the Grievance Officer — we respond within 24h, resolve within 15 days

6. Data retention

• Active account data: kept while the account is active
• Deleted account data: hard deleted after 30 days
• Class recordings: 180 days (for child-safety investigations)
• Invoices / payment records: 7 years (GST requirement)
• Security logs: 1 year

7. Sharing with third parties

We share data with processors only, under signed Data Processing Agreements:

• Razorpay — payments (India)
• 100ms.live — live video (India)
• SendGrid — email (USA, under SCC)
• AWS / Cloudflare — hosting (Mumbai region primarily)
• Firebase — push notifications
• PostHog / Sentry — analytics & errors (anonymised)

8. Security

Passwords hashed with bcrypt. All traffic over TLS. Secrets in AWS Secrets Manager. See our public Security Playbook for the full 270-item checklist.

9. Children's safety

Every tutor is KYC-verified and police-verified. Private 1-on-1 rooms are prohibited. All chat is moderated. Reports to authorities under POCSO are mandatory and automatic.

10. Changes

We email active users 14 days before any material change to this policy.

11. Contact

Questions or complaints: dpo@wisdomjr.com or grievance@wisdomjr.com