Privacy Policy
1. Who we are
YourGuru is operated by Aarush Innovations.
This Privacy Policy covers both parent-managed children’s learning and self-managed adult learning.
For a child’s profile, the parent or legal guardian manages the relevant permissions and privacy controls. An adult learner manages their own information and permissions.
For privacy questions or requests, contact support@yourguru.app.
2. Data protection and your choices
We handle personal information for the purposes explained in this Policy and the relevant permission notices, subject to applicable Indian data-protection law, including the Digital Personal Data Protection Act and its rules as their provisions become applicable.
You may ask us to:
- Provide information about the personal data we process about you or your child.
- Correct inaccurate or incomplete information.
- Delete information where applicable.
- Withdraw permission for processing that depends on consent.
- Address a privacy complaint.
- Record a nomination for exercising applicable data rights, where available under law.
We may verify your identity and authority before acting on a request. A parent cannot control an unrelated adult learner’s account merely because they know the learner or paid for a purchase.
Where processing is necessary for a requested feature, withdrawing the relevant permission may make that feature unavailable. We will explain the effect.
Optional model-training permission is separate. Declining or withdrawing it does not, by itself, prevent ordinary learning.
3. Children’s privacy
Children use YourGuru through profiles created and controlled by their parent or legal guardian. They cannot independently register an account or authorise their own learning-data processing.
Before the relevant learning or recording processing begins, we obtain the applicable parental permission and verification required for that purpose.
Child-learning permission and loved-one recording permission are separate. Each child requires the permissions applicable to their own profile; a sibling’s permission does not cover them.
Children’s information may include:
- Their name and optional profile photo.
- Grade, board and applicable learning configuration.
- Language preferences.
- Questions, learning interactions and admitted educational material.
- Progress, assessment results, permitted replays and learning history.
- Necessary safety, access and usage information.
Parents may review and manage their associated children’s information through the available account controls or a verified privacy request.
We do not sell children’s information or use it for third-party advertising.
4. Information we collect
4.1 Account information
For parents and adult learners, we collect information needed to create and manage the account, such as name, email address, authentication identifiers, account type, account status, accepted policy versions and permission records.
Where PINs apply, we store protected verification information rather than readable PINs.
4.2 Adult learning information
For self-managed adults, we may process:
- Teaching-language preferences.
- Spoken or typed questions and code submitted for explanation.
- Admitted educational documents and images.
- Transcripts, generated explanations, accepted learning work and eligible audio.
- Learning History, usage and necessary safety information.
Adult accounts do not require a child profile, school board or grade, parental consent or a loved-one recording.
4.3 Billing information
When required for a purchase or invoice, we collect billing contact details, address, State, City, postal PIN code and any optional business name and GSTIN you provide.
We also retain relevant plan, order, payment-reference, invoice, tax and subscription information.
Payment providers process payment-method information. YourGuru does not store full card numbers or card security codes.
4.4 Loved-one recordings
For a child’s personalised tutor, an authorised recording may include the speaker’s face, voice, image frames, transcript and media-processing information.
Processing may produce the tutor voice, visual representation and other media needed for the authorised experience.
This is separate from an adult learner using a microphone to ask a question.
4.5 Usage, support and safety information
We process necessary service activity, error information, support communications, feature usage and security or moderation outcomes.
Ordinary operational records are intended to contain necessary metadata rather than complete private recordings, documents or conversations. Access to content needed for a specific support or safety review is separately restricted.
4.6 Device and location information
To protect accounts and manage access, we record browser and device descriptions, sign-in and sign-out times, profile device changes, last activity and relevant learning-session status.
Network information may be processed to determine an approximate city and country. We do not request GPS location for device management.
Approximate locations may be inaccurate or unavailable. Device descriptions and locations do not establish a person’s identity or prove account sharing.
5. Cookies and similar technologies
We use cookies, browser storage and similar technologies for authentication, security, preferences, device authorisation and essential application functions.
Optional analytics operate only where enabled under the applicable permission requirements. We do not use third-party advertising cookies.
You can manage browser storage through your browser settings. Clearing it may sign you out or require device verification again.
6. How we use information
We use information as necessary to:
- Create accounts, verify ownership and authenticate access.
- Manage named learning profiles, permissions and device authorisations.
- Provide requested learning, explanations, practice, history and eligible replays.
- Create and operate a child’s authorised loved-one tutor.
- Apply appropriate safety and moderation controls.
- Prevent account misuse, unauthorised access, fraud and security incidents.
- Process purchases, subscriptions, invoices and billing support.
- Communicate about account activity, device changes, purchases and service availability.
- Resolve support requests and maintain service reliability.
- Develop and train YourGuru’s own AI systems using eligible material covered by the required separate permission.
- Meet applicable legal obligations.
We collect and use information appropriate to the account type. Adult learning does not require creating artificial parent or child records.
7. AI processing, authorised archives and model training
7.1 Processing needed for learning
AI and supporting services may process the information necessary to answer a question, understand speech, explain admitted material or generate an authorised tutor experience.
We limit information sent to providers to what is needed for the relevant task. Provider access is subject to the applicable service arrangements and safeguards.
7.2 Improvement using non-identifying material
We may improve reliability, safety and teaching quality using permitted operational information, feedback and genuinely de-identified educational material.
Private recordings, documents, conversations and learning history are not made available to other accounts merely because similar questions are asked.
Removing a name alone does not necessarily make material anonymous. Educational material must not retain information that identifies a learner, household or recorded person before it is treated as non-identifying.
7.3 Separate training permission
Using personal content for additional model development or training requires a specific explanation of the material, purpose and retention, together with the necessary permission and a lawful basis.
For children’s information, the relevant permission comes from the parent or legal guardian. Adult learners provide their own permission. Necessary rights and permissions for another person’s face, voice or protected material must also be in place.
Ordinary Terms acceptance, payment, microphone access or permission to create a personalised tutor does not automatically authorise separate training.
We do not treat a new policy version as retrospective permission to train on previously collected personal material.
7.4 Archiving old replays
When a child changes grade, previous-grade replays become unavailable through the product.
Selected old replays covered by valid archival and training permission may be retained in restricted Google Cloud Storage Archive in Mumbai, India, for future development, evaluation and training of YourGuru’s own AI systems.
These archives may include the authorised replay media and the information needed to understand its teaching content and permission status. They are not a permanent family replay library, are not publicly accessible and are not available to other learners.
We retain only material needed for the authorised purpose and review whether continued retention is justified. We prefer reviewed, de-identified teaching material where personal audio or video is unnecessary.
Material without the required permission is not retained for future training merely because it might become useful.
7.5 Withdrawal and deletion
You may withdraw optional training permission. We stop further training use of the affected personal material and remove the affected personal training copies and archives within 30 days of your request, unless limited retention is required by law.
Withdrawing optional training permission does not itself delete the learning records still needed to provide your requested learning features. You can separately request deletion of the profile or account.
Account or child-profile deletion includes the associated personal training archives. Archive storage charges or minimum billing periods do not delay deletion.
8. Safety, educational files and camera use
8.1 Safety processing
We may process relevant interactions to identify unsafe content, exploitation, privacy risks, harmful activity and misuse.
Parents may receive appropriate safety communications about their children. Adult safety communications go to the adult account owner.
Where evidence is needed for a permitted safety review, we retain only the necessary information, with redaction and restricted access where appropriate.
8.2 Educational files
Learning-file inputs are intended for safe educational material, not identity documents, credentials, personal financial records, private health records or unrelated sensitive information.
Checking a file may require temporary processing of its contents. Rejected or unverified files and their extracted content are not retained as learning material, training samples or ordinary support evidence, and are not passed to generative AI providers.
Limited non-content records, such as the time and general reason for a failed attempt, may remain where necessary.
YourGuru does not delete the original file from your own device.
8.3 Camera use
Ask a Question does not require a learner’s live camera.
Where an optional Daily Learning attention feature is offered, we explain it and request the relevant permission separately. Raw attention-camera images or video remain on the device; only permitted summary information may be processed for the described learning purpose.
Loved-one tutor recording is a separate feature with its own recording permission.
9. Sharing and service providers
We share information only as needed with providers supporting functions such as:
- Authentication, hosting, databases and storage.
- Email and service communications.
- Payments and invoicing.
- Speech, AI, tutor-media processing and moderation.
- Security, reliability and authorised support.
Providers receive access appropriate to their task. We do not authorise them to sell personal information or use children’s information for advertising.
Permission to use material for YourGuru’s own model development does not automatically authorise a provider to train its independent models on that personal material.
Parents can access information associated with their own children as permitted by the product. Adult learning information is controlled by the adult account owner.
Authorised staff may access necessary information for a legitimate support, security, operational, authorised training or legal purpose. Access is restricted by role and recorded where appropriate.
We may disclose necessary information to comply with law, respond to valid legal process or protect people and the Service. Any disclosure is limited to the relevant purpose.
10. Payments
Payment providers process payment details under their own applicable notices and security arrangements.
YourGuru retains the information needed to confirm purchases, manage entitlements, provide invoices, resolve disputes and meet accounting or tax obligations.
Invoices and payment communications go to the verified account owner’s email address. Paying for another person does not grant access to their private learning information.
11. Data retention
We retain personal information only for the relevant service, authorised purpose and applicable retention period.
The periods below do not override a valid deletion or consent-withdrawal request, except where a limited lawful retention requirement applies.
- Account, profile and learning records: While needed for the active account and authorised learning purposes, subject to deletion and category-specific limits.
- Active approved loved-one recording: While required for the child’s authorised tutor experience and while the relevant permission remains valid.
- Failed or incomplete loved-one recordings: Deleted within 24 hours.
- Replaced source recordings: No longer available through the product. Any continued archival requires the relevant separate authorisation and remains subject to withdrawal and deletion.
- Previous-grade replays: Product access ends on grade change. Selected, properly authorised replays may remain in restricted GCS Archive while needed for the permitted training purpose and while the relevant permissions remain valid.
- Adult Learning History: Retained for the adult’s authorised history and learning purposes, subject to account deletion and applicable retention controls.
- Rejected or unverified educational files: No retained learning, training or support-content archive. Temporary processing content is released when the attempt ends.
- Device, location, sign-in and device-change history: 90 days.
- Policy reminders and closed security reviews: 12 months after the review is closed.
- Current device authorisations: While active and needed to provide access.
- Access restrictions: Until an authorised administrator lifts them or the applicable deletion process removes them.
- Support records: 12 months, with limited longer retention only where justified by a legal or dispute requirement.
- Product analytics: No more than 365 days for information linked to a user or profile.
- Formal accountability audit records: Up to 24 months under the applicable audit policy, distinct from ordinary device history.
- Billing and financial records: For the period required for accounting, tax, legal obligations and legitimate payment disputes.
Security-email content is retained only for its bounded delivery purpose. Ordinary security notices have a delivery window of up to 24 hours, while device-change codes expire after 10 minutes. Minimal delivery receipts may remain for up to 30 days without the message body.
We do not retain private learning media merely because a billing or audit record must be kept longer.
12. Deletion and withdrawal
12.1 The 30-day deadline
We complete deletion of the affected personal data within 30 days of receiving your deletion request, subject to necessary verification of your identity and authority.
The deadline runs from receipt of the request. It does not restart when a cancellation window ends or when cleanup begins.
Any 48-hour parent-account cancellation window is included within the same 30-day period.
12.2 Parent-account deletion
A parent may request deletion of the household account through the secure account controls.
The request starts a 48-hour cancellation window. Parent and child access continues during that window. If the request is cancelled in time, the account remains active and deletion does not proceed.
If the request is not cancelled, access ends after the window and deletion of the account and associated child information proceeds. We still complete deletion within 30 days of the original request.
12.3 Child-profile deletion
A parent may delete an individual child profile.
After confirmation, access for that child ends immediately and deletion begins. There is no 48-hour cancellation window for an individual child profile.
Other children’s profiles are unaffected. Deletion of the affected personal data completes within 30 days of the request.
12.4 Adult-account deletion
A self-managed adult may request deletion through the secure account controls without a Parent PIN.
Access ends and deletion begins immediately after confirmation. There is no parent-account cancellation window.
Deletion of the affected personal data completes within 30 days of the request.
12.5 What deletion covers
Deletion includes applicable:
- Account and child-profile information.
- Loved-one recordings, including authorised archived copies.
- Generated tutor media.
- Replays, including previous-grade replay archives.
- Private learning history, retained educational files and voice inputs.
- Personal material held in training datasets or training archives.
- Identifiable copies and related private references under our control.
Limited information may remain where necessary and lawful for financial, legal, security, audit or dispute purposes. Such records are restricted to that purpose and must not become a recoverable library of deleted private learning media.
Genuinely de-identified educational content may remain where it no longer identifies you, your child or a recorded person. Material found to contain private or identifying content must be restricted and handled through the relevant correction or deletion process.
12.6 Withdrawal of other permissions
You may withdraw applicable consent through the available controls or a verified privacy request.
Processing that depends on the withdrawn permission stops, and affected features may become unavailable. Withdrawal does not affect the lawfulness of earlier processing carried out under valid permission.
Optional training permission and the related archive-removal process are explained in Section 7.
13. Security and account protection
We use authentication, protected PIN verification where applicable, access controls, restricted media access, encryption in transit, provider security safeguards and audit controls.
Parents and adults can review available access information through Manage devices. Children cannot manage household devices or account-security decisions.
Device changes may trigger neutral policy reminders and human review. They do not automatically suspend a profile.
If activity is unfamiliar, reset your password and any applicable profile PINs, then review and revoke unwanted access.
No system can guarantee complete security.
14. Data storage and transfers
YourGuru is an India-focused service. Where supported, application infrastructure, product data and media use India-region resources, including Mumbai.
Authorised old replay archives described in this Policy use Google Cloud Storage Archive in Mumbai, India.
Some provider-managed services, including authentication, communications, payments, security and certain AI or processing functions, may process information outside India.
We consider the information involved, the purpose, provider safeguards and applicable transfer requirements. We do not represent that every provider or every processing operation is located exclusively in India.
15. Changes to this Policy
We may update this Policy when the Service, processing purposes, providers or applicable requirements change.
We provide notice of material changes where required. If a change needs new consent, we request it before the affected processing begins.
A revised Policy does not retrospectively authorise a new use of information collected under a narrower permission.
16. Contact and complaints
For privacy questions, access requests, corrections, deletion, consent withdrawal or complaints, contact support@yourguru.app.
We verify identity and authority as appropriate before disclosing or changing personal information.
We acknowledge complaints within 48 hours and address them within one month, or sooner where applicable law requires.
You may also use the complaint or appeal mechanisms available under applicable law. Contacting us does not remove those rights.