What we hold, and what we do not.
Draft, under legal review against the Digital Personal Data Protection Act 2023. Published in draft so you can read it before it is final; we will date and announce the version that replaces it.
Who the data belongs to
Student data belongs to the school, not to us and not to Sahayak’s investors. We process it on the school’s instruction. If a school leaves, they export it and we delete our copy.
What we collect
Names, a login identifier, a role and a class for every person. For students: attendance, marks, submitted work, teacher observations and the learning record built from those. For parents: a phone number, and which children are theirs. We do not collect a home address, a date of birth, caste, religion, biometric data or a government identifier, and there is nowhere in the product to enter one.
Where it lives
The database and uploaded files are hosted in Mumbai. Some AI processing currently runs outside India, at our model provider. We say so here rather than in a sub-clause because it is the thing a school most needs to know and most often is not told.
What reaches the AI
A student’s first name, the work in question, and the teaching material the school uploaded. Not full names, not contact details, not identifiers, not another student’s work. Nothing sent to a model is used to train it — ours or anyone else’s — and no school’s material is visible to another school.
Consent, and withdrawing it
For a student under 18 the AI consents are held by their parent, per purpose: whether chats are remembered between sessions, whether photographs may be uploaded, whether written work may be analysed, and whether voice may be used. A parent can withdraw any of them at any time from their own settings, and withdrawal takes effect immediately. The product keeps working without them — the tutor simply forgets each conversation when the child closes it.
Safeguarding
A sentence that signals self-harm is detected before it reaches the model, and the school’s designated safeguarding lead is alerted. This happens regardless of consent settings, because a child’s safety is not a preference. These alerts cannot be switched off by anyone.
Who can see what
A parent sees their own child. A teacher sees the classes they teach. A student sees their own work. Nobody at Sahayak browses a school’s data; support access is requested from the school and logged.
Deleting your account
Anyone can ask for their account to be removed from their own settings. It is a request handled by a person, not an instant erase, and we complete it within seven days. One tap must not wipe a term of a child’s work without a second person involved — and a learner’s marks are also the school’s record, which the school has its own obligations about.
Cookies
A session token so you stay signed in, and your theme and language preference. No advertising cookies, no third-party analytics that identify a person, and no tracking across other sites.
Contact
Write to hello@sahayak.school. We answer privacy questions from parents directly, not only from schools.
See also how we keep it honest and our terms.