Privacy Policy

Effective date: 01-08-2026 · Last updated: 28-10-2026

Abhranti (“we”, “us”) is an educational self-assessment platform operated by Abhranti, Panathur Main road, Belagere, Varthur, Bangalore-560087, India. This policy explains what personal data we collect through the Abhranti app and website (abhranti.ai), why we collect it, and the rights you have over it. It is written to comply with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, under which we act as a Data Fiduciary.

1. Who this policy covers

Abhranti serves three kinds of users:

Students, who take assessments and receive learning reports. Most of our students are under 18 — see section 4, which governs everything else in this policy for them.
Parents and guardians, who create and manage the family account, give consent for their children, view progress reports, and make payments.
Teachers and schools, who may view class-level or student-level reports where the student’s parent or the school has authorised that access.

2. What we collect

Account and sign-in data. You sign in with Google or Apple. From the sign-in provider we receive your name, email address, and profile photo (if any). If you use Apple’s “Hide My Email”, we receive and use the relay address — a real email address is not required. We never see or store your Google or Apple password; authentication is handled by Amazon Cognito. Section 14 sets out exactly what we do with Google account data.

Profile data. Student name or nickname, class/grade, education board, and subjects, entered by the parent or student; the link between a parent account and its student profiles; teacher and classroom associations where applicable.

Learning and assessment data. Answers submitted in assessments, scores, time taken, topics mastered, and the areas of misunderstanding our system identifies — used solely to build the student’s own reports and study recommendations.

Payment data. If you buy a subscription, payment is processed by our RBI-authorised payment gateway Razor. Your card, UPI, or bank details go directly to the gateway and never touch our servers — in line with RBI card-tokenisation rules, we cannot and do not store them. We keep only transaction metadata: plan purchased, amount, transaction ID, and status, for receipts, refunds, and tax records. Purchases are made by the parent account, not the student.

Device and usage data. App version, device type, and technical logs needed to keep the service working and secure. The app does not collect advertising identifiers and contains no third-party advertising or ad-tracking SDKs; ad measurement happens only through abhranti.ai, and you can turn it off (section 11).

Operational diagnostics. On our production app and website, Middleware receives performance timings, technical errors, page and action events, and session recordings when enabled, to help us find and fix problems. Random visitor, install and visit identifiers connect website visits with the app they open. Website recordings mask form values and exclude marked sensitive regions. Our named diagnostic events do not include names, email addresses, messages, answers, or advertising click identifiers.

Messages you send us. When you write to us through the contact form on abhranti.ai, the Report a problem form in the app, or by email to contact@abhranti.ai or support@abhranti.ai, we receive your name, email address, and what you write. A report sent from the app also includes your account identifier and the app version, platform, and environment, so we can find the problem. We use this only to answer you and fix what you report.

3. Why we collect it

To provide the service: run assessments, score them, and generate progress reports for the student and their linked parent or teacher.
To improve question quality and difficulty calibration, using aggregated and de-identified data.
To process payments and provide receipts and refunds.
To see how visitors find us, using Meta’s cookies, and OpenAI’s if a ChatGPT advert brought you, unless you turn this off (section 11).
To provide support and respond to your requests.
To keep the platform secure and to meet legal obligations.

We do not sell personal data. We do not show advertising. We do not use personal data for purposes beyond those above without asking for fresh consent.

4. Children’s privacy

Under the DPDP Act, everyone below 18 is a child. Abhranti is built around that:

A parent or guardian creates the account and student profiles, and we obtain the parent’s verifiable consent before processing any of the child’s personal data. Students do not sign up independently.
We do not serve targeted advertising to children, and we do not track, behaviourally monitor, or profile children. Assessment analytics exist only to produce the child’s own learning reports, visible to the child and the adults their parent has authorised.
A parent can review, correct, or delete their child’s data, or withdraw consent entirely, at any time (sections 8 and 9).

5. Who we share data with

We share personal data only with the processors that run the service, under contracts that restrict what they may do with it:

Amazon Web Services (Mumbai region, ap-south-1) — hosting, storage, and Amazon Cognito authentication.
Google (Google Workspace) — our email, where messages you send us are received and answered.
Cloudflare — hosts the abhranti.ai website and runs the spam check (Turnstile) on its contact form.
Middleware — production performance monitoring, error diagnostics and session recording, as described in section 2.
Google and Apple — only as your chosen sign-in provider; their handling of your sign-in is governed by their own privacy policies.
Razor — payment processing, as described in section 2.
Meta Platforms — measuring how visitors find us, as described in section 11, unless you turn it off from Cookie choices at the bottom of abhranti.ai.
OpenAI — measuring which of our ChatGPT adverts brought visitors, as described in section 11, unless you turn it off from Cookie choices at the bottom of abhranti.ai.

Within the product, a student’s reports are visible to the parent account that manages the profile, and to a teacher or school only where that access has been authorised. Beyond this, we disclose personal data only if required by law or to protect the safety and integrity of the service. We never sell personal data.

6. Where data lives and how it is protected

Our account, learning and transaction records are stored in India (AWS Mumbai, ap-south-1). Operational diagnostics are processed by Middleware. Data is encrypted in transit and at rest, access inside Abhranti is restricted on a least-privilege basis, and our systems are segregated so that services only reach the data they need. In the event of a personal data breach we will notify affected users and the Data Protection Board of India as the DPDP Act requires.

7. How long we keep data

Account and profile data: for as long as the account is active, and deleted within 90 days of account deletion or consent withdrawal.
Learning and assessment data: for as long as the student profile exists, so reports and progress remain available; deleted with the profile.
Transaction records: retained as required by Indian tax and accounting law (currently 8 years), even after account deletion.
Technical logs: up to 12 months, then deleted or anonymised.
Messages you send us: for as long as needed to answer and follow up, and deleted within 24 months of our last reply.

8. Your rights

Under the DPDP Act you (and, for a child, the parent who gave consent) have the right to:

Access a summary of the personal data we hold and how it is processed.
Correct or complete inaccurate data.
Erase personal data that is no longer needed for the purpose you consented to.
Withdraw consent at any time, as easily as it was given — after which we stop the related processing.
Have grievances addressed (section 10).
Nominate another person to exercise these rights if you die or become incapacitated.

Exercise these from the app’s settings, or by writing to privacy@abhranti.ai. We respond within the timelines prescribed under the DPDP Rules.

9. Deleting your account

You can delete your account (or an individual student profile) from Settings inside the app, or by emailing privacy@abhranti.ai from the account’s registered address. Deletion removes profile and learning data per the schedule in section 7; transaction records are kept only as long as law requires.

10. Grievances and contact

Grievance Officer: privacy@abhranti.ai, Panathur Main road, Belagere, Varthur, Bangalore-560087, India. We acknowledge grievances promptly and resolve them within the period prescribed under the DPDP Rules. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

11. Cookies

The app and website use cookies and local storage to keep you signed in, remember your preferences, and associate visits with operational diagnostics. Middleware may also use session storage or cookies for those diagnostics. The cookie choice below controls advertising measurement separately.

abhranti.ai also uses Meta’s cookies and Meta’s pixel to see how visitors find us, including which of our adverts on Meta brought them. If another platform’s advert brought you, Meta is not told. This is on unless you turn it off from Cookie choices at the bottom of abhranti.ai. While it is on:

abhranti.ai loads Meta’s pixel, which sets Meta’s cookies (_fbp, and _fbc if you arrived from a Meta advert) and tells Meta which page you viewed.
When the app opens and nobody is signed in, a page of abhranti.ai loaded briefly inside the app tells Meta that the app was opened, and notes which advert, if any, brought you, so it counts as if you had arrived at abhranti.ai. Once someone is signed in, opening the app tells Meta nothing.
When a parent picks a plan in the app’s first-time setup, right after signing in, a page of abhranti.ai loaded briefly inside the app tells Meta which plan was chosen, with a random event identifier and Meta’s cookies. Nothing else about you or your child goes with it.
Our website’s server also sends Meta each of these, with the same random event identifier so that Meta counts it once, your browser’s IP address and user agent, and Meta’s cookies.

As with any request a browser makes, Meta also receives your browser’s IP address and user agent.

Nothing else is reported to Meta, not even a message sent from our contact form, and nothing at all after that setup step. We never send Meta your name, email address or phone number, a student’s name, age, class, marks, results, or anything a student does in the app, and we never send Meta your Google account data (section 14). If you turn it off, none of this happens.

If one of our adverts in ChatGPT brought you, abhranti.ai also uses OpenAI’s cookies and OpenAI’s ChatGPT ads pixel to see whether the advert worked. It loads only when your latest advert click was in ChatGPT. This is on unless you turn it off from Cookie choices, the same choice as Meta’s. While it is on:

abhranti.ai loads OpenAI’s pixel, which sets OpenAI’s cookies (__oppref, the advert’s click reference, and __obref, a random reference for your browser) and tells OpenAI when you view our home page.
When the app opens and nobody is signed in, a page of abhranti.ai loaded briefly inside the app tells OpenAI that the app was opened.
When a new account chooses to set up as a parent, and when a parent adds their first child, a page of abhranti.ai loaded briefly inside the app tells OpenAI that this happened, with a random event identifier and OpenAI’s cookies. Nothing about you or your child goes with it.

As with any request a browser makes, OpenAI also receives your browser’s IP address and user agent. Nothing else is reported to OpenAI. We never send OpenAI your name, email address or phone number, a student’s name, age, class, marks, results, or anything a student does in the app, and a student’s own account never reports these steps. If you turn it off, none of this happens.

12. Changes to this policy

When we change this policy we will update the date at the top and, for material changes, notify you in the app or by email. Where a change expands how we process children’s data, we will seek fresh parental consent before it applies.

13. Governing law

This policy is governed by the laws of India.

14. Google Sign-In and Google account data

Abhranti offers “Sign in with Google” as one way to sign in. This section describes, in one place, how we handle the Google account data that Google shares with us when you choose it.

What we access. When you sign in with Google we request only the basic profile scopes (openid, email, profile). From these we receive your Google account’s name, email address, and profile picture URL, plus a unique account identifier. We do not request access to your Gmail, Google Drive, Calendar, Contacts, or any other Google service, and we never receive your Google password.

How we use it. We use this data solely to create and sign you in to your Abhranti account, to show your name and photo inside the app, to link the parent account to its student profiles, and to send you account and service emails (receipts, security notices, and replies to your requests). We do not use Google account data for advertising, and we do not use it to build profiles for any purpose other than running your Abhranti account.

Who we share it with. Your Google account data is stored by Amazon Cognito (AWS Mumbai, ap-south-1) as part of your Abhranti account. It is not sold, rented, or shared with any third party, other than the processors in section 5 that host and run the service. Within the product, a student’s name and photo are visible only to the parent account that manages the profile and to a teacher or school the parent has authorised.

How we protect and retain it. It is encrypted in transit and at rest and restricted on a least-privilege basis (section 6). It is kept for as long as your account is active and deleted within 90 days of account deletion or consent withdrawal (section 7).

How to delete it. You can delete your Abhranti account, and with it all Google account data we hold, from Settings inside the app or by emailing privacy@abhranti.ai (section 9). You can also revoke Abhranti’s access to your Google account at any time from your Google Account permissions page (myaccount.google.com/permissions); after revocation you can no longer sign in with Google until you grant access again.

Abhranti’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Website usage measurements include sections viewed, scroll depth, interactions, and visible active time. Inactive or hidden tabs do not count as active reading time. Random browser and visit identifiers help connect a website visit to an app arrival and a new account, without recording form contents or answers.