Draft — owner to review. This is a starting draft. Please check it with a legal adviser before you publish it.
This Privacy Policy explains how Root Career Institute ("RCI", "we", "us") collects, uses and protects your personal data. It covers our website and our Android app (together, the "Service").
We follow the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and other Indian laws that apply to us. By using the Service, you agree to this policy. If you do not agree, please do not use the Service.
Who we are
Root Career Institute is an online coaching business for JEE, NEET and Class 9–12 students. For your personal data, we are the "Data Fiduciary" under the DPDP Act.
- Legal name: Root Career Institute
- GSTIN: 09HKDPK5566B2Z0 (Uttar Pradesh)
- Address: Durga Bhawan, Naval Kishore Road, Hazratganj, Lucknow, Uttar Pradesh 226001
- Email: rootcareerinstitute0210@gmail.com
- Phone: +91 78974 11184
The data we collect
Data you give us
- Name and email address.
- Your state. We need it to apply the correct GST on your invoice.
- Your exam target (for example, JEE or NEET) and your language preference.
- A profile photo, if you choose to add one.
- Doubts you ask, including any images you upload.
- Messages you send through our contact form.
Data created when you study
- Learning progress, such as lectures watched and bookmarks.
- Your answers and scores in practice quizzes and mock tests.
Data about your device
- Device model, operating system version and app version.
- A hashed device ID. We store a scrambled form of the ID, not the original. We use it to apply the one-phone rule.
Payment data
- Order and payment IDs, amount, date, status and your GST invoice.
- Razorpay processes all payments. We never see or store your card, UPI or net banking details.
Basic logs
- Our systems keep basic technical logs, such as request times and error messages. These help us keep the Service safe and fix problems.
How we use your data
We use your data only to run the Service:
- To create your account and let you log in with an email OTP.
- To unlock the courses you buy and track their validity.
- To play lectures, offline downloads, notes and tests in the app, and to save your progress.
- To answer your doubts.
- To make GST invoices and keep tax records.
- To protect our content. This includes the one-phone rule and a moving watermark on videos. The watermark shows your email in masked form.
- To prevent fraud, account sharing and misuse.
- To reply to your messages and send service emails, such as login codes and invoices.
- To fix bugs and improve the Service.
- To follow the law.
What we do not do: We do not sell your data. We do not show ads. We do not use third-party advertising or tracking tools in the app or on the website. We do not send push notifications.
Why we are allowed to use your data
We process your data with your consent. You give consent when you create an account and use the Service. We also process data for "legitimate uses" that the DPDP Act allows, such as meeting a legal duty (for example, keeping GST records).
You can withdraw your consent at any time by deleting your account. Withdrawal does not affect processing done before it. We must still keep some records to meet legal duties (see "How long we keep data").
Students under 18
Many of our students are under 18. Under the DPDP Act, a person under 18 is a "child". For these students:
- A parent or legal guardian should create the account, or approve it. The parent or guardian gives consent for the child's data.
- We will take steps to obtain verifiable consent from a parent or guardian, as the DPDP Act and its rules require.
- We record learning progress only to run the course and show it to the student. We do not track or monitor children's behaviour for advertising, profiling or any other purpose.
- We do not show targeted ads to children. We do not show ads to anyone.
- We do not process a child's data in a way that could harm the child's well-being.
- A parent or guardian can contact us at any time to see, correct or delete the child's data.
Who we share data with
We share data only with service providers who help us run the Service. They process data on our instructions. We share only what each provider needs.
- Supabase — database, login and file storage on hosted servers.
- Vercel — hosts our website.
- Bunny.net — stores and streams our video lectures.
- Razorpay — processes payments.
- Brevo — sends emails, such as login codes, invoices and replies.
- Sentry — collects crash reports to help us fix bugs. We use it only if we turn it on.
We may also share data:
- With government bodies, courts or police, when the law requires it.
- With our professional advisers, such as an accountant, for tax or legal work.
- With a new owner if our business changes hands. The new owner must protect your data under this policy.
Some of these providers may store or process data on servers outside India. We use them only as Indian law allows.
Cookies
Our website uses only essential cookies or browser storage, for example to keep you logged in. We do not use advertising cookies or third-party tracking cookies.
How long we keep data
- Account, profile and learning data: while your account is active. We delete it when you delete your account.
- Doubts and uploaded images: while your account is active.
- Payment records and GST invoices: for the period Indian tax law requires. Section 36 of the CGST Act, 2017 and rule 56 of the CGST Rules, 2017 require us to keep these records. The period is generally 72 months (six years) from the due date of the annual return for that year. It can be longer if a tax case or appeal is pending.
- Contact-form messages: as long as we need them to answer you and follow up.
- Basic logs: for a short time, for security and fixing problems.
How we protect your data
- Data travels over encrypted connections (HTTPS).
- Access is limited by account and by role. Staff see only what they need for their work.
- Offline downloads are encrypted. They play only inside our app, on the same phone, and they expire.
- The app blocks screenshots and screen recording.
- Card and UPI details stay with Razorpay.
No system is completely secure. If a personal data breach happens, we will inform you and the Data Protection Board of India, as the DPDP Act requires.
Your rights
Under the DPDP Act, you have the right to:
- Get a summary of the personal data we hold about you and how we use it.
- Correct, complete or update your data. You can edit most details in your profile.
- Erase your data by deleting your account.
- Withdraw your consent.
- Nominate another person to use your rights if you die or cannot act yourself.
- Raise a grievance with us. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
To use these rights, email us from your registered email address or call us. We may verify your identity first.
Deleting your account
You can delete your account at any time:
- In the app: Profile → Delete account.
- On the website: Account → Delete account.
See the Delete account page for full details. When you delete your account, we delete your profile, learning progress, quiz answers, doubts and images, offline downloads and registered devices. Your course access ends.
We keep payment records and GST invoices because tax law requires it. We remove your contact details from those payment records. Issued invoices stay as they were issued.
Grievance Officer
If you have a question or complaint about your data, contact our Grievance Officer:
- Grievance Officer: Jitendra Kumar
- Email: rootcareerinstitute0210@gmail.com
- Phone: +91 78974 11184
- Address: Durga Bhawan, Naval Kishore Road, Hazratganj, Lucknow, Uttar Pradesh 226001
We will acknowledge your complaint within 48 hours. We will try to resolve it within one month.
Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date at the top. For important changes, we will tell you in the app or by email.