SWC EDTECH SOLUTIONS · studywithconcepts.com · Last updated: 17 October 2026
This Privacy Policy explains how SWC EDTECH SOLUTIONS (trading as Study With Concepts, "we", "us", "our") collects, uses, stores and shares personal data. It applies to all users of studywithconcepts.com, including registered students, parents or guardians, anonymous visitors and trial users.
Registered students: Name, grade, email address, phone number (optional at registration), school name, board, exam target, learning activity including test scores, practice-question responses, progress history, AI doubt queries submitted and the AI responses received, answer-sheet images uploaded for grading, and subscription and payment records (transaction IDs, amounts, dates). We do not store card numbers, UPI credentials or bank account details.
Trial users: Name, phone number, grade, school name and city collected during trial-exam registration. Trial exam responses and uploaded answer images are processed and stored.
Anonymous visitors: IP address, browser type, pages visited and session duration are logged for operational security. Messages or questions sent through any chatbot or AI doubt feature are processed in real time by our AI providers (see Section 4) and are stored in our database as doubt-query history.
We use personal data to:
Student data is never used for advertising and is not sold. Data is not shared with third parties beyond the processors listed in Section 4.
Service communications: We may send you transactional messages via WhatsApp (activation confirmation, subscription expiry notice, support responses). These are essential to the service and are not promotional. No promotional or marketing messages are sent without a separate, explicit opt-in that is distinct from account creation.
We share data with the following processors as part of delivering the service:
<script> tag only after an authenticated admin or employee explicitly accepts in the analytics consent banner. The script is never loaded for students, trial users or anonymous visitors — no PostHog network request is made at page load. On logout, analytics are immediately stopped and the SDK is opted out. Session recording is permanently disabled.This platform serves students of all ages, including children under 18. We take extra care to protect the privacy of young learners.
Registration: At account creation, the person registering sees the following notice below the "Create Account" button:
"By clicking 'Create Account', you agree to our Terms & Conditions and acknowledge our Privacy Policy."
The act of clicking "Create Account" records the policy version accepted and the registration timestamp server-side. This is a self-declaration mechanism and is not labelled as verified parental consent. We do not independently verify whether the person registering is a parent, guardian, adult student, or the child themselves.
Parents and guardians are encouraged to register on behalf of their child and to review this Privacy Policy before doing so.
Student data use: Submitted doubts, uploaded answer sheets and test scores are used solely to deliver learning services to that student. This data is shared with AI providers (see Section 4) for real-time processing only.
AI processing: Questions and images submitted by students are processed by our AI providers (Google Gemini, OpenAI). See Section 4 for disclosure on their data handling. Students should not include sensitive personal information in doubt queries beyond what is necessary.
Parent reports: A weekly learning report is compiled manually by our admin team and sent via WhatsApp to the registered parent or guardian contact number.
Parental access and deletion requests: A parent or guardian may contact support@studywithconcepts.org or WhatsApp +91 8149151983 to request access to, correction of or deletion of their child's data. We will respond within 15 business days. See Section 6 for retention rules.
Student accounts are never opted in to analytics tracking. No student browsing behaviour, answers, doubt queries or personal data enter PostHog or GA4.
Note on parental consent: Under applicable Indian law (IT Act 2000 and the Digital Personal Data Protection Act 2023), processing personal data of children may require verifiable parental consent. Our current registration mechanism is a self-declaration and does not independently verify the registrant's relationship to the student. Parents and guardians should review this policy before registering on behalf of a child. We recommend legal counsel review the platform's obligations as the DPDP Act rules are finalised.
The following schedule has been confirmed by the platform owner. Verified deletion requests from students or guardians are handled separately and processed subject to the legal minimums listed below.
| Category | Data Types | Retention Period | Deletion Trigger | Notes / Exceptions |
|---|---|---|---|---|
| Student-generated data | Account profile (name, email, phone, grade, school, board); test scores and practice-question responses; AI doubt queries and responses; uploaded answer-sheet images (Cloudinary); competition and trial exam results; progress history; subscription and activation records | During active service, then 2 years after account closure or subscription expiry. Renewal updates the expiry-based deadline. | Expiry-based deadline reached, OR verified deletion request from student or guardian | Payment and financial records embedded in the account are governed by the 7-year rule below. Anonymised aggregate statistics (e.g. leaderboard percentiles) may be retained without personal identifiers. |
| Payment and invoice records | Invoice numbers, transaction IDs, amounts, activation dates, payment-confirmation records | 7 years from invoice date | 7 years elapsed | Minimum 7 years required under Indian accounting and income-tax law. Cannot be deleted earlier on a deletion request. |
| Security and audit logs | Session records, login timestamps, IP addresses, password reset requests, session-invalidation events | 90 days from creation | 90 days elapsed | Retained for security investigation and account-recovery purposes within that window. |
| Policy consent records | Policy version accepted, acceptance timestamp, IP address at registration (stored in user record) | Account lifetime plus 3 years after account closure | 3 years after account closure | May be required as evidence of consent in regulatory or legal proceedings. |
| Database backups | Encrypted automated backup snapshots of all collections | 7-day point-in-time recovery window (current plan). Individual snapshot deletion schedule is managed by Emergent's infrastructure provider. | Determined by Emergent's infrastructure backup schedule | A recovery window of 7 days is confirmed. The exact deletion timing of individual backup snapshots has not been independently verified for this plan tier — contact Emergent Labs for plan-specific details. Personal data deleted from the primary database will be excluded from new backups as snapshots cycle out. |
Self-service deletion: A self-service deletion button is not currently available in the platform. Deletion requests must be submitted to support@studywithconcepts.org or WhatsApp +91 8149151983. The support team will confirm the request, identify data held, and process deletion subject to the applicable exceptions above.
Passwords are stored as bcrypt hashes. JWT session tokens are short-lived and are globally invalidated immediately on password change. One active device session is permitted per student account at a time.
Temporary passwords: Admin-issued temporary passwords are generated server-side using a cryptographically random function. The plaintext is returned to the admin once only and is never stored in the database. Temporary passwords expire after 48 hours.
Admin password resets: Before generating a temporary password, admins are required to record how they verified the student's identity. This is an internal process record; it does not constitute independent proof of identity and is not disclosed to the student.
Cloudinary file delivery: All answer-sheet images use authenticated delivery. Server-generated signed URLs (24-hour expiry) are required to view any file; unsigned CDN URLs return HTTP 401 from Cloudinary. Signed URL expiry is enforced by Cloudinary on every request.
No security measure provides an absolute guarantee. We use reasonable technical and organisational measures to protect personal data.
Platform analytics (PostHog, GA4) are used only on admin and employee accounts, with explicit opt-in via an in-platform consent banner. Both tools are configured with event capturing disabled by default.
The PostHog SDK script is loaded only when an authenticated admin or employee explicitly accepts. It is never loaded on page entry and never loaded for students, trial users or anonymous visitors. On logout, analytics capturing is stopped immediately and the SDK is opted out. No PostHog network request occurs for non-admin users. Session recording is permanently disabled.
The GA4 script is loaded only after an admin or employee opts in via the consent banner, using the same condition. Not loaded for students, trial users or anonymous visitors.
At registration, the platform records: the policy-version string accepted, the UTC timestamp of account creation, and the IP address of the registration request. This record is stored in the user account and is subject to the consent-record retention period in Section 6.
For data-related queries, access requests or deletion requests:
support@studywithconcepts.org · WhatsApp +91 8149151983
Grievance Officer: Sachin Dange — same contact details.
See also: Contact & Grievance Redressal
SWC EDTECH SOLUTIONS | Sole Proprietorship | Proprietor: Shivam Tiwari
B402, Space Park Phase 1, Mahalaxmi Nagar, Indore, Madhya Pradesh – 452010, India
support@studywithconcepts.org · +91 8149151983
With your permission, we use Meta Pixel to measure NRWO campaign visits. This is optional and does not affect registration. We never send student names, contact details, registration details, or payment information. If you are registering a student, choose this only if you are the parent/guardian or otherwise authorised.