UPI-Vidya: Privacy Policy
1. Introduction
UPI-Vidya ("UPI-Vidya", "we", "us", "our") provides a school-integrated financial literacy learning platform for students in Classes 1 to 12. The platform is available at upividya.in. It includes a student portal, a parent portal and a school administration portal.
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have. It is written in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them. Please also refer to our Terms and Conditions governing use of the platform.
2. Who this Policy applies to
- • Students, who use the learning portal under the supervision of their school and parent or guardian.
- • Parents and guardians, who view their child's progress.
- • School administrators, who manage student accounts for their school.
- • Visitors to our public website.
3. Roles under the law
- • Schools that register students with UPI-Vidya are responsible for obtaining the necessary parental consent. They also decide which students are enrolled.
- • UPI-Vidya processes student data to run the platform, and decides how that data is used within the platform.
4. Data we collect
4.1 Student account data (entered by the school administrator)
- Student full name
- Gender
- Class, section and roll number
- School name
4.2 Parent or guardian data
- Parent or guardian name
- Parent mobile number
4.3 Login credentials
- A Student PIN and a Parent PIN, generated by the system.
- School administrator passwords, stored in hashed form.
4.4 Learning and usage data
- Sessions unlocked and completed
- Quiz scores, attempts and feedback
- Activity inside the learning playground
- Time spent per day (the daily 15-minute limit)
- Online or offline status and the last activity time, so parents and schools can see live progress
4.5 Technical data
- Authentication tokens and security logs, including failed login attempts used to prevent misuse
- Basic technical information such as IP address, browser type and device type, which are processed by our hosting and security providers
4.6 What we do not collect
- We do not collect payment card or bank details.
- We do not collect photographs, precise location, contacts or microphone and camera data.
- We do not collect government ID numbers.
- We do not run advertising and we do not use advertising trackers.
5. Why we use the data
- • To create and manage student, parent and school accounts
- • To deliver lessons, quizzes and activities, and to unlock content based on progress
- • To enforce the daily time limit
- • To show progress and activity to the student, the parent and the school
- • To keep the platform secure, prevent unauthorised access and fix errors
- • To improve the content and the experience
- • To communicate with schools and parents about the service
- • To meet legal obligations
6. Children's data and consent
- • Students under 18 are treated as children under the DPDP Act.
- • Student accounts are created only by a school administrator. Children cannot sign themselves up.
- • By enrolling a student, the school confirms that it has obtained verifiable consent from the child's parent or legal guardian for the processing described in this Policy.
- • Parents or guardians can withdraw consent at any time (see Section 11). Withdrawing consent may mean the child can no longer use the platform.
- • We process children's data only for educational purposes and only as much as needed to run the platform.
7. Who can see the data
Their own profile, progress and scores
Their own child’s profile, progress and activity
Students of their own school only
Complete access for support, maintenance and security, on a need-to-know basis
8. Sharing and service providers
We share data only with trusted providers that help us run the platform:
- • Google Firebase for authentication and database storage
- • Vercel for website hosting and server functions
- • GoDaddy for domain registration and DNS
- • Google Fonts and Font Awesome (CDN) for fonts and icons, which may receive your IP address when pages load
These providers process data on our behalf under their own security and privacy terms. Some of them may process data on servers outside India.
We may also disclose data if required by law, a court order or a government authority, or to protect the rights and safety of users and the platform.
9. Cookies and local storage
We use only essential browser storage, such as session information needed to keep you logged in. Login sessions are tied to the browser tab and end when the tab is closed. We do not use advertising or third-party tracking cookies.
10. Data security
We use reasonable technical and organisational safeguards, including:
- • Hashed credentials and encrypted connections (HTTPS)
- • Role-based access, so each user sees only what they are allowed to
- • Limits on repeated failed logins
- • Server-side checks for administrative actions
No online system is completely secure. If a personal data breach affects you, we will notify the affected users and the authorities as required by law.
11. Your rights
Under the DPDP Act, a parent or guardian (on behalf of a child), or a school administrator (for their school's records), can:
- • Ask for a summary of the personal data we hold
- • Ask us to correct or update inaccurate data
- • Ask us to delete the data, subject to legal requirements
- • Withdraw consent for processing
- • Nominate another person to exercise these rights
- • Make a complaint (see Section 14)
To exercise any right, contact us using the details in Section 15. Requests are verified before action. We aim to respond within a reasonable time, and in any case within the period required by law.
12. Data retention
- • We keep student data for as long as the school's account is active and the student is enrolled.
- • When a school ends its agreement, or when a parent withdraws consent, the related data is deleted or anonymised within a reasonable period, unless the law requires us to keep it.
- • Security logs are kept only as long as needed for security purposes.
- • Anonymised data that can no longer identify a person may be kept for research and improvement.
13. Changes to this Policy
We may update this Policy from time to time. The "Last updated" date shows the latest version. Material changes will be announced on the website or sent to schools.
14. Grievance redressal
If you have a complaint about how your data is handled, contact us using the details below. If you are not satisfied with the response, you may approach the Data Protection Board of India as provided under the DPDP Act.