Privacy Policy

Last updated: 3 September 2026

This Privacy Policy explains how Vidyak ("Vidyak," "we," "us," or "our") collects, uses, discloses, and protects information when you access or use our website, mobile applications, and related services (together, the "Service").

The Service is operated by SAAGERS NEXT PRIVATE LIMITED, a company incorporated in India, with its registered office at Kasba Jana, Auraiya, Uttar Pradesh 206129, India. For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), SAAGERS NEXT PRIVATE LIMITED is the "data controller." For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the "Data Fiduciary."

If you have any questions, requests, or complaints about this policy or your personal data, contact us at support@vidyak.com or write to the address above marked for the attention of the Grievance Officer (see Section 18).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent to process your personal data, we will ask for that consent separately and you may withdraw it at any time.

1. Scope and Who This Policy Covers

Vidyak is an AI-powered educational platform. You can submit a topic or question and receive an instant AI-generated answer, and you can optionally generate an AI video lesson with animated explanations, narrated audio, and downloadable PDF notes. The Service is designed primarily for school students, and we make it available to users worldwide.

This policy applies to all users of the Service, wherever located. Additional region-specific information for the European Economic Area ("EEA"), the United Kingdom, the United States (including California), and India appears in Section 15.

Because the Service is intended for students, many users are minors. Section 9 explains the specific protections and consent requirements that apply to children and young people.

2. Information We Collect

2.1 Information you provide to us

Account information: your name (if you choose to provide it), email address, and a password. Passwords are stored only in salted, hashed form using an industry-standard algorithm; we never store or have access to your plaintext password.
Age information: your date of birth, and — at account creation — your confirmation that you accept these terms, which, where you are below the age of digital consent in your jurisdiction, represents that a parent or legal guardian has authorised your use of the Service (see Section 9).
Learning preferences: your selected education board and class or grade level, your preferred explanation style and difficulty level, and your preferred video narration language. All of these are optional, and you can change or clear them at any time.
Content you submit: the topic prompts, questions, and any other text you type into the Service.
Communications: messages you send to us for support, feedback, product reviews, or other requests, and any information contained in them.
Payment information: if you purchase a paid plan, our third-party payment processor collects the payment details needed to process your transaction (see Section 6). We receive only limited transaction data (such as a transaction reference, plan, amount, currency, and payment status). We do not receive or store your full card number, CVV, UPI PIN, or bank credentials.

2.2 Information generated through your use of the Service

Chat and session history: your prompts together with the AI-generated answers, video lessons, and PDF notes produced in response, stored so you can revisit past sessions.
Generated outputs: the AI-generated video files, audio narration, and PDF lesson notes associated with your account.
Learning activity data: limited signals about how you engage with learning content and your feedback on it. We use this only to adapt the Service to your own learning needs, as described in Section 3 and Section 16. We do not use it for advertising or to build marketing profiles.
Device and technical data: IP address, device type, operating system, browser type, language settings, app version, and identifiers needed to keep you signed in.
Usage and analytics data: general information about how you use the Service and approximate location derived from IP address (city or region level, not precise geolocation), together with technical diagnostic information used to identify and fix errors.
Cookies and similar technologies: see Section 7.

2.3 Information we do not collect

We do not intentionally collect special categories of data (such as data revealing racial or ethnic origin, religious beliefs, health, or biometric data). Please do not include such information in your prompts. We do not collect precise GPS location. We do not use the Service to conduct behavioural monitoring of children for advertising purposes, and we do not serve third-party advertising on the Service.

3. How We Use Your Information

We use personal data for the following purposes:

To provide the Service: create and maintain your account, authenticate you, generate AI answers, video lessons, and PDF notes in response to your prompts, and store your chat and session history so you can return to it.
To personalise your experience: scope your curriculum dashboard to your board and class, and adapt the depth, style, and language of generated content to your stated preferences and your own learning activity (see Section 16).
To process payments: create orders, confirm payment status, activate and renew paid plans, issue receipts, and handle refunds or billing disputes (only if you purchase a paid plan).
To communicate with you: respond to support requests, send service-related notices (such as security alerts, changes to our policies, or changes to the Service), and — only where permitted and with any required consent — send product updates you can opt out of.
To maintain security and prevent abuse: detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service, and enforce our agreements.
To improve the Service: understand how the Service is used, diagnose technical problems, and develop new and improved features. Where we analyse usage for product improvement, we use aggregated or de-identified data wherever practicable.
To comply with law: meet our legal, regulatory, tax, accounting, and record-keeping obligations, and respond to lawful requests from public authorities.

We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising as those terms are defined under California law. We do not use the content of your prompts or your children's data to train third-party foundation models for those providers' own general purposes; prompts are sent to AI providers only to generate your requested output (see Section 4).

4. AI Processing and Service Providers (Subprocessors)

To operate the Service, we share limited data with third-party service providers ("subprocessors") who process it on our behalf and under contract, only to perform their specific function. The categories are:

AI content-generation providers — process your prompt text (and, where relevant, a prior answer for context) to generate text answers, video scripts, and animation sequences.
Text-to-speech providers — process the narration script for a generated lesson to produce narrated audio.
Media/stock-content providers — receive short search terms (not your personal data) to return stock images or clips used inside a generated video.
Cloud hosting, compute, storage, and database providers — host our application, databases, and your generated video and PDF files.
Content-delivery and caching providers — deliver the website and app and generated files efficiently.
Email and communications providers — send transactional email such as verification, password-reset, and support replies.
Payment processors — process payments if you buy a paid plan (see Section 6).
Error-monitoring and analytics providers — receive diagnostic and usage data to help us keep the Service reliable.

A current list of the specific subprocessors we use, and the countries in which they process data, is available on request by emailing support@vidyak.com. We keep this list up to date internally, carry out due diligence on each subprocessor's security and privacy practices, and put data-processing terms in place with each of them. Some subprocessors process data outside your country, including in the United States — see Section 10 on international transfers.

5. Curriculum-Grounded Answers

To ground answers in verified educational material, the Service retrieves relevant excerpts from textbook and curriculum content held in our own internal systems, selected based on the subject of your question. This retrieval step does not disclose your account identity to any third party.

6. Payments

The Service may be offered free of charge or with paid plans. If you purchase a paid plan:

Payments are processed by third-party payment processors (for example, Razorpay for payments in India, and other processors for other regions). Your payment is subject to the processor's own terms and privacy policy.
The processor collects and processes the card, UPI, wallet, netbanking, or other payment details required to complete the transaction. We never receive or store your full card number, CVV, UPI PIN, or online-banking credentials.
We store limited billing records — such as the plan purchased, amount, currency, transaction reference, payment status, and plan period — for accounting, tax, fraud-prevention, and support purposes, and we retain these records for as long as required by applicable law.
We do not use payment information for any purpose other than processing your transaction, providing the paid Service, and meeting our legal obligations.

7. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to:

Keep you signed in and secure — essential authentication and session tokens. These are strictly necessary for the Service to work and cannot be switched off.
Remember your preferences — such as light or dark mode and your last-used settings.
Understand and improve usage — analytics and performance measurement, currently via Google Analytics and Vercel Web Analytics.

When you open the Service in a web browser for the first time, we display a cookie notice. Where we use any non-essential cookies or similar technologies (for example, analytics), we ask for your consent through that notice before setting them. You can update your consent choice, or exercise any of your other rights over your personal data, at any time by contacting support@vidyak.com. In our mobile apps, equivalent choices are available in the app's settings. Essential cookies are always active because the Service cannot function without them.

8. How We Disclose Information

We disclose personal data only in these circumstances:

To subprocessors — as described in Section 4, to operate the Service on our behalf.
For legal reasons — to comply with applicable law, regulation, legal process, or an enforceable governmental request; to enforce our Terms; or to protect the rights, property, or safety of Vidyak, our users, or the public.
In a business transfer — if we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction. We will require the recipient to honour this Privacy Policy, and we will notify you of any change in control or use of your personal data, as well as any choices you may have.
With your direction or consent — when you ask us to share information, or otherwise consent to a disclosure.

We do not sell personal data, and we do not disclose personal data to third parties for their own independent marketing.

9. Children's Privacy and Age Requirements

Vidyak is designed for school students, and we welcome young users. We are committed to protecting children's privacy and to complying with children's data-protection laws in the regions where we operate, including India's DPDP Act, the GDPR (EEA and UK), the UK Age Appropriate Design Code, and the U.S. Children's Online Privacy Protection Act ("COPPA").

9.1 Age of digital consent

The minimum age at which a person can consent to the processing of their own personal data for online services differs by country — for example, it is generally 13 in the United States and the United Kingdom, between 13 and 16 across EEA member states, and 18 in India under the DPDP Act. In this policy we refer to that threshold as the "age of digital consent" for your jurisdiction.

9.2 Age declaration at sign-up

We ask every user for their date of birth when they create an account, and we store it as described in Section 2. This is a self-declared statement, in line with how most consumer software of this kind handles age at sign-up — we do not separately verify it.

9.3 Users below the age of digital consent

If you are below the age of digital consent in your jurisdiction, you may use the Service only with the involvement, knowledge, and consent of a parent or legal guardian. The account-creation screen requires an explicit checkbox confirming that you agree to this Privacy Policy and our Terms of Service — where you are below the age of digital consent, checking that box represents that a parent or legal guardian has reviewed and authorised your use of the Service on your behalf. We do not independently verify this beyond the declaration itself.

A parent or guardian may at any time review the personal data we hold about their child, request its correction or deletion, or object to further collection or use of the child's data, by contacting support@vidyak.com.

9.4 Data minimisation and no profiling for ads

For all users we understand to be children, we:

collect only the personal data reasonably necessary to provide the Service (account credentials, age, board and class, learning preferences, chat history, generated content, and basic technical and usage data);
apply high-privacy settings by default;
do not serve behavioural or targeted advertising, and do not sell or "share" children's data;
do not use children's personal data for tracking or behavioural monitoring except as needed to provide the learning features the child is using, and never in a way likely to cause harm to the child;
do not use "nudge" techniques to encourage children to weaken their privacy settings or provide unnecessary data.

9.5 If we learn a child is using the Service without the required parental involvement

If we become aware that a child has provided us personal data without the parental involvement required in that child's jurisdiction, we will delete that data promptly. If you believe a child is using the Service without appropriate parental knowledge or consent, contact support@vidyak.com.

10. International Data Transfers

We are based in India, and our subprocessors (Section 4) may process data in other countries, including the United States and the EEA. Data-protection laws in those countries may differ from those in your country.

Where we transfer personal data across borders, we rely on appropriate safeguards, which may include:

transfers to countries recognised as providing an adequate level of protection;
the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with the data importer, together with additional technical and organisational measures where needed;
for transfers of personal data out of India, compliance with the cross-border transfer provisions of the DPDP Act and any restrictions notified by the Government of India.

You may request a copy of the relevant safeguard by emailing support@vidyak.com.

11. Data Retention

We keep personal data only for as long as necessary for the purposes described in this policy:

Account data, chat/session history, learning preferences, and generated content — for as long as your account remains active.
After account deletion — we delete or irreversibly anonymise your personal data within 30 days of a verified deletion request, except for data we must retain for legal, tax, accounting, security, or fraud-prevention purposes, which we keep only for the period required and then delete.
Billing and transaction records — for the retention period required by applicable tax and accounting law (typically several years).
Security and audit logs — for a limited period appropriate to the purpose, then deleted or aggregated.
Backups — residual copies in encrypted backups are overwritten on our regular backup rotation cycle.

12. How We Protect Your Information

We use technical and organisational measures appropriate to the risk, including:

encryption of data in transit (HTTPS/TLS);
salted, hashed password storage (never plaintext);
access controls and the principle of least privilege for staff access to user data;
use of reputable cloud infrastructure with its own physical and network security controls;
logging and monitoring to detect unusual activity;
vendor due diligence and data-processing agreements with subprocessors.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users as required by applicable law (including the DPDP Act and GDPR).

13. Your Rights

Subject to your local law, you (or your parent or guardian on your behalf, if you are a child) may have the right to:

access the personal data we hold about you and receive information about how we process it;
correct inaccurate or incomplete data;
delete your personal data ("right to erasure" / "right to be forgotten");
restrict or object to certain processing;
withdraw consent at any time, where processing is based on consent (this does not affect processing already carried out);
data portability — receive a copy of certain data in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where technically feasible;
opt out of marketing communications;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 16);
lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@vidyak.com. We will respond within the time limits set by applicable law (generally within 30 days, extendable where permitted). We will not discriminate against you for exercising your rights. We may need to verify your identity before acting on a request; for requests made by an authorised agent, we may require proof of authorisation.

If we decline a request, we will explain why, to the extent the law allows.

14. Account Deletion

You can delete your account and associated personal data at any time by:

using the in-app "Delete Account" control in your account settings; or
emailing support@vidyak.com.

When you delete your account, we permanently remove your account record, chat and session history, learning activity data, saved preferences, and generated video and PDF metadata from our active systems. The associated generated media files held with our storage providers are removed on our scheduled storage-cleanup cycle. Deletion is completed within 30 days, subject to the limited legal-retention exceptions in Section 11. Deletion is irreversible.

15. Region-Specific Disclosures

15.1 EEA and United Kingdom (GDPR)

Controller: SAAGERS NEXT PRIVATE LIMITED, Kasba Jana, Auraiya, Uttar Pradesh 206129, India, support@vidyak.com. Where we are required to designate an EU or UK representative under Article 27 GDPR, that representative's contact details will be published in this section.

Legal bases we rely on:

Performance of a contract — to create your account and provide the Service you request (generating answers, videos, and notes; storing your history; processing a paid plan you buy).
Consent — for non-essential cookies and analytics; for optional marketing; for processing the personal data of a child below the age of digital consent (given by the holder of parental responsibility); and for any other processing where we ask for it. You may withdraw consent at any time.
Legitimate interests — to secure the Service and prevent abuse and fraud, to maintain and improve the Service, and to run our business — balanced against your rights and freedoms. Contact us for information about this balancing test.
Legal obligation — to comply with law, including tax, accounting, and lawful requests from authorities.

You have the right to lodge a complaint with your national supervisory authority. A list of EEA authorities is maintained by the European Data Protection Board; in the UK, the authority is the Information Commissioner's Office (ico.org.uk).

15.2 United States — California (CCPA/CPRA) and other states

In the preceding 12 months we have collected the following categories of personal information (as defined by the California Consumer Privacy Act, as amended): identifiers (such as name, email, IP address, account identifiers); customer records (such as password in hashed form and, for paid users, limited billing records); internet or other network activity (such as usage and interaction data); approximate geolocation (city/region level, from IP address); audio/electronic information (generated narration audio and the content you submit); inferences drawn to personalise learning content; and, for minors, age information.

We collect this information for the business and commercial purposes described in Section 3, and disclose it to the categories of service providers described in Section 4.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of consumers under 16 years of age.

California residents (and residents of other U.S. states with comparable laws) have the right to know/access, to delete, to correct, and to opt out of sale/sharing (not applicable here as we do not sell or share), and the right not to receive discriminatory treatment for exercising these rights. To exercise these rights, email support@vidyak.com. We will verify your request as described in Section 13. You may use an authorised agent to submit a request on your behalf with proper authorisation.

15.3 India (DPDP Act, 2023)

Data Fiduciary: SAAGERS NEXT PRIVATE LIMITED, at the address above.

We process your personal data on the basis of your consent or for legitimate uses permitted under the DPDP Act. You have the right to access, correct, complete, update, and erase your personal data, the right to grievance redressal, and the right to nominate another individual to exercise your rights in the event of death or incapacity. Where processing is based on consent, you may withdraw it at any time with effect for the future.

For users below 18, we process personal data only with the involvement and consent of a parent or legal guardian, obtained through the account-creation checkbox described in Section 9.3, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, or processing likely to cause a detrimental effect on a child's well-being.

You may contact our Grievance Officer (Section 18) with any complaint. If your complaint is not resolved to your satisfaction, you may approach the Data Protection Board of India.

16. Automated Processing and Personalisation

The Service uses automated systems to generate educational content in response to your prompts, and to adapt the depth, explanation style, difficulty, and narration language of that content to the preferences you set and to your own learning activity.

This personalisation affects only how educational material is presented to you. It does not produce legal effects or similarly significant effects concerning you, it is not used to make decisions about eligibility, pricing, or access, and it is not used for advertising or to build marketing profiles. You can change or turn off personalisation signals in your settings, and you can contact us to ask about the logic involved.

AI-generated educational content can contain errors — please see our Terms of Service for important accuracy disclaimers.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect, and we will update the "Last updated" date above. Where required by law, we will obtain your consent to material changes. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy, except where consent is required.

18. Contact Us and Grievance Officer

For any question, request, or complaint about this Privacy Policy or your personal data:

Email: support@vidyak.com

Grievance Officer / Privacy contact: SAAGERS NEXT PRIVATE LIMITED Kasba Jana, Auraiya, Uttar Pradesh 206129, India Attn: Grievance Officer Email: support@vidyak.com

We will acknowledge complaints promptly and aim to resolve them within the timeframes required by applicable law.