Legal

Privacy policy

Last updated: 12 October 2026

Draft pending legal review. This document describes how this website actually works today. It has not yet been reviewed by a lawyer, and items in [square brackets] must be completed by the operator before public launch.

This policy explains what personal data the Heramb.study website collects, why, and what you can do about it. It covers this website only — the invite-only learning app will have its own notice before anyone uses it.

1. Who is responsible

The website is operated by [OPERATOR LEGAL NAME — to be completed before launch] ("we", "us"), which decides how and why your personal data is processed (a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023, and a "controller" under the EU/UK GDPR). Contact: [CONTACT EMAIL — to be completed before launch], or the contact form. Grievance officer: [NAME AND CONTACT — to be completed before launch].

2. What we collect

When	Data	Why
You request an invite	Email; optionally your name; role; country; main use case and optional note; for teachers and institute owners, optional institute name and size; your consent choices with date and version; the campaign tag and on-site page you came from, if any.	To review and manage invitations; to send product updates only if you opted in.
You apply for an institute pilot	Your name, role, work email, optional phone; institute name, city, country, approximate size, exams, test frequency, optional current software, preferred start, optional price-comfort range and notes; date.	To assess, arrange and follow up on a pilot. The price question only informs our pricing plans.
An institute joins the founding programme	Institute name, city and type; contact name, role, and phone and/or email; whether they want the weekly summary email (with date); how they heard of us; the institute code and founding-seat number; dates of joining and last activity; optional value feedback (minutes saved, what it helped with, a short note).	To run the founding programme: issue the code, show the institute its dashboard, send the weekly summary if requested, and contact the institute about its use of Heramb. Contact details are visible only to the operator.
A teacher or student uses a tool connected to an institute code	Counts only: how many tests were analysed, report links created and shared, reports opened and saved, “useful / not useful” taps and reminders added, per day; plus a random device identifier created in the browser, stored only as a one-way hash, to count distinct devices. Never names, roll numbers, marks or topic names.	To show the institute (and the operator) whether Heramb is being used and is useful. Anyone can switch this off on their device with the “Share anonymous usage counts” switch on the institute dashboard (teachers) or the My progress page (students).
A connected teacher taps “Share with the head” after analysing a test	Class-level numbers only: batch name, test name and date, number of students, class average, and per chapter the class average, how many attempted and how many scored below 50%. No student names, roll numbers or individual marks.	To show the institute head each batch's results on the institute dashboard, and — combined with at least four other institutes in the same city, without naming anyone — a city average per chapter. Kept with the institute's founding-programme records and deleted with them (including from city averages).
You send a message	Name, email, topic, message, date.	To read and reply to your message.
You submit any form	A one-way, salted hash of your IP address and email, stored briefly in a counter.	To limit abuse and automated spam. Raw IP addresses are not stored in our database.
You visit any page	Standard server logs kept by our hosting provider (IP address, browser, page requested, time).	Security, reliability and debugging.
Only if you click "Allow analytics"	Pseudonymous usage data via Google Analytics 4 (pages viewed, device type, approximate location, and a small set of events such as "invite form started").	To understand which pages and tools are useful.

We never send names, email addresses or anything you type into our free tools to analytics. The free tools (diagnostic, analysers, report template, class tracker) run entirely in your browser; their contents are not sent to us — with two exceptions you choose explicitly: importing marks from a Google Sheet link (our server downloads the shared sheet and passes it straight to your browser without storing it), and importing aphoto or PDF of a marksheet (sent, after you tick a consent box, to our AI provider to read the table; not stored by Heramb). Excel and CSV files are read in your browser and never uploaded.

3. Legal basis

Consent — for processing your invite request, pilot application and contact message (you confirm this with a checkbox), for product-update emails (a separate, optional checkbox that you then confirm from an email — "double opt-in"), and for analytics.
Legitimate interests (GDPR) / reasonable purposes for security (DPDP) — for rate limiting, fraud prevention and server logs.

You can withdraw consent at any time; this doesn't affect processing that already happened.

4. Service providers and international transfers

We use these processors, which handle data on our behalf under their own terms and security measures:

Google Cloud / Firebase (Cloud Firestore) — stores invite requests, contact messages and rate-limit counters. Database region: [REGION — e.g. asia-south1 (Mumbai); to be confirmed].
Hosting provider — [Vercel or Firebase App Hosting — to be confirmed], which serves the website and keeps server logs.
Google Analytics 4 — only if analytics is enabled on this site and you consent.
AI model provider — only if AI summaries are enabled. When you press “Write my summary”, we send topic names and class-level averages and counts — never names, roll numbers or individual marks — to the configured provider (for example Anthropic) to write the text. Requests are not used by us for anything else.
AI model provider (marksheet import) — only if photo/PDF import is enabled and you tick its consent box: the image or PDF you upload is sent to the provider to read the marks table and is not kept by Heramb. Use roll numbers rather than names on the sheet where possible.
Google — when you import from a Google Sheet link, our server requests that sheet from Google as a CSV file.
Resend — if email is enabled, sends the acknowledgement of your invite request, the confirmation link for product updates, and pilot notifications to us. It receives your email address and the message content.

These providers may process data outside your country, including in the United States. Where GDPR applies, we rely on the providers' standard contractual clauses or other approved transfer mechanisms.

5. How long we keep data

Invite requests: until invitations for the early-access programme close, then [24 months — to be confirmed], or sooner if you ask us to delete them.
Contact messages: up to [24 months — to be confirmed] after the conversation ends.
Pilot applications: for the duration of pilot discussions and any pilot, then [24 months — to be confirmed], or sooner on request.
Founding-programme records (institute contact details, usage counts, value feedback): while the institute takes part, then [24 months — to be confirmed], or sooner on request — deletion removes the institute and all its counts.
Rate-limit counters: automatically deleted, typically within a day.
Analytics data: retention set to the shortest available period in Google Analytics (2 months).

6. Security

Data is encrypted in transit (HTTPS) and at rest by our database provider. Our database denies all direct access from browsers; every submission is validated on our servers, and access to stored data is limited to the operator. No system is perfectly secure, and we can't guarantee absolute security. If a personal-data breach affects you, we'll notify you and the relevant authority as required by law.

7. Your rights

Depending on where you live, you can:

access the personal data we hold about you, and get a copy;
correct or complete inaccurate data;
have your data erased;
withdraw consent, including for product-update emails (every such email includes an unsubscribe link, and the confirmation email does too);
under the DPDP Act, nominate another person to exercise your rights and seek grievance redressal;
under GDPR, restrict or object to processing and receive data in a portable format;
complain to a regulator (in India, the Data Protection Board of India; in the EU/UK, your local data-protection authority).

To make a request, use the contact form and choose "Privacy or data request", from the email address the request concerns. We may need to verify your identity. We aim to respond within 30 days.

8. Cookies and local storage

Student report links and “My progress” (only if used): a personal report link contains the report itself after the “#”, which browsers never send to a server — so Heramb doesn't receive or store it. Reports a student saves are kept in their own browser on that device. Anyone with a link can open it, so teachers should send each link only to that student or parent.
Class progress tracker (only if you use it): the classes and test marks you save are stored in your own browser's local storage on that device. They are never sent to us, we can't see or recover them, and clearing your browser data deletes them. Use the tracker's Export button to keep a backup.
Founding programme (only if used): the institute code a teacher connects with, a random device identifier and the usage-count switch are kept in local storage; a linked Google Sheet address is kept there if you choose “Remember this sheet”; a paper map (which questions belong to which chapter) and the report language are remembered there; and student WhatsApp numbers a teacher chooses to add for one-tap sending are kept only there — never in report links and never sent to us. The operator's dashboard sign-in uses one strictly necessary cookie (heramb_owner).
Strictly necessary: your analytics choice is saved in your browser's local storage so we don't ask again. If the site is installed or visited repeatedly, a service worker stores copies of pages on your device for offline use.
Analytics (optional): Google Analytics cookies are set only after you click "Allow analytics". Advertising storage is never enabled by that choice.
Advertising: this site does not currently show ads. If that changes, we'll update this policy and ask for any required consent first.

To change your analytics choice, clear this site's data in your browser settings; you'll be asked again.

9. Children and educational data

Under the DPDP Act, a "child" is anyone under 18. We don't knowingly accept invite requests from children without a parent's or guardian's involvement — we ask under-18s to have a parent or guardian submit the form. The public forms are not designed for student records; please don't include marks, assessment results or other information about students. If you believe a child has given us data without consent, contact us and we'll delete it.

10. What we don't do

We don't sell or rent personal data.
We don't use your data for targeted advertising or behavioural tracking of children.
We don't make automated decisions with legal or similarly significant effects from website data.

11. Changes

We'll update this page when our practices change and revise the "last updated" date. Significant changes will be highlighted on the site, and where required we'll ask for your consent again.