Privacy Policy

Last updated: 17 October 2026 · Version 2.2 · Built to align with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025

This Privacy Policy explains how Twor Consulting Engineers Private Limited ("Company", "we") collects and uses personal data through AI GurukulZ (gurukulz.com), including data belonging to students who are minors.

1. Who this policy covers, and our role

It covers Institutions (schools, coaching institutes, colleges), their teachers and administrators, students who access AI GurukulZ through an Institution, and individuals who sign up directly: adults, and children whose parent or guardian has approved the account.

For people who sign up directly, including children whose parent or guardian has approved, the Company is the Data Fiduciary. In most Institution deployments, the Institution is the Data Fiduciary for its students’ personal data — it determines the purpose and means of processing — and the Company acts as a Data Processor on the Institution’s behalf, under the Institution Agreement. Obligations such as breach notification, proof of consent, and grievance redress towards data principals rest primarily with the Data Fiduciary, with the Company’s support as Processor.

2. What we collect

• Account data: name, email, role, Institution affiliation, and a securely hashed password.
• Content you or your Institution upload: curriculum, notes, photos, scans and PDFs of your own material, question banks, and similar material. We also record that you confirmed, once, that you have the right to use it.
• Consent records: the date, the version of the wording, and the IP address and device details when you gave the one-time upload confirmation. For a child’s account, also the consent given by the parent or guardian: their name and email, the date, the version, and their IP address and device. We use your date of birth only to check your age when you sign up, and do not keep it.
• Outputs: the notes, quizzes, lectures, sketches and images the AI creates for you.
• Learning data: your interactions with the AI Teacher/Tutor/Assessor, progress and assessment results, and your place in each recorded lecture, used to power the learning features you signed up for.
• Live-class transcript: the text of what you and the AI Teacher say in a live class. We do not store audio or video of you. Your voice is turned into text as you speak and is not kept.
• Usage and security logs: timestamps, errors and access logs, used to keep the service secure and reliable.
• Support data: what you send us when you write to us.
• We do not knowingly collect more personal data than is necessary to provide the learning features you or your Institution have enabled. Please do not upload other people's personal data (for example, a scan that shows someone else's name, phone number or marks) unless you are entitled to.

3. Children’s data — verifiable parental consent

Under the Digital Personal Data Protection Act, 2023, anyone under 18 is a “child,” and processing a child’s personal data requires verifiable consent from a parent or lawful guardian.

• Institution-mediated consent. Where a student accesses AI GurukulZ through their school, coaching institute, or college, that Institution is responsible for obtaining the necessary parental/guardian consent as part of its own enrolment process, and represents to us that it has done so before creating student accounts on AI GurukulZ. We keep a record of each Institution’s confirmation.
• Direct sign-up by a child, with a parent’s or guardian’s approval. When you sign up directly, we ask for your date of birth. We use it only to check your age and do not keep it. If you are under 18, we do not create the account yet. We email your parent or guardian a private link, valid for 7 days. The page tells them what we collect and why. If they approve, by giving their name and ticking a declaration that they are the parent or lawful guardian and consent to our processing the child’s personal data, we create the account and record the consent (date, version, the parent’s name and email, IP address and device). If they decline or do not respond, nothing is created and the details we held are erased. While a request is waiting, we hold the sign-up details for up to 7 days only, so that we can create the account if it is approved. At present we check that the person approving can open the email address given; we do not verify parental identity in any other way. We will add stronger methods, for example age or identity tokens issued by government-approved services, when they are available to us, and update this policy.
• Withdrawing consent. A parent or guardian can withdraw consent at any time using the link in the approval email. Withdrawing deletes the child’s account and everything in it, as described in Section 8.
• No behavioural monitoring or targeted advertising directed at children. We do not use a child’s data to build behavioural profiles for advertising, we do not track children for that purpose, and AI GurukulZ does not show advertising to student or child accounts.
• If you believe a child has an account without a parent’s or guardian’s approval, write to us at the address below and we will review it and remove it if needed.

4. Consent and your choices

We process your personal data on the basis of your consent, given by a clear affirmative action when you create an account after seeing this notice (for a child, given by the parent or lawful guardian; for students of an Institution, as described above). When you first upload study material, we also ask for a one-time confirmation that you have the right to use it, and we record it (Section 2). You may withdraw consent at any time: delete your account in Settings (Section 8), or write to grievance@gurukulz.com; we act on a written request within 30 days. A parent or guardian can withdraw a child’s consent with the link in the approval email. Withdrawing consent for the core service means we can no longer run your account. If we add optional uses that are separate from the core service, such as marketing email, we will ask for your consent to those separately.

5. How we use content and data

We use uploaded content and usage data solely to provide the AI GurukulZ service to the uploading Institution and its users — generating AI explanations, assessments, lectures and progress analytics. We do not use your content, Outputs or student data to train AI models, and we do not sell personal data. Lectures made from your own notes are private to your account; lectures on general topics may be shared with other Learners and contain no personal data.

6. Who processes your data, and where

Our servers, including the servers that run the AI Teacher, are located in India. We share data with sub-processors only as necessary to operate AI GurukulZ, under contractual confidentiality obligations, and with authorities where required by law:

• Sarvam AI (India): turns speech into text and text into voice during live classes and recorded lectures.
• Anthropic (United States): its Claude model writes the AI Teacher's explanations and answers from the text of your questions and lesson material.
• Google (Gemini): reads scanned pages and images you upload so their text can be used, helps write text, and creates images, sketches and video for lessons.
• OpenAI (United States): reads scanned pages and images you upload so their text can be used, helps write text, and creates images and video for lessons.

This means the text of your questions, the content of pages and images you upload, and lesson content may be transferred outside India. These providers use it only to generate a response and, under their standard commercial terms for business and API use, do not use it to train their models, and keep it only for a short period (typically up to 30 days) to detect abuse. The DPDP Act's cross-border transfer provisions (Section 16) are subject to a phased timeline set by the Central Government, and we will update this section as they are notified. This list may change as we change providers; we will keep it current.

7. Your browser

AI GurukulZ keeps your sign-in and a few display settings in your browser's storage. We do not use advertising trackers. Our pages load fonts from Google Fonts, so your browser contacts Google when a page opens, and the classroom loads a software library from the jsDelivr network. These providers can see your IP address and browser details under their own policies.

If you sign in with your mobile number or with Google, that step is handled by Google's Firebase authentication service. Your browser loads scripts from Google, and Google processes the phone number or Google account details needed to confirm it is you. We use this only to verify your identity.

8. Data retention and deletion

We keep account and content data for as long as your account or your Institution's subscription is active, plus a reasonable period for legal and operational purposes thereafter. Live-class transcripts and lecture progress are kept until you or we delete them, or your account is deleted.

You can delete any file, topic or course yourself in AI GurukulZ. When you do, we remove its stored files, saved readings and cached copies from our live systems within 7 days. Backups are overwritten within 90 days and are not used for anything else in the meantime.

Deleting your account yourself. A learner who signed up directly can delete their account at any time in the dashboard: Settings → Delete my account. We confirm it is you with a code sent to your email (or, if you signed up only with a mobile number, by asking you to type DELETE and your mobile number). We then erase your profile, courses, uploaded files, tests, answers, progress, recordings and live-class transcripts, and remove your sign-in. A parent or guardian who approved a child’s account can withdraw consent at any time with the link in the approval email, which deletes the account in the same way. Accounts created by an Institution are managed by the Institution; ask it to delete them, or write to us. You may also write to us at any time, and we act on a verified request within 30 days.

What we keep after deletion. We keep a record that consent was given, so that we can prove it if we are asked: the date, the version of the wording, the IP address and device details and, for a child’s account, the child’s name and email and the parent’s or guardian’s name and email. We also keep limited billing, security, complaint and audit records for as long as the law requires. We use these records only for those purposes, and remove them once we no longer need them to meet a legal duty or to deal with a claim.

9. Data security and breaches

We apply reasonable technical and organizational safeguards to protect personal data, including password hashing, encryption in transit and access controls. No system is completely secure. If a personal data breach affects you, we will tell you without undue delay and, where the DPDP Rules require, report it to the Data Protection Board of India within 72 hours of becoming aware of it.

10. Your rights

Subject to applicable law, you (or, for a student, their parent/guardian or Institution) may ask for a summary of the personal data we hold and how we use it, ask us to correct or delete it, withdraw consent, seek redress of a grievance, and nominate another person to exercise these rights if you die or cannot act. Contact us as described below; we may need to verify your identity first.

11. Grievance Officer

As required under the DPDP Act and the IT Rules, 2021: R.V. Angarakhe, Compliance & Grievances Manager, grievance@gurukulz.com. We aim to acknowledge grievances within 24 hours and resolve them within 15 days. If you have used this process and your matter is eligible, you may approach the Data Protection Board of India.

12. Changes to this policy

We may update this Privacy Policy from time to time; material changes will be notified via the AI GurukulZ platform or email, and the date and version above will change.

13. Contact

Twor Consulting Engineers Private Limited, VIOS Towers, 4th Floor, Off Eastern Express Highway, Sewri-Chembur Road, New Cuffe Parade, Mumbai 400037, Maharashtra, India. grievance@gurukulz.com. Jurisdiction: Courts at Mumbai, Maharashtra.