Privacy Policy
Last updated: June 2026 · DPDP Act 2023 compliant
1. Data Fiduciary
Konda Academy Pvt Ltd is the data fiduciary under India's Digital Personal Data Protection (DPDP) Act 2023. Contact: support@konda.academy
2. Data We Collect
WhatsApp phone number, name, class, board, language preferences, questions asked, quiz/exam results, subscription and payment records, voice notes (transcribed, not stored), and photos you send (processed, not stored). Web portal: email, password hash, and the same academic data.
3. Legal Basis
We process data under your explicit consent (obtained via WhatsApp onboarding and web registration), and to perform the service contract. You can withdraw consent at any time by messaging /delete to Vani AI on WhatsApp or via your web portal settings.
4. How We Use Your Data
To answer your questions, personalize tutoring to your board and class, generate progress reports, send study reminders, process payments, and improve our AI models (using aggregated/anonymized data only).
5. Data Sharing
We share data with: Meta (WhatsApp delivery), Anthropic/OpenAI/Google (AI inference — minimized data, no training on your data per their DPA), Razorpay (payments), Pinecone/Render/Sentry (infrastructure). All are bound by data processing agreements.
6. Cross-Border Transfers
AI inference data is transferred to servers in the USA (Anthropic, OpenAI) and EU. We use standard contractual clauses and vendors' DPAs as safeguards. We prefer Gemini (Google, India region) for DPDP residency where possible.
7. Retention
Account data: until you delete your account + 90 days. Payment records: 7 years (legal requirement). Voice/image: processed in memory, not stored. Conversation history: last 6 turns only.
8. Your Rights
Under DPDP Act 2023: right to access your data, right to correction, right to erasure, right to withdraw consent, right to grieve. Contact grievance@konda.academy or message /delete on WhatsApp.
9. Children's Privacy
We do not serve ads, sell data, or use dark patterns for minors. For users under 18, we require verifiable parental consent during onboarding.
10. Security
TLS in transit, AES-256 at rest, bcrypt password hashing, HMAC webhook verification, security review conducted June 2026.
