DPDP Act 2023
Most of our users
are children.
That single fact changes what the Digital Personal Data Protection Act, 2023 requires of us — and it is the reason this page exists as its own notice rather than a paragraph inside the privacy policy.
Updated 2 August 2026
This notice is for the person who scrutinises it: a parent deciding whether to trust us, or a school's legal or IT function. Read it together with the Privacy Policy. Where we do not yet meet a standard, this page says so rather than implying we do.
Roles under the Act
Veranox Systems Private Limited is the Data Fiduciary for personal data processed through Gradium Prep. The student — and, where relevant, the parent or guardian — is the Data Principal. Groq, Google, Supabase, Vercel, Cloudflare and Razorpay act as our processors for the narrow purposes set out in the Privacy Policy.
Children's data — Section 9
Section 9 of the Act sets three obligations where the Data Principal is a child (under 18). Stated plainly, with our current position on each:
- ·Verifiable parental consentis required before processing a child’s data. See section 03 — this is the obligation we do not yet fully meet, and we say so.
- ·No tracking or behavioural monitoring of children. We do not do this. We measure academic performance on questions a student chose to attempt — that is service delivery the user asked for, not behavioural profiling. There are no advertising trackers, no cross-site tracking, and no third-party analytics on the learner surfaces.
- ·No targeted advertising directed at children. We run no advertising of any kind.
Where we currently fall short
Verifiable parental consent is not yet implemented.Today we ask a student to confirm they have a parent’s permission. That is a declaration, not verification, and the Act expects verification.
Until that is built, Gradium Prepshould be used with a parent or guardian’s active involvement, and a guardian can have all of a child’s data removed on request under section 08. We would rather publish this gap than let a compliance claim outrun the product.
Consent
We process personal data on the basis of free, specific, informed and unambiguous consent, given by clear affirmative action — creating an account, or submitting the waitlist form. Each consent is tied to a stated purpose. Consent can be withdrawn as easily as it was given, by emailing the address in section 09.
Purpose limitation and minimisation
Personal data is used only for the purpose it was collected for: signing you in, measuring where you stand, scheduling your revision, answering the question you asked, and reporting progress to a guardian you linked.
On minimisation, the product is deliberately thin: an email, a first name you choose, and an exam. No phone number, no address, no school, no date of birth, no government identifier. The AI features receive the question text only — never your identity or your history.
Data localisation and cross-border transfer
The AI answer and tutor features send question text to Groq and Google, whose processing happens outside India. The Act permits cross-border transfer except to countries the Central Government restricts; we will stop using any provider that becomes restricted.
Practice and Drill are graded entirely on your own device and involve no transfer at all — which is why they remain available, and free of this consideration, even when the AI features are not used.
Selective disclosure to parents
A guardian sees aggregate progress — readiness, consistency, chapter and capability strength — and never the raw record: not the questions asked, not individual wrong answers, not tutor conversations. This is minimisation applied to the people closest to the student, and it is enforced by what the parent surface is built to read, not by a promise.
Exercising rights
A student, or a parent or guardian acting for a child, may request access to their personal data, correction of it, erasure of it, or withdrawal of consent. Email the Grievance Officer and we will action it. Practice data held on the device can also be erased by the user at any time by clearing site data in the browser.
Grievance redressal
Grievance Officer: Uday Vamsidhar Volety, Veranox Systems Private Limited, Chennai, Tamil Nadu, India.
Email: uday@veranox.in. Target response: 3 working days. If you are not satisfied with our response, the Act gives you the right to escalate to the Data Protection Board of India.