Privacy Policy

1 Introduction

EduuMatch ("we", "us", "our") operates a tutor discovery platform based in Bokaro, Jharkhand, India. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website and services. It is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (IT Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By using EduuMatch, you consent to the practices described in this policy. If you do not agree, please do not use our platform.

2 Information We Collect

2.1 From Parents / Students

• Name and contact details (phone number, email)
• Area / locality
• Student class, subjects, and preferred timings
• Any additional requirements shared in contact requests
• Communication preferences

2.2 From Tutors

• Name, phone number, email, gender
• Area, locality, and preferred travel radius
• Qualifications, experience, subjects taught, classes, and boards
• Fee expectations, teaching mode, availability
• UPI details and bank information (for payment features)
• Verification documents (Aadhaar, PAN, certificates)
• Profile photo and media

2.3 Automatically Collected

• IP address, browser type, device information
• Pages visited, search queries, and interactions
• Referral source (how you found EduuMatch)
• Session activity and timestamps

2.4 Sensitve Personal Data

In compliance with the DPDP Act, 2023, certain categories of personal data require additional protection. Government IDs (Aadhaar, PAN), financial information (bank details, UPI), and biometric data (profile photos used for verification) are classified as sensitive personal data. We process this data only with your explicit consent and for specified purposes.

3 Legal Basis for Processing

Under the DPDP Act, 2023, we process your personal data on the following legal bases:

4 How We Use Your Information

• Tutor Profiles: Display tutor information on the platform so parents can discover and contact tutors directly.
• Contact Requests: Forward parent contact requests to the relevant tutor.
• Verification: Verify tutor identities, qualifications, and credentials.
• Platform Improvement: Analyze usage to improve the platform and user experience.
• Communication: Send verification updates, platform notifications, and service-related messages.
• Payment Processing: Process lead unlock fees, subscription payments, and refunds through Razorpay.
• Trust & Safety: Detect and prevent fraud, abuse, and policy violations.

5 Data Sharing & Disclosure

We may share limited information in these specific situations:

• Tutor-Parent Discovery: When a parent views a tutor profile, the tutor’s public profile information (name, subjects, area, qualifications) is displayed. Phone/email are only shared after the tutor unlocks the lead.
• Payment Processing: Payment information is shared with Razorpay (PCI-DSS compliant) for transaction processing. We do not store card details or UPI PINs.
• Hosting & Infrastructure: Data is stored on Render (cloud infrastructure). These providers have data processing agreements compliant with Indian data protection laws.
• Legal Compliance: We may disclose information if required by law, regulation, or a valid legal process issued by a competent Indian authority.
• Business Transfer: In the event of a merger, acquisition, or sale of assets, user data may be transferred with notice to users.

5.1 International Data Transfers

Your data may be stored and processed on servers located outside India (e.g., Render’s US-based infrastructure). In compliance with the DPDP Act, 2023, we ensure that any cross-border data transfer is subject to appropriate safeguards and contractual clauses that provide a level of protection equivalent to Indian law.

6 Data Storage & Security

• Encryption at Rest: All personal data is encrypted at rest using AES-256 encryption.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Password Security: Passwords are hashed using bcrypt with a cost factor of 10.
• Access Controls: Access to personal data is restricted to authorized personnel only, with role-based permissions.
• Audit Logging: All access to sensitive data is logged and regularly reviewed.
• Incident Response: We have a documented incident response plan for data breaches, as required by the DPDP Act, 2023.

While we implement reasonable security measures, no internet-based service is 100% secure. In the event of a data breach, we will notify the Data Protection Board of India and affected users within 72 hours as required by the DPDP Act, 2023.

7 Cookies & Tracking

EduuMatch uses cookies and similar technologies for:

• Essential Cookies: Maintaining user sessions (login state), CSRF protection.
• Functional Cookies: Remembering user preferences and settings.
• Analytics Cookies: Understanding platform usage to improve our services (anonymized).

We do not use advertising cookies, tracking pixels, or third-party behavioural tracking. You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

For complete details, see our Cookie Policy.

8 Your Rights Under DPDP Act, 2023

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you and how it has been processed.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Right to Grievance Redressal: File a complaint regarding data processing practices.
• Right to Withdraw Consent: Withdraw consent for data processing at any time, without affecting the lawfulness of processing before withdrawal.
• Right to Data Portability: Request transfer of your data to another service provider in a structured format.
• Right to be Informed: Be informed about the purpose and legal basis for data processing.

To exercise any of these rights, contact us through the WhatsApp channel on our website or email our Grievance Officer. We will respond within 30 days as required by the DPDP Act, 2023.

9 Data Retention

Upon account deletion or data erasure request, we will remove your personal data within 30 days, except where retention is legally required (e.g., financial records for 7 years).

10 Children’s Privacy

EduuMatch is designed for parents and tutors. We do not knowingly collect personal information from children under 18 without parental consent. If a child’s data is inadvertently collected, it is done so through the parent’s account and with the parent’s consent. Parents may request deletion of their child’s data at any time.

11 Payment & Financial Data

All payments on EduuMatch (lead unlocks, subscriptions) are processed through Razorpay, a PCI-DSS compliant payment gateway. EduuMatch does not store:

• Credit card or debit card numbers
• UPI PINs or bank account passwords
• CVV or OTP codes
• Any payment credentials that could be used to initiate unauthorized transactions

We store only transaction references (Razorpay payment IDs, order IDs) and basic billing information for reconciliation and dispute resolution.

12 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated with at least 15 days’ notice via email and/or platform notification. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

13 Grievance Officer & Contact

13.1 Grievance Officer (DPDP Act, 2023 & IT Rules, 2021)

In compliance with the Digital Personal Data Protection Act, 2023 (Section 13) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Grievance Officer for EduuMatch is designated to address:

• Data protection and privacy complaints
• Requests to exercise data rights (access, correction, deletion, portability)
• Consent withdrawal requests
• Platform content complaints

13.2 Contact Information

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to file a grievance:

• Grievance Officer: EduuMatch Privacy Team
• Email: info@eduumatch.com (recommended)
• Response Time: Within 30 days as required by the DPDP Act, 2023