Privacy Policy

Gradis is a service for children, and we take that responsibility seriously. This policy explains what we collect, why, who we share it with, and the rights you have over it. It is written to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law.

1. Who we are

Gradis Private Limited is the data fiduciary for the personal data described here. Our registered office is at Tower 5, 2301, Lodha Woods, Kandivali East, Mumbai 400101. Contact for privacy questions: founder@gradis.ai.

2. Parental consent for children's data

Gradis is used by children aged 8 to 13. The account is created and held by a parent or legal guardian, who provides consent at signup for their child's use of the service. The child cannot create an account directly. The parent is identified by the email address and phone number captured at signup, both of which we use for billing and for direct communication about the child's use of the service. We do not process a child's data for any purpose other than running the service the parent has signed them up for.

You can withdraw consent at any time by cancelling your subscription and writing to founder@gradis.ai to request deletion of your child's data.

3. What we collect

From parents

• Name, email address, phone number.
• Payment details handled by PhonePe Payment Gateway (we do not store card or UPI numbers ourselves).
• Any messages you send to our support email or WhatsApp.

From children

• First name and age (as provided by you at signup).
• The conversations they have with the AI coach.
• The artifacts they create on the platform (writing, drawings, code, audio recordings if they choose to record).
• Activity data: when they log in, how long they spend, which sections they use.

4. Why we collect it

• To run the service: personalise the AI coach, generate reports for parents, save the child's work.
• To bill parents and prevent fraud.
• To send parents updates about their child's activity on Gradis (WhatsApp, email).
• To improve the product. We use aggregated, de-identified data to study what works and what doesn't.
• To meet legal obligations (tax records, audit, response to lawful requests).

5. What we never do

• We do not sell your data or your child's data to anyone.
• We do not share an identifiable child's conversations or artifacts with advertisers, brokers, or any third party for marketing.
• We do not use your child's content to train AI models, our own or anyone else's.
• We do not show your child advertising.
• We do not add you to mailing lists you did not sign up for.

6. Who we share data with (and why)

We use a small number of trusted service providers (sub-processors) to run Gradis. They process data on our instruction only.

• Supabase (database, authentication, storage). Data stored in Supabase's infrastructure in Asia Pacific.
• Anthropic (Claude language model, used by the AI coaches). Conversations with the AI are sent to Anthropic's API for processing. Anthropic does not use API inputs to train its models. Inputs may be retained for up to 30 days for abuse monitoring and are then deleted.
• OpenAI, used for two narrow purposes: (a) content-safety moderation of text a child types, to catch unsafe content before it reaches the AI coach; and (b) transcribing audio when a child or parent uses the voice-record option (via OpenAI's gpt-4o-mini-transcribe model). OpenAI does not use API inputs to train models. Audio is processed for transcription and not retained by OpenAI past the API call. Not used for the coaching conversation itself.
• PhonePe Payment Gateway (RBI-authorised payment aggregator, payment processing). When you subscribe, payment details are handled by PhonePe Payment Gateway directly. PhonePe is a sub-processor of card and UPI data.
• AiSensy (WhatsApp Business message delivery). Parent phone numbers and the message body are shared so Gradis can send updates over WhatsApp.
• Vercel (application hosting). Standard request logs.
• Resend or equivalent (transactional email). Parent email addresses + email contents.

Some of these providers are located outside India (Anthropic, OpenAI, Vercel, Resend are based in the United States). Your account creation and use of Gradis is your consent to these transfers, which we make for the limited purposes of running the service. This list of sub-processors is current and complete as of the effective date of this policy. If we add a new sub-processor that touches your data or your child's data, we will update this policy first.

7. How long we keep data

We keep your account data for as long as your subscription is active, plus the period required for tax, audit, and legal compliance (currently 8 years for financial records under Indian law). When you cancel and request deletion, we delete your child's conversational content and artifacts within 30 days, and retain only the minimum financial records required by law. The analytics records described in section 11 are deleted at the same time.

Children's conversational data and artifacts are stored separately from parent payment data. Payment information is held only by PhonePe Payment Gateway; we never see or store card or UPI numbers.

8. Security

We use encryption in transit (TLS) and at rest. Access to production data is restricted to a small number of personnel with a business need. We do not store credit card or UPI numbers ourselves.

9. Your rights

Under the DPDP Act, you have the right to:

• Access the personal data we hold about you and your child.
• Ask us to correct inaccurate or outdated data.
• Withdraw consent and ask us to erase data we no longer need.
• Lodge a grievance with our Grievance Officer (see below) or the Data Protection Board of India.

10. Grievance Officer

Under the DPDP Act, our Grievance Officer is the founder, Prakhar Bhandari, reachable at founder@gradis.ai. We will acknowledge any grievance within 7 working days and respond within 30 days.

11. Cookies and analytics

Gradis uses two narrow categories of cookies. We do not use advertising cookies, social-media trackers, or third-party marketing pixels.

Strictly necessary cookies

• Authentication session (`sb-*` cookies set by Supabase Auth): stores your signed-in session so you don't have to re-enter your password on every page. Expires when you sign out or after a period of inactivity. Without this cookie the service cannot function. You cannot opt out without losing the ability to sign in.
• CSRF / security tokens: short-lived cookies set by our framework to prevent cross-site request forgery on sensitive actions like cancelling a subscription. Cleared at the end of each browser session.

Analytics cookies (our own, first-party)

We measure how people find Gradis and how far they get, so we know which of our efforts are worth continuing. We do this ourselves. We do not use Google Analytics, Facebook Pixel, or any advertising or social media tracker, and we do not sell or share this information with anyone.

What we set. One cookie named `gradis_ft`, which lasts 180 days. It holds a random identifier for your browser, which campaign or website brought you to us, the address of the page that linked to you with anything after the question mark removed, and the date you first arrived.

What we record. When something meaningful happens, for example a page is opened, an account is created, a first session begins, or a subscription starts, we save the name of that step, the time, the page address, and where you originally came from. We do not record names, email addresses, phone numbers, or anything your child writes or builds. Those never enter these records.

Why there is an identifier at all. Without it we cannot tell whether one person visited four times or four people visited once. When a parent creates an account, we attach that original source to the account, so we can see which of our efforts actually helped a family find us.

Where it goes. Into our own database, on the same infrastructure as the rest of Gradis. No analytics company receives it. We do not follow you or your child around other websites. This cookie works only on Gradis pages.

Our landing page also uses Vercel Analytics, which counts page views without setting any cookie and without identifying anyone.

If you would rather not. Blocking this cookie in your browser changes nothing about how Gradis works. Everything keeps running.

How to disable cookies

You can clear or block cookies through your browser settings. Blocking strictly-necessary cookies will sign you out and prevent you from using Gradis. Blocking analytics cookies has no effect on functionality.

12. Changes to this policy

We will update this policy as the service evolves. Material changes are communicated by email and posted here with a new effective date.