Privacy Policy

1. Who we are

The Nirmaan student app and the nirmaan.education website are operated by Nirmaan Learning LLP, a limited liability partnership registered in India. Nirmaan Learning LLP is the data fiduciary (in some jurisdictions, the data controller) responsible for the personal data described in this policy, except where a school acts as the data fiduciary for its own students, as described in section 10.

2. What this policy covers

This policy applies to:

• the Nirmaan student app for Android, distributed on Google Play under the package name com.nirmaan.studentapp;
• the website at nirmaan.education, including the waitlist form, the contact form and the blog; and
• support conversations you have with us by email, phone or WhatsApp about the app or the website.

It does not cover any third-party website, service or app that we link to. It also does not cover the separate systems a school may run; if your school gave you your Nirmaan account, your school’s own privacy notice governs the records it holds about you.

In this policy, “you” means the person using Nirmaan — a student, a parent or guardian, or a teacher or school administrator. “We”, “us” and “Nirmaan” mean Nirmaan Learning LLP.

3. The short version

This summary is for convenience only. The sections that follow are the operative policy.

• Nirmaan is built for learners aged 10 and above. Because many of our users are children, we apply stricter rules to their data than the law’s minimum.
• We collect what we need to teach: your account details, the questions and work you submit, and how you progress through lessons.
• We ask for the microphone, camera, photos and files, and notifications. Each is optional, each is explained in the app before we use it, and the app still works if you say no — you simply lose that feature.
• We do not sell personal data. We do not show advertisements. We do not build advertising profiles, and we do not track children across other apps or websites.
• We keep your learning content for up to 24 months, then delete it automatically. You can ask us to delete it sooner at any time.
• You can delete your account and its data from inside the app at any time: Profile → Delete Account.

4. Information we collect

4.1 Information you give us

4.2 Learning content you submit

This is the heart of what Nirmaan does, so we describe it precisely. When you learn with Nirmaan we process:

• Text you type — the questions you ask the tutor, your answers to its questions, and your notes.
• Voice you record — when you speak to the tutor instead of typing, the app captures audio and converts it to text so the tutor can respond. Both the recording and its transcript are stored as part of your learning record, encrypted at rest, so the tutor can refer back to what you asked. We keep them for up to 24 months and then delete them automatically. You can ask us to delete them sooner at any time, and they are removed if you delete your account.
• Images you capture or upload — photographs of a textbook page, a worksheet or your handwritten work, so the tutor can read the problem you are stuck on. These are stored as part of your learning record, encrypted at rest, kept for up to 24 months and then deleted automatically. You can ask us to delete individual images sooner at any time, and they are removed if you delete your account.
• Your learning record — lessons started and completed, answers given, mistakes made, concepts diagnosed as weak, time on task, streaks and scores. This record is what allows the tutor to find your gaps and teach to them rather than starting from zero each session.

4.3 Information collected automatically

• Device and app information — device model, operating system version, app version, language and region settings, and general network type. We use this to make the app work correctly on your device and to diagnose problems.
• Diagnostics and crash data — if the app crashes or misbehaves, we record what the app was doing at the time and the technical error, so we can fix it.
• App activity — which screens and features you use and when. We use this to understand which parts of the product help students learn and which need work.
• An app instance identifier — a random identifier generated by the app so we can tie a session together. It is reset when you delete the app’s data or uninstall the app.
• Approximate location inferred from your IP address — at the level of country or region only, used for security, fraud prevention and to know which curriculum defaults to offer. The app does not request or collect precise GPS location.

We do not collect the Android Advertising ID, and we do not collect non-resettable hardware identifiers such as IMEI, IMSI, SIM serial number or MAC address. We do not link any persistent device identifier to your personal data.

4.4 Information about website visitors

When you visit nirmaan.education rather than using the app:

• If you join the waitlist, we store the email address or mobile number you enter, so we can tell you when the app is available.
• If you use the contact form, we store your name, email address, the role you select and your message, so we can reply.
• We record page views — the page path, the referring website’s domain and a random session identifier. We deliberately discard query strings from referrers so that this measurement does not pick up personal data.
• We use Google Analytics on the website to understand traffic in aggregate. Google Analytics is used on the public marketing website only. It is not used to profile children, and it is not part of the student learning experience.

5. Device permissions and why we ask

Android asks your permission before an app can use the capabilities below. Nirmaan requests each one only at the moment the feature needs it, with an on-screen explanation of what we will access and why, and only after you affirmatively agree. We do not collect any of this data in the background.

You can change any of these at any time in Android under Settings → Apps → Nirmaan → Permissions, or inside the app. Withdrawing a permission does not delete data already collected under it — to remove that, see section 14.

6. How we use information

We use personal data only for the purposes listed here:

• To teach. To generate explanations, questions, hints and illustrations tailored to you; to diagnose which concepts you have not yet understood; and to decide what to teach next.
• To maintain your account. To create and secure your account, sign you in, remember your preferences and sync your progress across sessions.
• To show progress. To produce progress summaries for you, and — where the account is a child’s, or where a school provisioned it — for your parent or guardian and your teacher or school.
• To support you. To answer your questions and resolve complaints.
• To keep the service safe. To detect and prevent abuse, fraud, unauthorised access and content that is unsafe for a young learner.
• To improve the product. To fix bugs, measure whether features actually help students learn, and improve our teaching content. We use aggregated or de-identified information for this wherever it is sufficient.
• To take payment. To process subscriptions and purchases, and to meet tax and accounting obligations.
• To comply with law. To meet legal, regulatory and enforcement obligations that apply to us.

If we ever want to use your information for a purpose that is not listed above, we will update this policy and, where the law requires it, ask for your consent first.

7. How the AI tutor handles what you tell it

Nirmaan teaches using large language models. Being clear about what that means for your data matters to us, so:

• What is sent. When you ask a question, the app sends the content of that question — your text, your transcribed speech, or the image you captured — together with the relevant part of your learning history, to an AI model provider that generates the tutor’s response. Each provider acts as our processor under contract and may use the data only to return that response to us.
• Who processes it. We use more than one AI model provider, and route a given request to whichever is best suited to it. Our providers are Google LLC (Gemini models), OpenAI, L.L.C. and Anthropic PBC (Claude models). We do not send your data to any other AI provider without updating this policy first.
• Training. We do not permit our AI model providers to use your conversations, your voice, your images or your learning record to train their general-purpose models, and our agreements with them prohibit it.
• What we do not send. We do not send your password, your payment details or your contact details to the model provider.
• Automated decisions. The tutor decides what to teach you next based on your answers. This is an automated decision, but it has no legal or similarly significant effect on you — it changes only which lesson comes next, and you can always override it by choosing a different topic. Nirmaan does not grade you for any official purpose, and we do not use your data to make decisions about admissions, credit or employment.
• AI output can be wrong. The tutor can occasionally produce an inaccurate explanation. Please treat it as a study aid rather than an authority, and tell us at hello@nirmaan.education if you see something wrong or unsafe.

8. What we never do

• We never sell your personal data, and we never share it for any purpose that would facilitate its sale.
• We do not display advertisements in the app, and we do not include advertising SDKs in it.
• We do not use personal data for behavioural advertising and we do not build advertising profiles about anyone, adult or child.
• We do not track children or monitor their behaviour across other apps, websites or services, and we do not direct targeted advertising at children. Section 9(3) of India’s Digital Personal Data Protection Act, 2023 prohibits this, and we build to that standard everywhere we operate.
• We do not link persistent device identifiers to your personal data or to resettable identifiers.
• We do not read your contacts, SMS messages or call logs, and the app does not request those permissions.
• We do not collect precise location.
• We do not publicly expose anyone’s financial information or government identity documents.

9. When we share information

We share personal data only in the situations described below. Every service provider listed here is bound by a written contract to process data only on our instructions, to protect it, and to delete or return it when our relationship ends.

We may also disclose personal data:

• When the law requires it — in response to a valid order from a court, regulator or law enforcement authority. We review each request, disclose only what is legally required, and tell the affected person unless we are legally prohibited from doing so.
• To protect people — where we believe in good faith that disclosure is necessary to prevent serious harm to a child or another person, or to investigate fraud or a security incident.
• In a business transfer — if Nirmaan Learning LLP is involved in a merger, acquisition or sale of assets, personal data may transfer to the successor entity. That entity will remain bound by this policy, and we will notify you before your data becomes subject to a materially different policy.

10. Children, parents and schools

Nirmaan is intended for learners aged 10 and above. Most of our users are therefore children, and this section governs their data. Where it is stricter than any other section, this section applies.

10.1 Parental consent

India’s Digital Personal Data Protection Act, 2023 treats anyone under 18 as a child. Before we process a child’s personal data we obtain verifiable consent from a parent or lawful guardian. During sign-up we ask for the learner’s age. If the learner is a child, we require a parent or guardian’s contact details and a confirmation step carried out by that adult, and we keep a record of the consent given and when.

Where a school provisions accounts for its students, the school confirms to us that it has obtained the necessary parental consents, and the school acts as the data fiduciary for the records it directs us to process on its behalf.

10.2 Protections that apply to every child’s account

• No advertising and no advertising SDKs.
• No behavioural tracking, no cross-app or cross-site tracking, and no targeted advertising.
• No advertising identifiers collected.
• No public profiles, no open chat with other users, and no facility for a child to publish personal information to other users.
• No sale of data, and no sharing with any third party except the processors listed in section 9 who help operate the service.
• Only the data genuinely needed to teach the child is collected, and it is used only for that purpose.

10.3 Parental rights

A parent or lawful guardian may, at any time, ask us to show them the personal data we hold about their child, correct it, delete it, or stop processing it by withdrawing consent. Write to hello@nirmaan.education from the email address associated with the child’s account, or through the in-app parent options. We will ask a small number of questions to verify that you are the parent or guardian before we act, and we will respond within 30 days. Withdrawing consent will end the child’s ability to use Nirmaan, since we cannot teach without processing their learning data.

10.4 Other jurisdictions

Where the United States Children’s Online Privacy Protection Act (COPPA) applies, we obtain verifiable parental consent before collecting personal information from a child under 13, we collect no more than is reasonably necessary for the child to participate, we never condition participation on disclosing more than is necessary, and a parent may review or delete their child’s information and refuse further collection at any time. Where the EU or UK GDPR applies, we treat users below the applicable age of digital consent as children and rely on parental consent.

If you believe a child has given us personal data without the necessary parental consent, contact us at hello@nirmaan.education and we will delete it promptly.

11. Our legal bases for processing

Under the Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent, given freely, specifically and on being informed by the notice we present at sign-up and by this policy. For a child, that consent is given by a parent or lawful guardian. Certain processing — for example retaining invoices for tax purposes — is carried out to comply with legal obligations.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of a contract for operating your account and delivering lessons; consent for optional features such as the microphone, camera and notifications, and for children’s data; legitimate interests for securing the service and improving the product, balanced against your rights; and legal obligation where the law requires us to act. You may withdraw consent at any time without affecting processing carried out before you withdrew it.

12. How long we keep information

We keep personal data only as long as we need it for the purpose we collected it for, and then delete it or irreversibly anonymise it.

13. Your rights

You have the right to:

• Know and access — obtain a summary of the personal data we hold about you, how we process it, and the identities of everyone we have shared it with.
• Correct and complete — have inaccurate or incomplete data corrected or updated.
• Erase — have your personal data deleted, as described in section 14.
• Withdraw consent — at any time, as easily as you gave it.
• Nominate — under the Digital Personal Data Protection Act, 2023, nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Grievance redressal — have a complaint about our handling of your data answered, as described in section 19.
• Portability, restriction and objection — if you are in the EEA or UK, you also have the right to receive your data in a portable format, to restrict or object to certain processing, and to lodge a complaint with your local supervisory authority.

To exercise any of these, write to hello@nirmaan.education from the address on the account, or use the options in the app under Profile. We will verify who you are before we act, and we will respond within 30 days. There is no charge. If we cannot do what you asked, we will tell you why.

14. Deleting your account and data

You can delete your Nirmaan account and its associated data at any time. There are two ways to do it.

What gets deleted. Your account and login credentials, your profile, your entire learning record, your tutor conversations, any voice recordings and images you submitted, your preferences and your device identifiers. Deletion covers our production systems and propagates to our encrypted backups within 30 days, as backups roll over.

What we keep, and why. We retain invoices and payment records for 8 years because Indian tax and company law requires it; a minimal record that an account with a given identifier was deleted and when, so we can evidence that we honoured your request; and any data we are under a specific legal obligation or active legal hold to preserve. Nothing in this residual set is used to rebuild your profile or to contact you.

We delete rather than deactivate. Deleting your account is not a freeze or a suspension — the underlying data is removed and cannot be restored. If you want to come back to Nirmaan later, you will start a new account with no prior history.

If you only want to remove part of your data — a single conversation, or the images you uploaded — without closing your account, ask us at hello@nirmaan.education and we will do it.

15. How we protect information

We take reasonable security safeguards to prevent personal data breaches, including:

• Encryption in transit. All traffic between the app, the website and our servers uses HTTPS with TLS. The app rejects unencrypted connections.
• Encryption at rest. Data stored in our databases and backups is encrypted.
• Access control. Access to production data is restricted to the small number of personnel who need it to operate the service, protected by multi-factor authentication, and logged.
• Passwords. Stored only as salted one-way hashes. We cannot read your password, and neither can anyone who obtains our database.
• Isolation. Database access rules ensure one user’s records cannot be read by another.
• Minimisation. We do not collect data we do not need, which is the most reliable protection of all.
• Review. We keep our dependencies patched and review our security arrangements periodically.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected person as required by the Digital Personal Data Protection Act, 2023, and any other regulator to whom we owe a notification duty, within the timeframes the law sets.

16. Where your information is stored

Your account, your learning record, your voice recordings and your submitted images are stored in India, in the Asia Pacific (Mumbai) region (ap-south-1) of our cloud infrastructure provider.

Some of our service providers — in particular our AI model providers — process data on servers outside India in order to generate the tutor’s response. That processing is transient and contractually limited to producing the response. Where personal data is transferred out of India, we transfer it only to countries not restricted by the Central Government under section 16 of the Digital Personal Data Protection Act, 2023, and we put contractual protections in place with the recipient. Where personal data belonging to people in the EEA or UK is transferred outside those areas, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

17. Links and third-party services

Our website and blog may link to other websites. Our app may link to educational resources operated by others. We do not control those sites, this policy does not apply to them, and we encourage you to read their privacy policies. We are not responsible for their content or their data practices.

Subscriptions and purchases are handled by an external payment gateway. When you pay, you are handed to the gateway’s own secure page, and the gateway’s privacy policy governs what it does with the card or bank details you enter there.

18. Changes to this policy

We may update this policy as the app changes or as the law changes. When we do, we will revise the “last updated” date at the top of this page and publish the new version here.

If a change materially affects how we handle your personal data — for example, a new category of data, a new purpose, or a new recipient — we will notify you in the app or by email before it takes effect, and where the law requires it we will ask for fresh consent. We will not apply a materially different policy to data we already hold without telling you first.

19. Contact us and grievance redressal

If you have a question about this policy, want to exercise a right, or want to complain about how we have handled your personal data, contact our Grievance Officer:

If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the EEA or the UK, you may complain to your local data protection supervisory authority.