Privacy Policy

Mauli Classes · version 1.0-draft · effective 2026-10-14Draft — under review

Draft for review — not yet in effect.

About this policy

Mauli Classes is a small private coaching class. One Teacher runs the class and the Mauli Classes app and website. Students (from Class 1 through Class 12) and parents or guardians use the app to follow classes, homework, tests, results, study material and, for parents, fee records. For our youngest children (Nursery and UKG, from age 4) only the parent or guardian uses the app.

This policy explains, in plain words, what information we keep, why we keep it, who can see it, where it is stored, how long we keep it and what you can ask us to do with it. It applies to the Mauli Classes mobile app, the Teacher's web portal and the public pages at admin.mauliclasses.com, including the public Support and Enquire about classes forms.

Because all our students are treated as children, please also read the Child & Student Privacy Notice and the Parent / Guardian Consent Notice. They explain the same things from the student's and the parent's point of view.

Our policies are currently available in English. Versions in other languages may be added later.

Who we are

Mauli Classes is operated by Rani Mayur Gaikwad as an individual tuition/coaching provider. She is also the Teacher who runs the class and the app.

In this policy, "we" and "Mauli Classes" mean Mauli Classes (operated by Rani Mayur Gaikwad). "The Teacher" means her in her role of running the class and the app.

Contact for privacy questions, requests and grievances: the Support form in the app or on our website (or support@mauliclasses.com).

The short version

Accounts exist only by invitation from the Teacher. There is no public sign-up.
Families who are not yet with us can send an enquiry about classes. We use it only to reply to them.
A student can use the app only after a linked parent or guardian has given consent for that child.
We keep only what the class needs: names, contact details, class records and the material you upload.
We do not sell personal information. We do not show ads. We do not use analytics, advertising or crash-reporting tools in the app.
We do not send anyone's information to an AI service.
The app does not take payments. It only records fees paid outside the app. Fee reminders appear in the app, for parents only.
Students and parents see only their own records, or their own child's records. They do not see other students' records.
You can ask to see, correct or delete your information, withdraw consent, or raise a complaint, from inside the app or through the Support form.

Children and students

Mauli Classes teaches Nursery, UKG and Class 1 to Class 12, so our students are from age 4 upwards. We treat every student as a child (under 18). The app does not ask for or store a date of birth or age. It records the student's class.
Nursery and UKG children have no login of their own. The parent or guardian uses their own Parent account to follow the child's attendance, homework, fees, notices and progress, and the Teacher keeps the child's records. Because such a child has no account, there is no student acknowledgement step for them. The parent's consent for the child is still required and covers the child.
Before a student can use the app, a parent or guardian who is linked to that student must accept our policies and give a separate consent for that child. Until then, the app shows the student nothing except the policies and the privacy options.
The Teacher also records how she confirmed that the parent is an adult and the child's parent or guardian. She records only the method (for example, met in person at admission). No ID document, ID number or copy is collected.
A student's own acknowledgement of our rules does not replace the parent's consent.
From Class 1, students have their own login and go through a short student acknowledgement of our rules. A student who is still learning to read may be helped by a parent or guardian. This help, and the student's acknowledgement, never replace the parent's own consent.
How a student who is 18 or older is handled: [OWNER/LAWYER CONFIRMATION REQUIRED: how a student aged 18 or over is handled]. Until this is decided, every student account needs parent or guardian consent.

What we collect, why, and who can see it

For each kind of information below we explain why we keep it, who can see it, and how long we keep it. "The Teacher" can see everything in the class. "The student" means the student the record is about. "A linked parent" means a parent or guardian linked to that student who has an active consent for that student. If a parent withdraws consent for a child, that child's records disappear from that parent's app.

Our service providers (listed further down) store or carry this information for us. They do not decide how it is used.

Names

What: the student's full name and preferred name (by default the first name); the parent's name and how they like to be addressed.
Why: to identify students and parents in the class and in the app.
Who can see it: the Teacher; the student sees their own name; a parent sees their own name and their linked children's names.
How long: while the account exists. When an account is deleted, the name is erased (see "Deleting your account").

Email address

What: the email address used to sign in. A Nursery or UKG child has no login, so no email address is kept for that child.
Why: to sign in, and to send a password-reset code when you ask for one.
Who can see it: the Teacher. Students and parents cannot see anyone else's email address.
How long: while the account exists. Erased when the account is deleted.

Phone number

What: a parent's phone number (required when a parent creates an account) and a student's phone number (optional).
Why: so the Teacher can contact the family about the class.
Who can see it: the Teacher; each person can see their own; a parent with active consent can also see their child's phone number, if the student gave one.
How long: while the account exists. Erased when the account is deleted.

Account, role and status

What: whether you are a student or parent, whether your invitation is pending, your account is active or access is switched off, and when these changed. Invitation codes are stored only in a scrambled (one-way hashed) form and expire after 7 days.
Why: to let the right people in and keep everyone else out.
Who can see it: the Teacher.
How long: while the account exists. After deletion a closed record remains without name or email so the account can never be reopened.

Relationships, class, batch and board

What: which parent is linked to which student; the student's class, board and batch, when they joined or left a batch, and the class timetable (which can include a room, an online class link or a short note).
Why: to show each family the right classes, records and announcements.
Who can see it: the Teacher; students and parents see their own batches and timetable, and parents see which children are linked to them.
How long: while the student is enrolled, and for a former student as explained under "Leaving the class is not deleting your account". [OWNER/LAWYER CONFIRMATION REQUIRED: retention schedule for each category of information]

Attendance

What: present, absent or late for each class, and any short note the Teacher adds.
Why: to keep the class register and let families follow attendance.
Who can see it: the Teacher, the student and a linked parent.
How long: see "How long we keep information". After an account is deleted, attendance is kept without the student's name or contact details.

Homework, comments and feedback

What: homework set by the Teacher, whether it was submitted and reviewed, the student's comment on a submission, and the Teacher's written feedback.
Why: to set, collect and review homework.
Who can see it: the Teacher, the student and a linked parent.
How long: while the student's account exists. Deleted when the student's account is deleted.

Homework photos

What: photos of homework that a student takes or chooses in the app.
Why: so the Teacher can check written work.
Who can see it: the Teacher, the student and a linked parent. Photos are stored privately, not on any public page.
Device protection: the app removes location and other descriptive details (such as GPS position, captions and comments embedded in the file) on the phone before upload. It keeps only the picture and which way up it goes.
Please photograph only the homework. Avoid faces, other people, documents or anything showing where you live.
How long: while the student's account exists. Deleted when the student's account is deleted.

Study material

What: notes, worksheets and other material the Teacher shares. Students and parents receive a copy marked "MAULI CLASSES" and open it in the app's own viewer. The watermark does not contain your name or any personal details.
Why: to teach.
Who can see it: the Teacher sees the original; students and parents in the right class or batch see the watermarked copy.
Personal information: the material itself contains no personal information about students or parents.

Tests, marks, results and progress

What: tests, marks, absence from a test, the Teacher's remarks, and progress summaries the app works out from attendance, homework and marks.
Why: to record and explain how a student is doing.
Who can see it: the Teacher; the student and a linked parent see results only after the Teacher publishes them. Students and parents do not see other students' marks or ranks.
How long: see "How long we keep information". After an account is deleted, marks and results are kept without the student's name or contact details.

Fee records

What: the fee plan, charges and due dates, payments made outside the app (amount, date, how it was paid, any reference or note), waivers and corrections, any sibling discount or concession, and any refund with its calculation.
Discounts and concessions: the parent sees the discount or concession and its amount. The Teacher's internal reason for it is kept for the Teacher only.
Why: so the class and the family have a clear record of fees. The app only records fees paid outside the app. It does not take or process payments and does not collect card, bank or UPI details.
Who can see it: the Teacher and a linked parent. Students cannot see fee records.
How long: see "How long we keep information". After an account is deleted, fee records are kept without the student's name or contact details.

Announcements and in-app notifications

What: announcements from the Teacher, and notifications inside the app (for example, new homework or a published result). A parent's notification can include the child's first or preferred name.
Fee reminders: shortly before, on and shortly after a fee's due date, the app may show a fee reminder inside the app. Fee reminders go only to linked parents with an active consent, never to students.
Why: to keep families informed.
Who can see it: announcements go to the roles and batches the Teacher chooses; each notification is seen only by the person it is for.
Notifications stay inside the app. We do not send push notifications, marketing emails or text messages.
How long: a person's notifications are deleted when their account is deleted.

Sign-in and security information

What: your password (stored only as a one-way hash by our sign-in provider), sign-in sessions, a history of changes to key class records (who changed what and when), and a record of refused registration attempts. Refused attempts are stored only as scrambled codes of the email and IP address and are deleted after 90 days.
Protecting the public forms: to stop spam and abuse of the Support and Enquire about classes forms, we keep, for each form sent, a scrambled code (a one-way keyed hash) of the contact detail given for the reply (the phone number or email address) and, when our hosting network supplies it, of the sender's IP address, together with the time and, if you are signed in, your account. We do not keep the IP address itself, and these codes are not used for anything else. These records are deleted automatically after 30 days.
On your phone: the app keeps you signed in by storing your session encrypted on the device.
On the web: the Teacher's portal uses a sign-in cookie (see the Cookie & Web Technologies Policy at /cookies).
Provider logs: our hosting providers, Supabase and Netlify, keep their own technical logs, which include IP address and browser or device type, for the periods they set. The sign-in system also records the IP address and browser or device type of each active sign-in session; these session records end when you sign out or your session expires, and are deleted with your account. [OWNER/LAWYER CONFIRMATION REQUIRED: how long Supabase and Netlify keep their platform logs]
Why: to keep accounts and records secure and to investigate problems.
Who can see it: the Teacher sees the change history; the logs are held by the providers.
How long: refused-attempt records 90 days; public-form protection records 30 days; other security records [OWNER/LAWYER CONFIRMATION REQUIRED: retention schedule for each category of information]. When an account is deleted, names, contact details, comments and feedback are erased from the change history of that account's records; the fact that a change happened remains.

Consent and privacy-request records

What: which version of each policy you accepted and when, each parent's consent for each child (and any withdrawal), how the Teacher confirmed a parent's identity, and your privacy requests with their reference number and outcome.
Why: to show what was agreed, and to handle your requests.
Not stored with these records: IP address, device identifier or password.
Who can see it: the full consent history is kept in a protected area that the app cannot read. The Teacher sees only whether consent is complete, pending or withdrawn, and the privacy requests made to her.
How long: kept as evidence, also after an account is deleted, without your name or contact details. [OWNER/LAWYER CONFIRMATION REQUIRED: retention schedule for each category of information]

Support requests

What: what you send through the Support form in the app or on our website, or by email to our support address: the category you choose (for example Account or login, Fees, Privacy / Data), a subject and your message. If you are signed in, the request is linked to your account, so we do not ask for your details again. If you are not signed in (for example, because you cannot log in), we ask for your name and an email address or phone number so we can reply. Each request gets a reference number (it looks like SR-XXXXXXXX).
Why: to answer you and solve the problem.
Who can see it: the Teacher. A signed-in person can see the status of their own requests.
Not used for: marketing, advertising or anything other than answering you.
How long: [OWNER/LAWYER CONFIRMATION REQUIRED: retention period for support requests]
When an account is deleted: the name, contact details, subject and message of the support requests sent while signed in to that account are erased. The reference number and topic are kept. A request sent without signing in is not linked to an account; you can ask the Teacher to remove it.

Enquiries about classes (from families without an account)

What: when a family who is not yet with us uses the Enquire about classes form in the app or on our website, we receive the parent's or guardian's name, a phone number or email address (at least one), the class level they are interested in, how they would like to be contacted (phone, WhatsApp or email) and their message. Each enquiry gets a reference number (it looks like EQ-XXXXXXXX).
We do not ask for the child's name or any other information about the child, and no account is created.
Why: only to reply to the enquiry about classes. We do not use it for marketing and do not add the family to any mailing list.
Who can see it: the Teacher.
Not added to student records unless the family decides to enrol. Enrolment is a separate step with its own invitation, policies and consent.
How long: [OWNER/LAWYER CONFIRMATION REQUIRED: retention period for enquiries from families who do not enrol]

What we do not collect

No date of birth, age, ID documents or ID numbers.
No location. The app does not ask for location, contacts or the microphone, and does not use an advertising identifier.
On Android, the app asks only for internet access and, when a student taps "Camera", the camera. Choosing a photo from the gallery uses the phone's own photo picker, so the app does not ask for access to all your photos.
No card, bank account or UPI details. The app does not take payments.
No tracking for advertising, no behavioural profiling and no analytics.

Sharing and service providers

We do not sell personal information. We do not share it with advertisers, marketers or data brokers. We share it only with the service providers below, so they can run the service for us, or when the law requires it.

Supabase stores the database, the files (homework photos and study material) and the sign-in system. Our project is hosted in the Mumbai, India region. A few server functions (for example, creating an account and making watermarked copies) run on Supabase's function platform, which may run them outside India. [OWNER/LAWYER CONFIRMATION REQUIRED: region where Supabase runs its server functions]
Netlify hosts the Teacher's web portal and these policy pages. The portal's server code runs in Netlify's Singapore region, so the Teacher's portal data and sign-in cookie pass through Singapore. Students and parents use the mobile app, which talks to Supabase directly; if you use the web page for deleting an account, your sign-in on that page also passes through Netlify.
Google (Gmail) sends password-reset emails. Google receives only your email address and the reset code.
WhatsApp is used only to send you your invitation: the app prepares the message, and the Teacher sends it from her own phone or WhatsApp account. The message contains your first name, your email address, the access code and its expiry date. Mauli Classes does not connect to WhatsApp in any other way.
Hostinger provides our email mailboxes. If you write to our support email address, your email is received and stored there. When a support request or an enquiry arrives through a form, the system may place a short notice for our own mailbox that contains only the reference number, never your message. [OWNER/LAWYER CONFIRMATION REQUIRED: where Hostinger stores mailbox data, and the data-processing terms with Hostinger]
Apple and Google distribute the mobile app through their app stores, under their own terms and privacy policies.

We expect each provider to protect the information to at least the standard this policy describes, and to use it only to provide its service to us. [OWNER/LAWYER CONFIRMATION REQUIRED: data-processing terms in place with each provider]

We may also disclose information if Indian law, a court or a government authority lawfully requires it.

Information stored outside India

Our main database and files are in India (Mumbai). Some processing happens outside India: the Teacher's web portal server code (Singapore), possibly some server functions (see above), password-reset email (Google), invitation messages (WhatsApp) and possibly our mailbox provider (Hostinger). By using Mauli Classes you understand that this happens. We will follow any rules the Government of India makes about transfers outside India, as they apply to us.

How we protect information

Every table and file is protected by access rules on the server, so each person can reach only what their role allows. This is checked by the server, not just by the app.
Information travels over encrypted connections (HTTPS).
Photos and study material are kept in private storage. Students and parents receive only the watermarked copy of study material.
Invitation codes and passwords are stored only as one-way hashes. The app stores your session encrypted on your phone.
Changes to key class records are logged so mistakes and misuse can be traced.

No system is perfectly secure, and we cannot promise that information will never be lost or misused. If a breach affects your information, we will tell affected families and the authorities as the law requires. [OWNER/LAWYER CONFIRMATION REQUIRED: breach-response process and contacts]

How long we keep information

We keep information only as long as the class needs it or the law requires it. A retention schedule is being finalised, and the periods have not been decided yet. [OWNER/LAWYER CONFIRMATION REQUIRED: retention schedule for each category of information]

What happens today:

While a student is enrolled, their records are kept so the class can run.
Former students: when a student leaves the class without asking for deletion, the Teacher marks the student as having left. Their attendance, progress, results and fee history are kept, with their name, for 12 months after leaving, and then reviewed for deletion, anonymisation or continued retention where the law allows or requires it. The 12-month period is the class's own business choice, so that a returning student, a parent's question or a certificate can be handled; it is still being reviewed by our lawyer. [LEGAL REVIEW REQUIRED — 12-month former-student retention]
This 12-month period does not apply to deletion requests. When an account is deleted, the items listed under "Deleting your account" are deleted or erased.
After an account is deleted, the student's attendance, marks and results, and fee records are kept without name or contact details. [OWNER/LAWYER CONFIRMATION REQUIRED: how long attendance, marks and fee records are kept after an account is deleted]
Some records may have to be kept for a minimum time by law, for example fee and accounting records. [OWNER/LAWYER CONFIRMATION REQUIRED: whether any law requires a minimum retention period for these records]
Automatic deletion exists today only for refused sign-up attempts (90 days), the public-form protection records (30 days) and the short mailbox notices that carry only a reference number (30 days). For former students, the app reminds the Teacher when the 12-month review is due; the review itself is done by hand.

Leaving the class is not deleting your account

Stopping or leaving classes is not a request to delete an account or information.

When a student leaves, the Teacher marks the student as having left and switches off app access for the student (and, where appropriate, for the parent).
The class keeps the student's history, such as attendance, progress and fee records, for 12 months after leaving, as explained under "How long we keep information".
If a former student comes back and their record has not been deleted, the Teacher can reactivate the same record, so the old history continues. The parent and student are then asked to accept any policy versions that have changed. This is never possible for a record that was deleted.
If you want an account or information deleted, you need to make a separate deletion request, as explained below. A deletion request is not delayed by the 12-month period.

Deleting your account

A student or parent can ask to delete their own account in two ways:

In the app: More → Privacy & account → Delete my account.
On the web: admin.mauliclasses.com/delete-account. You sign in there to prove the account is yours. Knowing someone's email address is not enough to delete their account.
If you cannot do either, use the Support form in the app or on our website (or support@mauliclasses.com) and the Teacher will record the request for you. She may need to confirm who you are first.
The Support form's "Privacy / Data" category is for questions, access and correction. Deleting an account has its own path, described here.

What happens at once: your account is switched off, you receive a reference number (it looks like PR-XXXXXXXX), and the Teacher is told.

What the Teacher then deletes: the sign-in account, sessions and the sign-in system's log entries for the account; name, email and phone number; a student's homework submissions, comments, feedback and homework photos; notes written about a student on attendance, test results and fee plans, and the reasons written for a fee discount, concession or refund; notifications; the links between a student and their parents; what you wrote in your privacy requests; and the name, contact details, subject and message of the support requests you sent while signed in (their reference number and topic are kept). Names, contact details, comments, notes and feedback are also erased from the change history of those records. In the class's records, the person then appears as "Erased student" or "Erased parent".

What is kept, without name or contact details: for a deleted student account, attendance, marks and results, and fee records, linked to an internal reference (de-identified, not anonymous); a fee payment's own reference and note stay with that financial record. For everyone, the consent records and the record of the deletion itself are kept. We keep these so the class has accurate academic and fee records and can show what was agreed and that the deletion was done.

If the student returns later: the Teacher will create a new account. After a deletion, the student's old records cannot be restored to the new account. (A former student who left without asking for deletion can instead be reactivated, as explained above.)

Timing: there is no fixed deadline yet. We aim to complete verified requests as quickly as practical. [LAWYER CONFIRMATION REQUIRED — maximum time to complete a deletion] Your access stops at once. The Teacher will contact you when it is done.

Backups: our provider's backups may still contain deleted information until they are replaced in the normal backup cycle. [OWNER/LAWYER CONFIRMATION REQUIRED: how long Supabase backups are kept on the plan in use]

A parent who wants their child's account or records deleted can withdraw consent for that child and send a privacy request (see below). The Teacher decides on deletion or retention through the request process and will tell you the outcome.

A young child's record (Nursery and UKG, no login of their own): a parent or guardian who is linked to the child can ask the Teacher to delete the child's record, through a privacy request in the app, the Support form or in person. The Teacher confirms who you are first. Nothing changes until she completes the request. Then the same information is deleted or erased as for a student account (there is no sign-in account to delete), the child appears as "Erased student", and the same records are kept without the child's name. Your own Parent account is not affected unless you ask for it to be deleted as well. Details are on the Delete Your Account page at /delete-account.

Your rights and choices

Certain provisions of India's Digital Personal Data Protection Act, 2023 are already in force. The main obligations about processing, consent, children's data and your rights that are relevant to Mauli Classes are scheduled to start on 13 May 2027. Mauli Classes is putting many of these protections in place early, as a privacy and child-safety practice. [LEGAL REVIEW REQUIRED — final commencement wording] Mauli Classes offers these choices now:

Access: ask for a summary of the information we hold about you or your child, and who we have shared it with.
Correction and updating: ask us to fix or complete information that is wrong or out of date.
Erasure: ask us to delete information we no longer need, subject to records we must keep (explained above).
Withdraw consent: a parent can withdraw consent for a child at any time in More → Privacy & account. It is as simple as giving it. Withdrawal does not affect what was done before it.
Grievance: complain to us about how we handle information.
Nominate: name another person who can exercise these rights for you if you die or become unable to do so.

For children, a parent or guardian normally makes these requests.

How requests are handled

Send a request in the app (More → Privacy & account → Send a privacy request), or use the Support form in the app or on our website and choose "Privacy / Data" (or write to support@mauliclasses.com). The Your Privacy Choices & Grievances page at /privacy-choices explains each option.
Every request gets a reference number and is tracked until it is completed or refused with a reason.
Requests are handled by hand by the Teacher, not by an automatic system. She may need to confirm who you are before acting.
Our target response time: [OWNER/LAWYER CONFIRMATION REQUIRED: target response time for privacy requests and grievances].
You can raise a grievance with Mauli Classes in the app or through the Support form. [LEGAL REVIEW REQUIRED — grievance/contact terminology under the DPDP Rules]
If you are not satisfied with our answer, you may be able to complain to the Data Protection Board of India once the relevant provisions apply. [OWNER/LAWYER CONFIRMATION REQUIRED: wording and contact route for complaints to the Data Protection Board of India]

Cookies and similar technologies

The mobile app does not use cookies. The Teacher's web portal uses only the cookies needed to keep the Teacher signed in. There are no analytics or advertising cookies. Details are in the Cookie & Web Technologies Policy at /cookies.

Artificial intelligence

We do not send any student's, parent's or class information to an AI service, and no AI provider is connected to Mauli Classes. A private demonstration version of the app contains an offline "Demo assistant" that works only with made-up people and does not store anything on our servers. The same version's "Explore Demo" uses only fictional people. If we ever plan to use AI with real information, we will update our policies and ask for acceptance again first. See the AI-Assisted Learning Policy at /ai-policy.

Changes to this policy

Each version of this policy has a version number and an effective date.

Material changes (for example, a new use of information or a new kind of provider) will be shown in the app, and you will need to accept the new version before you continue using Mauli Classes.
Minor changes (for example, clearer wording or a corrected contact detail) will be published here with a new date, without asking you to accept again.

Contact

Mauli Classes is operated by Rani Mayur Gaikwad as an individual tuition/coaching provider.
Support, privacy questions, requests, grievances and deletion: the Support form in the app or on our website (or support@mauliclasses.com).
Families who are not yet with us: the Enquire about classes form in the app or on our website.
Address: [LEGAL REVIEW REQUIRED — PUBLIC/SERVICE ADDRESS]