Privacy Notice

1. The law this notice follows

India's Digital Personal Data Protection Act 2023 (the DPDP Act) and the DPDP Rules 2025 come into force in stages; most of the duties and rights described below apply from a later date. [To confirm: commencement dates of the relevant provisions.] Until they apply, this notice is also our privacy policy under the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and we follow the practices and honour the requests described here voluntarily.

2. Our two roles

Under the DPDP Act we act in two different roles:

• For students' data: when an institution uses iProGrader, the institution decides why and how its students' data is processed. The institution is the Data Fiduciary and we are its Data Processor. We process students' data only on the institution's instructions and only to provide the service.
• For our own users and contacts: for the accounts of teachers and staff, for billing contacts and for people who write to us, we are the Data Fiduciary.
• When an individual teacher uses iProGrader without an institution's account, that teacher is the Data Fiduciary for the scripts they upload. [To confirm: the declaration of institution and lawful basis that individual workspaces will require.]

If you are a student, parent or guardian, your institution's own privacy notice also applies, and your institution is your first point of contact. We will help institutions respond to requests about students' data. [To confirm: the request-handling process, before the rights provisions apply.]

3. Students' data we process for institutions

Depending on what an institution uses, this can include:

• scanned or photographed answer scripts, and the text read from them;
• the student details the institution provides, such as name, roll or enrolment number, class or programme, exams taken and, where the institution records it, a parent or guardian contact;
• marks, feedback and review history, including which teacher reviewed or changed a mark and why;
• records of the lawful basis or consent that the institution keeps through iProGrader.

We never collect or accept Aadhaar numbers, in any field, upload or student list. Institutions should not send us information about students that the service does not need.

4. How students' data is used

Only to provide iProGrader to the institution: checking that every page of a script is present, reading the answers, proposing marks against the institution's own marking scheme, letting teachers review and correct those marks, and publishing results when the institution decides to.

We do not sell students' data. We do not use it for advertising. We do not track, profile or monitor the behaviour of children, and we do not direct any advertising at them.

We do not use students' data to train AI models, and we use AI providers only on terms under which they do not use the data we send them to train their models. [To confirm: each provider's current API data-use and retention terms, recorded at onboarding.]

With an institution's permission, its teachers can build a reference set of marked answers that the institution has anonymised, used only to test and calibrate marking for that institution.

5. How AI is used, and what it sees

AI marks are proposals. A teacher at the institution reviews them, can change any mark (with a recorded reason) and decides when results are published. iProGrader never treats an unread or missing answer as a wrong answer; such questions are held for a person.

To read and mark an answer, iProGrader sends an AI model the image of the answer, the text read from it and the institution's marking scheme. We do not include students' names, roll numbers or other identifying details in the data we send, but the answer images themselves can contain whatever a student wrote on the page.

On answer booklets printed by iProGrader, the name and roll number box is blanked out before any AI model sees the page. For other stationery, institutions should ask students to write their details only on a cover sheet or in a space the institution designates. [To confirm: blanking of identity areas on other stationery, planned.]

Each institution chooses which AI models it uses. iProGrader is built to use:

• Anthropic (Claude) and OpenAI, which process requests outside India;
• Google Gemini on Vertex AI, which can run in Google's Indian regions for the models that support it [To confirm: availability in India of each model at onboarding];
• models hosted privately on servers that we or the institution run.

An institution can require that answer scripts are processed only in India. When it does, iProGrader uses only models that run in India, and if a setting changes so that work in progress would no longer comply, that work stops; it is never silently sent elsewhere.

Every AI call is recorded: which provider and model, the region recorded for that call, what kind of data was sent and the provider's retention terms. Institutions can ask us for this record; we will add an export. [To confirm: export, planned.]

6. Data about teachers, staff and other users

When you use iProGrader as a teacher, examiner, administrator or other staff member, we process:

• your name, work email, phone number (if you sign in with it), institution and role;
• sign-in data, handled for us by Google Firebase Authentication;
• a record of important actions you take, such as changing a mark or publishing results, which institutions need for academic integrity;
• technical logs used to keep the service secure and working.

We use this to run your account, keep the service secure, provide support, and meet legal, tax and audit obligations. For billing we will also keep the institution's billing contact, GSTIN and invoices. [To confirm: how billing will run at launch.]

7. Where data is stored, and who else handles it

iProGrader stores answer scripts, results and account data in India, in Google Cloud's Mumbai region (asia-south1). Database backups are kept in Google Cloud's Delhi region (asia-south2); answer-script files are kept in Mumbai only. [To confirm: a second-region copy of answer-script files before go-live.]

Some data can leave India:

• answer content sent to an AI provider outside India, when an institution has chosen one (section 5);
• the marking scheme and instructions for a question, which an AI provider can keep for a short time to make repeated calls cheaper (this does not include students' answers);
• sign-in identity data held by Google Firebase Authentication [To confirm: the storage location of sign-in identity data];
• this website and the iProGrader app's files are delivered through Cloudflare's network, which handles visitors' network addresses worldwide (the iProGrader service itself is not routed through Cloudflare).

The service providers who handle data for us are Google Cloud, Google Firebase Authentication, Cloudflare, the AI providers each institution selects, and our email provider for inquiries. [To confirm: email provider, and any further providers such as a payment gateway, to be listed before launch.]

We will not transfer personal data to any country to which the Government of India restricts transfers under the DPDP Act.

8. Children's data

Many students are under 18. The DPDP Act requires verifiable consent from a parent or lawful guardian before a child's data is processed, except where the law allows otherwise, for example for certain processing by educational institutions. Each institution decides, with its own advisers, the lawful basis for its students and whether it meets the conditions of any exemption, and records the basis in iProGrader; we do not decide it.

Where no lawful basis is recorded for a student, iProGrader stores the uploaded script but does not read or mark it until one is recorded. A student whose age is not known is treated as a child.

iProGrader records how the institution says consent was obtained (for example, confirmed by the institution or checked against documents); we do not verify a parent's consent ourselves. For children, a clicked link alone is treated as an acknowledgement, not as verifiable consent.

9. If you contact us

When you send a pilot request through this website or write to us, we receive your name, role, institution, institution type, city and state, work email, phone number if you give one, and your message, in our email inbox. Please do not send us information about students.

We use these details only to reply and to discuss a pilot with your institution. Only the YellowParrot team handling the request sees them. We do not sell or share them, and we do not use them for advertising. We keep them for no more than 12 months after our last contact with you, and delete them sooner if you ask.

10. This website and the app

This website sets no tracking cookies, runs no analytics and loads nothing from other websites. Your choice of light or dark theme is kept only in your own browser.

The iProGrader app uses Google Firebase Authentication to sign you in. If you sign in with a phone number, Google reCAPTCHA checks that the request comes from a person; Google's own privacy terms apply to that check.

The app keeps your sign-in session, your settings and, on phones used for capture, encrypted photographs waiting to upload, on your device only.

11. How long data is kept

We will keep students' data for the period the institution sets, following the norms of its board or university. [To confirm: retention settings and templates by board and university, planned.] Working copies made during processing are deleted automatically within 30 to 90 days.

When an institution asks us to delete a student's data, we will delete the scans, the extracted text and the working files, and keep only what the law or the institution's examination rules require (such as final marks and the audit trail), with the student's identity replaced by a pseudonym. We will give the institution a certificate saying exactly what was deleted and what was kept. [To confirm: deletion process, planned.]

When an institution stops using iProGrader, we will delete its data after it has had a chance to export it. [To confirm: export window and deletion period after the contract ends.] Database backups are overwritten on a fixed cycle, so deleted data leaves the backups within about 80 days. [To confirm: final backup periods.]

Account data is kept while the account is active and then for as long as legal, tax and audit obligations require.

12. Security

Data is encrypted in transit and at rest (at rest with keys managed by Google Cloud). Each institution's data is kept separate and checked on every request. Staff access is limited to what their role needs, and sensitive actions are logged. Uploads use short-lived signed links and are checked before processing.

If a personal data breach affects students' data, we will inform the institution without delay and support it in notifying the Data Protection Board of India and the people affected. For data we hold as Data Fiduciary, we will notify the Board and you as the law requires. [To confirm: internal breach procedure, before the breach provisions apply.]

13. Your rights

When the DPDP Act's rights provisions are in force, and voluntarily until then, you can:

• ask for a summary of the personal data processed about you, how it is processed, and who else it has been shared with and what was shared;
• ask for inaccurate or incomplete data to be corrected, completed or updated;
• ask for your data to be erased where it is no longer needed and the law does not require it to be kept;
• withdraw consent you have given, as easily as you gave it (processing already done remains lawful, and we will stop within a reasonable time);
• nominate a person to exercise your rights if you die or become unable to;
• have a grievance dealt with, and, if you are not satisfied, complain to the Data Protection Board of India [To confirm: the Board's complaint route once published].

Students, parents and guardians: please contact your institution first; it is responsible for students' data and we will help it respond. Teachers, staff and other contacts: write to us at the address below. We respond to requests and grievances within 30 days. [To confirm: published response period; the law allows up to 90 days.]

14. Contact and grievances

Write to Hello@yellowparrottech.com. Our Grievance Officer is [To confirm: name and designation], who can be reached at the same address or at [To confirm: registered office address].

YellowParrot Technologies Pvt. Ltd., [To confirm: CIN and registered office address].

15. Changes to this notice

We will update this notice as legal obligations come into force and when the service changes, and we will tell institutions about material changes before they apply. The date at the top shows the current version.

This notice is in English. The DPDP Act gives you the option of reading it in English or in any language in the Eighth Schedule of the Constitution. [To confirm: the languages offered at launch, Hindi at least.]