Privacy Policy

Note: This policy has been prepared based on the actual BrainVeda application. It has not been reviewed by a qualified lawyer. BrainVeda is currently a FREE educational platform. Please contact us at brainveda.edu@gmail.com for any privacy questions.

1. Who We Are

BrainVeda is an independent online educational platform created and operated by Rakesh Sir. We provide video lectures, PDF notes, Daily Practice Problems (DPPs), Previous Year Questions (PYQs), mock tests, and doubt support, currently for CBSE Class 10 students.

Website: brainveda.pages.dev
Contact: brainveda.edu@gmail.com

Note: BrainVeda is not a registered company at this time. Legal entity registration status should be confirmed by the owner before commercial launch. See Section 28 (Owner Action Required).

2. Scope of This Policy

This Privacy Policy applies to:

• All visitors to brainveda.pages.dev
• All registered students who create accounts on BrainVeda
• Anyone who contacts us through our website, Telegram, WhatsApp, or email

This policy does not cover external platforms such as YouTube, Telegram, WhatsApp, Instagram, or Google Forms, which are governed by their own privacy policies.

3. Personal Data We Actually Collect

At Registration (provided by you):

• Full Name — to personalise your dashboard and leaderboard display
• Phone Number — your unique login identifier; used to contact you for password reset support via WhatsApp
• Class — currently fixed as "Class 10" for all accounts
• Password — stored only as a one-way cryptographic hash (SHA-256 with a salt); your actual password is never stored or readable by us

We do NOT collect at registration: email address, date of birth, home address, school name, city, or any payment information.

Automatically recorded when you use the platform:

• Videos you have watched (for progress tracking in your dashboard)
• Notes and PDFs you have downloaded (for your download history)
• Mock tests you have attempted, and your scores per subject
• Your login streak and badge progress
• Bookmarks you save on videos
• Doubts you submit via the "Ask a Doubt" feature (subject + your question text)
• Poll votes (your option choice, anonymised in results)
• PYQ "solved" marks you set for yourself
• Session information (login session ID, session start time, expiry)

Contact form submissions (if you use /contact):

• Name, phone number, subject, and message text you provide

Coming-soon notification sign-ups (if you join a waitlist):

• Phone number or email you provide voluntarily

Basic page-view counts:

• We record anonymous page-view counts for internal monitoring (e.g. "video-detail page viewed X times"). We do not store individual student IP addresses in page_view logs.

We do NOT use Google Analytics, advertising tracking pixels, or any third-party analytics system. We do not store your IP address in our database.

4. How We Collect Your Data

• Registration form — name, phone, password you enter directly
• Login and usage — study activity automatically recorded when you use the platform
• Contact form — information you submit voluntarily
• Ask a Doubt — text you submit voluntarily
• Session cookie — a session identifier cookie placed when you log in

5. Why We Process Your Data (Purposes)

6. Legal Basis for Processing — DPDP Act and Rules Status

India's Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted by Parliament in August 2023.

The Digital Personal Data Protection Rules, 2025 were officially notified on 13 November 2025 (published in the Official Gazette by the Ministry of Electronics and Information Technology, MeitY). However, the Rules have a phased commencement schedule — not all obligations are immediately applicable:

• In force from 13 November 2025 (immediate): Rules 1 and 2 (Short Title and Definitions) and Rules 17 to 21 (establishment and operations of the Data Protection Board of India). These provisions are currently operative.
• In force from 13 November 2026 (12 months): Rule 4 (Consent Manager registration framework).
• In force from 13 May 2027 (18 months): Rules 3, 5 to 16, 22 and 23. These cover the core data fiduciary obligations — including Notice and Consent requirements, Rights of Data Principals, Significant Data Fiduciary designation, reasonable security safeguards, and children's data protections under Section 9 of the Act. Data fiduciaries (including platforms like BrainVeda) have until 13 May 2027 to achieve full compliance with these obligations.

BrainVeda's current compliance posture: The data fiduciary obligations most directly applicable to a platform such as BrainVeda (notice, consent mechanisms, data principal rights, children's data safeguards, security standards) fall within the 18-month transition period. BrainVeda is implementing privacy practices on a best-efforts basis aligned with the Act's intent and will achieve full compliance with the relevant provisions before they become operative in May 2027.

Additionally, under the Rules as notified: data breaches that are likely to result in harm must be reported within 72 hours (once the relevant provisions are operative); requests from Data Principals to exercise their rights must be responded to within 90 days under Rule 14(3) (operative from May 2027).

In light of the above, and on a best-efforts basis consistent with the Act's intent, we process your personal data on the following grounds:

• Your consent — by registering and using BrainVeda, you provide consent to the data practices described in this policy. You may withdraw consent by requesting account deletion (see Section 15).
• Legitimate educational purpose — study progress tracking, leaderboard, and platform improvement are necessary for the educational service you have requested.
• Security and platform integrity — rate limiting and session management are necessary to protect the platform and users.

Note: The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) remain in effect until formally repealed upon full commencement of the DPDP Rules. BrainVeda complies with applicable SPDI Rules requirements. Professional legal review is recommended before commercial launch.

7. Account Information

Your account stores: full name, phone number (hashed not stored as-is in the session), class, and a hashed password. You can view your profile in your student dashboard. To update your name or phone number, contact us (see Section 17).

8. Educational Activity Data

We record your study activity — videos watched, notes downloaded, test attempts, scores, streaks, bookmarks — to power your personal dashboard. This data is visible only to you (in your dashboard) and to the platform administrator (Rakesh Sir) for platform management purposes.

Your name and mock-test scores appear on the public leaderboard. If you do not wish your name to appear on the leaderboard, please contact us.

9. Doubt Submissions

When you submit a doubt via the "Ask a Doubt" feature, your doubt (subject and question text) is stored in our database and is visible to the platform administrator. Submitted doubts are not publicly displayed to other students. Doubts are used by Rakesh Sir to prepare educational responses.

Contact form messages (name, phone, subject, question) are stored for responding to your query and are visible only to the administrator.

10. Cookies and Session Technology

BrainVeda uses the following cookies:

• bv_student — Session cookie placed when you log in as a student. Properties: HttpOnly (not accessible to JavaScript), SameSite=Lax (cross-site forgery protection), expires after 7 days. Purpose: keeps you logged into your account.

We do not use advertising cookies, tracking pixels, analytics cookies, or any third-party cookies. The session cookie is strictly necessary for the login feature to work.

You can clear session cookies by logging out, or by clearing cookies in your browser settings.

11. Analytics and Tracking

BrainVeda does not use Google Analytics, Facebook Pixel, or any third-party analytics or advertising tracking service.

We use simple internal page-view counters stored in our own database (e.g. to count how many times a video page was visited). These are aggregate counts and are not linked to individual students beyond what is already in your own activity history.

12. Third-Party Services We Actually Use

BrainVeda links to or uses the following external services:

• YouTube (Google) — Videos are embedded from YouTube. When you watch a video, YouTube's servers process your request under Google's Privacy Policy. We use the youtube-nocookie.com embed domain to reduce tracking.
• Telegram — We operate a Telegram channel (t.me/thebrainveda) for updates and doubt support. Telegram operates under its own Privacy Policy.
• WhatsApp (Meta) — Used for password-reset support and doubt assistance. Meta operates under its own Privacy Policy.
• Instagram (Meta) — We have an Instagram page (@brainvedaofficial). Meta operates under its own Privacy Policy.
• Google Forms — Some DPP (Daily Practice Problem) exercises link to Google Forms for quiz submissions. Google operates under its own Privacy Policy.
• Cloudflare — Our website and database run on Cloudflare infrastructure (Cloudflare Pages, Cloudflare D1, Cloudflare R2). Cloudflare processes requests as part of normal web hosting. See Cloudflare's Privacy Policy.

We do not sell, rent, or share your personal data with any of these services for marketing or advertising purposes. We do not transfer your data to any data broker or marketing company.

13. Data Storage

Your personal data is stored on Cloudflare D1 — a globally distributed SQLite database hosted on Cloudflare's infrastructure. PDF files are stored on Cloudflare R2 object storage. Cloudflare's data centres are distributed globally. Data may be processed across Cloudflare's global network.

We do not maintain any database servers outside Cloudflare's infrastructure. We do not transfer data to countries outside of what Cloudflare's infrastructure uses in normal operation. Cloudflare's data processing and international transfer practices are governed by Cloudflare's Data Processing Addendum and Privacy Policy.

14. Data Retention

We retain your personal data for as long as your account is active on BrainVeda or until you request deletion. Specifically:

• Account data (name, phone, password hash) — retained until account deletion is requested
• Study activity data — retained as long as your account exists; helps maintain your progress history
• Session tokens — expire automatically after 7 days
• Contact form messages — retained until resolved and cleared by administrator
• Doubt submissions — retained as educational support records

We do not have automated data deletion schedules in place at this time. Account deletion is manual and performed by the administrator upon request.

15. Account Deletion

You may request deletion of your BrainVeda account and all associated personal data at any time by:

• Emailing brainveda.edu@gmail.com with subject "Account Deletion Request" and your registered phone number
• Messaging on WhatsApp: 8318350192

We will process deletion requests within a reasonable period (typically within 7 working days). Deletion will remove your account, study history, doubts, test scores, bookmarks, and session data from our database.

Note: Automated self-service account deletion is not currently available. Deletion is performed manually by the administrator.

16. Data Correction

If any personal data we hold about you is inaccurate, you may request correction by contacting us at brainveda.edu@gmail.com. We will update the data promptly.

17. Your Privacy Rights

Under applicable Indian law, you have the following rights regarding your personal data:

• Right to access — View your profile and study activity in your student dashboard
• Right to correction — Request correction of inaccurate personal data
• Right to erasure — Request deletion of your account and data
• Right to withdraw consent — You may withdraw consent for data processing by requesting account deletion
• Right to grievance redressal — See Section 26 (Grievance Mechanism)

To exercise any of these rights, contact us at brainveda.edu@gmail.com. We aim to respond within 90 days, consistent with the response period provided under Rule 14(3) of the Digital Personal Data Protection Rules, 2025 (which becomes operative for data fiduciaries from 13 May 2027).

Note: Additional rights under the DPDP Act — including the right to nominate a representative, and any applicable right to data portability — will be implemented as the relevant provisions of the Rules enter into force. The Rules were notified on 13 November 2025 with phased commencement; data fiduciary obligations (including full rights framework) come into force from 13 May 2027.

18. Children and Minors

BrainVeda serves CBSE Class 10 students, who are typically 14–16 years of age. Some users may therefore be minors under 18 years of age.

Current practice:

• BrainVeda does not collect date of birth and does not verify age at registration
• We do not knowingly solicit data from children under 13
• If you believe a child under 13 has registered without parental knowledge, please contact us at brainveda.edu@gmail.com and we will delete that account promptly
• We recommend that parents or guardians assist children in registering and using BrainVeda

DPDP Act, 2023 — Children's Data (Section 9) Status:

Section 9 of the Digital Personal Data Protection Act, 2023 requires Data Fiduciaries to obtain verifiable parental consent before processing a child's (under 18 years) personal data, and prohibits processing that may be detrimental to a child's well-being.

The implementing Rules governing Section 9 obligations (Rules 3, 5–16, 22, and 23 of the Digital Personal Data Protection Rules, 2025) were notified on 13 November 2025 but have a transition period: they come into force on 13 May 2027. This means full compliance with parental consent verification requirements is required by May 2027.

BrainVeda's current approach: BrainVeda does not currently have a technical age-verification or parental-consent mechanism. We do not knowingly solicit data from children under 13. For students aged 13–17, we recommend parental awareness and involvement. We are planning to implement appropriate age-appropriate safeguards before the May 2027 commencement date. No mechanism that does not actually verify age will be introduced merely for compliance appearance.

This is an OWNER ACTION REQUIRED item before May 2027 — see Section 28.

19. Data Security

• All passwords are stored as one-way cryptographic hashes (SHA-256 with application salt); we cannot recover your password
• Your data is stored on Cloudflare D1, a managed database with Cloudflare's infrastructure security
• All connections to BrainVeda use HTTPS (TLS encryption in transit)
• Session cookies are HttpOnly and SameSite=Lax
• Login and registration have in-memory rate limiting to prevent brute-force attacks

While we implement reasonable technical security measures, no internet service can guarantee absolute security. Please keep your password private and do not share your account credentials with anyone.

20. Data Breach

In the event of a data breach that is likely to result in harm to users, BrainVeda will make reasonable efforts to notify affected users via in-app announcements and/or direct contact through their registered phone number (via WhatsApp), to the extent technically feasible.

Under the Digital Personal Data Protection Rules, 2025 (once the relevant provisions become operative from 13 May 2027), data breaches that are likely to result in harm to Data Principals must be reported to the Data Protection Board of India within 72 hours of the breach being brought to the notice of the Data Fiduciary. BrainVeda will comply with this obligation when it becomes operative.

21. Data Sharing and Disclosure

We do not sell, rent, trade, or share your personal data with third parties for marketing or commercial purposes.

We may disclose data in the following limited circumstances:

• Cloudflare infrastructure — data passes through Cloudflare as our hosting provider in the ordinary course of website operation
• Legal obligation — if required by a court order, law enforcement authority, or applicable Indian law
• Protection of rights — if necessary to protect the rights, property, or safety of BrainVeda, its users, or the public

Your leaderboard name (first name) and mock-test performance are visible to other logged-in students on the leaderboard page.

22. External Links and Third-Party Services

BrainVeda links to external platforms including YouTube, Telegram, WhatsApp, Google Forms, and Instagram. These platforms are not operated by BrainVeda and are governed by their own terms of service and privacy policies. We are not responsible for their data practices. We recommend reviewing the privacy policies of any external platform you use.

23. Applicable Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (to the extent in force), and applicable rules and regulations issued thereunder.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, particularly as provisions of the Digital Personal Data Protection Rules, 2025 progressively come into force (with key data fiduciary obligations commencing 13 May 2027) and as BrainVeda introduces new features. Any material changes will be posted on this page with an updated "Last Updated" date. We recommend checking this page periodically.

For material changes (such as introduction of paid services or new data collection), we will notify registered students via in-app announcements where feasible.

25. Paid Services (Not Currently Active)

BrainVeda is currently a FREE platform. No payment information is collected. If paid subscription services are introduced in the future, this Privacy Policy will be updated to reflect how payment data is handled, and you will be notified before those features are activated.

26. Grievance Mechanism

If you have any grievance, concern, or complaint regarding the processing of your personal data or this Privacy Policy, please contact:

Note: Whether BrainVeda is classified as an "intermediary" under the Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — and whether a formally designated Grievance Officer is therefore mandatory — depends on BrainVeda's specific platform functions and applicable legal thresholds. This determination should be made with professional legal advice. If and when a formal Grievance Officer appointment is legally required, this section will be updated with the officer's details. Under the Digital Personal Data Protection Rules, 2025, additional obligations relating to grievance handling for Data Principals will come into force from 13 May 2027; this section will be updated accordingly when those obligations become operative.

27. Effective Date and History

Effective Date: 1 September 2026
Last Updated: 6 September 2026
Version: 1.1 (Session 14: Updated DPDP Rules 2025 status — Rules notified 13 Nov 2025 with phased commencement; updated §6, §17, §18, §20, §24, §26)

Previous version: 1.0 — Initial comprehensive policy (Session 12). Revised 1.0a in Session 13 (legal corrections). This version (1.1) updates DPDP Rules 2025 status to accurately reflect notification on 13 November 2025 with phased commencement.

28. Owner Action Required (Implementation Notes)

These items require action by the platform owner before commercial launch or to achieve fuller legal compliance:

• Obtain professional advice (from a qualified CA / business lawyer) regarding appropriate business structure, registration, and licences before commercial launch — options include sole proprietorship, partnership, LLP, or private limited company, each with different tax and compliance implications; no single structure is universally mandatory, but operating as a registered business entity is strongly recommended before accepting payments
• Obtain legal advice on whether BrainVeda meets the threshold for mandatory appointment of a Grievance Officer under applicable IT Rules; if required, appoint an officer with name and contact details; also monitor DPDP Act Rules for future grievance officer obligations
• Implement age verification or parental consent mechanism before DPDP Section 9 provisions come into force on 13 May 2027 — this is a firm compliance deadline, not a voluntary action
• Obtain legal review of this policy from a qualified Indian lawyer or CA before commercial/paid launch
• Review GST/tax obligations with a qualified CA before activating paid subscriptions
• Confirm data processing location compliance (Cloudflare's data residency) if required by future regulations