Privacy Policy

📘 1. Introduction

Sadhisu ("Sadhisu", "we", "us", or "our") is a bilingual (English / Kannada) educational technology platform that helps aspirants prepare for Karnataka government competitive examinations — including KAS, PSI, FDA, SDA, PC, TET, Group C, HSTR, GPSTR, and KSET. Our service provides study materials, practice tests, previous year papers, current affairs, audio lessons, video lessons, and AI-generated content to support exam preparation — operating on a Learn → Practice → Track → Improve learning loop.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, use the Sadhisu Android application, subscribe to Sadhisu Premium, or otherwise interact with our services (collectively, the "Services").

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 of India, and the Information Technology Act, 2000 and the rules made thereunder. By accessing or using our Services, you confirm that you have read, understood, and agreed to the practices described in this Policy.

If you do not agree with any provisions of this Policy, please do not use the Services.

🏛️ 2. Who We Are (Data Fiduciary Details)

For the purposes of the DPDP Act, 2023, Sadhisu ("we", "us", or "our") acts as the Data Fiduciary in respect of the personal data we collect from you.

📋 3. Scope of This Policy

This Policy applies to all users of Sadhisu, including:

• Visitors browsing the Sadhisu website;
• Registered users who create a Sadhisu account using Google Sign-In;
• Users of the Sadhisu Android application;
• Subscribers to Sadhisu Premium or any other paid plan;
• Individuals who contact us via email, feedback forms, or social media;
• Participants in promotional campaigns, surveys, or beta programs.

This Policy does not apply to third-party websites, applications, or services that may be linked from our platform. We encourage you to review the privacy policies of those third parties separately.

📂 4. Information We Collect

We collect personal data and usage information that is reasonably necessary to deliver, secure, and improve the Sadhisu Services. The categories of information we collect are described below.

4.1 Information You Provide Directly

• Account information: Name, email address, profile photo, and Google account identifier provided when you sign in using Google Sign-In.
• Profile information: Target examination (e.g., KAS, PSI, FDA, TET), language preference (English / Kannada), and any other details you choose to add to your profile.
• User-generated content: Bookmarks, flagged questions, feedback, support queries, and any content you share within the app.
• Payment information: Subscription status and purchase history. Subscriptions are sold through Google Play: card numbers, UPI IDs, net-banking credentials, and similar payment instruments are collected and processed entirely by Google and are never seen or stored by Sadhisu. We receive only a purchase token and the confirmation details needed to activate and verify your subscription.
• Communication data: Messages, emails, and feedback form submissions you send to us.

4.2 Information Collected Automatically

• Device information: Device model, manufacturer, operating system and version (e.g., Android 14), unique device identifiers, screen resolution, language, time zone, and mobile network operator.
• App and usage data: Screens viewed, features used, tests attempted, quiz scores, time spent on questions, accuracy rates, streaks, session duration, click events, crashes, and performance metrics.
• Log data: IP address, browser type and version, referring URL, date and time stamps, and diagnostic data.
• Cookies and local storage: First-party cookies, local storage, and encrypted IndexedDB cache used for offline functionality, session management, and preferences.

4.3 Information from Third Parties

• Google Sign-In: When you authenticate using Google, we receive your name, email, Google profile photo URL, and a unique Google user ID, in accordance with the permissions you grant in the Google consent screen.
• Analytics partners: Aggregated and pseudonymised information from analytics providers such as Firebase Analytics and similar tools.
• Payment processors: Purchase status, subscription state, and similar limited information from Google Play for reconciliation, entitlement management, and fraud prevention.

👶 5. Children's Data

Sadhisu is intended for individuals aged 18 years and above who are preparing for or aspiring to write competitive examinations. We do not knowingly collect personal data from children under 18 without verifiable parental consent.

If you are a parent or guardian and you believe that a child under 18 has provided personal information to Sadhisu without your consent, please contact us at sadhisuapp@gmail.com and we will take prompt steps to delete that information in accordance with the DPDP Act, 2023.

🔧 6. How We Use Your Information

We use your information for the following purposes:

• Provide the Service: Enable access, authenticate users, process subscriptions, deliver study content, track learning progress, and provide customer support.
• Improve the Platform: Analyse usage patterns, identify bugs, measure feature adoption, and develop new features and content.
• Maintain safety and security: Prevent fraud, investigate misuse, enforce single-device login policy, enforce our Terms, and protect user safety.
• Communicate: Send payment receipts, subscription confirmations, service updates, and (with your consent) study tips and current-affairs digests.

We do not sell, trade, or otherwise exploit your personal information to others.

✅ 7. Consent

By creating an account on Sadhisu, you provide your informed consent for us to collect, store, and process your personal data as described in this Policy. Specifically:

• You consent to the collection of your name and email via Google Sign-In for account creation and authentication.
• You consent to the storage of your usage data (quiz scores, progress, bookmarks, streaks) on Firebase for delivering the Service.
• You consent to the processing of your payment information by Google Play for subscription management.
• You consent to receiving push notifications via Firebase Cloud Messaging. You may disable push notifications at any time through your device settings.

Processing that does not rely on your consent. Some processing is carried out as a legitimate use under Section 7 of the DPDP Act, 2023, or to meet a legal obligation, rather than on the basis of your consent. This covers fraud prevention and purchase verification, security and abuse investigation, enforcement of our Terms, and the retention of payment and tax records described in Section 9. This processing continues even after you withdraw consent or delete your account, and only for as long as Section 9 allows.

Withdrawing consent. You may withdraw your consent at any time — through our account deletion page, from the App settings, or by writing to sadhisuapp@gmail.com. Withdrawal takes effect for future processing. Because Sadhisu cannot deliver a personalised learning service without the data listed above, withdrawing consent also closes your account: your account and study data are deleted and you will no longer be able to use the Service. It does not erase the records covered by the paragraph above.

🔗 8. How We Share Your Information

We do not sell your personal data. We share information only in the limited circumstances described below.

8.1 Service providers and processors

We share data with vendors who help us run Sadhisu, including:

• Cloud hosting and storage providers (Google Cloud / Firebase);
• Authentication providers (Google Sign-In);
• Payment processing and subscription billing (Google Play);
• Analytics and crash-reporting tools (Firebase Analytics, Firebase Crashlytics);
• Push notification delivery (Firebase Cloud Messaging);
• Feedback collection (Google Forms).

Each provider is contractually bound to handle your data confidentially and only for the purposes we authorise.

AI-generated content. Study material, explanations, and practice questions in Sadhisu are generated in advance using AI services, from subject-matter prompts written by us. These prompts describe the exam, subject, and topic — they do not include your name, email, Google account identifier, or payment details. Where a feature sends something you typed, or your selected exam or language, to an AI service in order to answer you, only that input is sent, it is not used to identify you, and we do not permit our AI providers to train their models on it.

8.2 Legal and safety disclosures

We may disclose personal data when we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request; to protect the rights, property, or safety of Sadhisu, our users, or the public; or to prevent fraud, abuse, or violations of our Terms.

8.3 Business transfers

If Sadhisu is involved in a merger, acquisition, restructuring, sale of assets, or insolvency proceeding, your data may be transferred as part of that transaction. We will notify you of any such change in ownership and material change in data handling.

🗄️ 9. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes set out in this Policy, subject to applicable legal, tax, and accounting obligations.

• Account and profile data: Retained while your account is active. When you delete your account from the App settings, your account and study data are deleted immediately from our active systems. Erasure requests sent by email are actioned within 30 days.
• Usage and learning data: Retained while your account is active to provide progress tracking and personalised recommendations. Deleted upon account deletion.
• Payment and subscription records: Retained even after account deletion, as required by applicable tax and accounting law (which may require retention for up to eight years). These records are kept only for legal, tax, and dispute-resolution purposes.
• Log and diagnostic data: Technical logs, crash reports, and security telemetry are retained for short periods — typically between 30 days and 12 months depending on the system — and are then automatically deleted. Payment-related error records are retained for up to one year for dispute resolution. These logs are used solely for security, debugging, and service reliability.
• Anonymised and aggregated analytics: May be retained indefinitely in de-identified form that cannot reasonably be linked to you.

🛡️ 10. Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of data at rest — your account, study, and progress data are stored encrypted on Google Cloud / Firebase infrastructure, using the server-side encryption the provider applies by default;
• Encryption of the app’s offline content cache on your own device;
• Firebase Security Rules to restrict database access to authenticated users only;
• Device attestation (Firebase App Check with Google Play Integrity) to detect unauthorised API access;
• Single-device login enforcement to prevent unauthorised account sharing;
• Server-side purchase validation (Google Play Developer API verification and real-time developer notifications);
• Use of OAuth 2.0 for third-party sign-in flows;
• No storage of passwords — authentication handled entirely by Google Sign-In;
• Incident-response procedures aligned with the DPDP Act and CERT-In directions.

Despite these efforts, no method of transmission over the internet or electronic storage is 100% secure.

Breach notification. If a personal data breach occurs, we will notify you without delay, describing the nature and extent of the breach, its likely consequences, the measures we are taking, and what you can do to protect yourself. We will also report the breach to the Data Protection Board of India within 72 hours of becoming aware of it, as required by the Digital Personal Data Protection Rules, 2025. No severity threshold applies — every personal data breach is reported.

🔍 11. Cookies and Tracking Technologies

On our website. We use first-party cookies and local storage in the following categories:

• Strictly necessary: Required for sign-in, security, and core functionality. These cannot be disabled.
• Functional: Remember your language, theme, and exam preferences.
• Analytics: Help us understand which features are useful and where users get stuck.

In the Android app. The app does not use browser cookies. It stores the equivalent information on your device — your session, preferences, and an encrypted offline cache of study content — in local app storage, and uses a Firebase Installation ID and a Firebase Cloud Messaging token so that analytics, crash reports, and push notifications reach the right installation. These identifiers are reset when you uninstall the app or clear its data.

What we do not use. Sadhisu does not use the Android Advertising ID, advertising cookies, tracking pixels, or any cross-app or cross-site tracking. We do not display advertisements, and we do not share data with advertising networks or data brokers.

You can manage website cookies through your browser settings, and clear app storage through your device settings. Disabling some of these may affect how the Services function.

⚖️ 12. Your Rights and Choices

Subject to applicable law, you have the following rights regarding your personal data.

12.1 Rights under the DPDP Act, 2023 (India)

• Right to access: Obtain a summary of personal data we process about you and the processing activities undertaken.
• Right to correction and erasure: Correct inaccurate or misleading data; complete incomplete data; update or erase data no longer necessary.
• Right to grievance redressal: Raise a grievance with our designated grievance officer (see Section 16).
• Right to nominate: Nominate another individual to exercise your rights in case of death or incapacity.
• Right to withdraw consent: Withdraw consent at any time, with effect for future processing (see Section 7).

12.2 How to exercise your rights

You can act on these rights directly, without waiting for us:

• Withdraw consent or erase your data: use our account deletion page, or Settings → Delete Account in the app.
• Access, correct, or nominate: write to sadhisuapp@gmail.com from the email address registered to your account.
• File a complaint: write to our Grievance Officer at sadhisuapp@gmail.com with “Grievance” in the subject line (see Section 16 below).

We acknowledge every request within 24 hours and act on it within 7 days. A request that requires us to verify your identity or collate records from several systems may take longer, up to a maximum of 30 days; where that happens we will tell you why before the first 7 days are up. We may ask you to verify your identity before acting on a request that would disclose or delete personal data.

12.3 Your choices

• Limit information: You can choose what information to provide. Lack of certain information may limit access to features.
• Manage cookies and notifications: See Section 11 for cookies and app storage, and Section 13 for marketing and push notifications.

📢 13. Marketing Communications

With your consent, we may send product updates, study tips, current-affairs digests, and promotional offers via email or push notification. You can opt out at any time by:

• Clicking the "unsubscribe" link at the bottom of any marketing email;
• Disabling push notifications in your device settings;
• Contacting us at sadhisuapp@gmail.com.

Even after you opt out of marketing, we may still send essential service messages such as payment receipts, security alerts, and important policy updates.

🌐 14. International Data Transfers

Sadhisu primarily stores data on servers located in India (Firebase asia-south1 / Mumbai region). Some of our service providers — including AI infrastructure providers (Google Cloud), content delivery providers (Firebase / Cloudflare), and analytics tools — may process data in other countries, including the United States.

When we transfer personal data outside India, we rely on safeguards permitted under the DPDP Act, 2023 and only to the extent necessary to provide the Service. We do not transfer data to any country that has been notified by the Central Government as restricted under the DPDP Act. Google maintains appropriate safeguards under its data protection frameworks.

📝 15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy;
• Post a prominent notice on our website and within the app;
• Where required by law, obtain your renewed consent before applying the changes to existing data.

Your continued use of the Services after an update constitutes your acceptance of the revised Policy, except where additional consent is required.

📌 16. Contact Us and Grievance Officer

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal data, please contact us:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it becomes operational under the DPDP Act, 2023, or with the relevant authority under the Information Technology Act, 2000.