Privacy Policy

📘 1. Introduction

Sadhisu ("Sadhisu", "we", "us", or "our") is a bilingual (English / Kannada) educational technology platform that helps aspirants prepare for Karnataka government competitive examinations — including KAS, PSI, FDA, SDA, PC, TET, Group C, HSTR, GPSTR, and KSET. Our service provides study materials, practice tests, previous year papers, current affairs, audio lessons, video lessons, and AI-generated content to support exam preparation — operating on a Learn → Practice → Track → Improve learning loop.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, use the Sadhisu Android application, subscribe to Sadhisu Premium, or otherwise interact with our services (collectively, the "Services").

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and the Information Technology Act, 2000 and the rules made thereunder. By accessing or using our Services, you confirm that you have read, understood, and agreed to the practices described in this Policy.

If you do not agree with any provisions of this Policy, please do not use the Services.

🏛️ 2. Who We Are (Data Fiduciary Details)

For the purposes of the DPDP Act, 2023, Sadhisu ("we", "us", or "our") acts as the Data Fiduciary in respect of the personal data we collect from you.

📋 3. Scope of This Policy

This Policy applies to all users of Sadhisu, including:

• Visitors browsing the Sadhisu website;
• Registered users who create a Sadhisu account using Google Sign-In;
• Users of the Sadhisu Android application;
• Subscribers to Sadhisu Premium or any other paid plan;
• Individuals who contact us via email, feedback forms, or social media;
• Participants in promotional campaigns, surveys, or beta programs.

This Policy does not apply to third-party websites, applications, or services that may be linked from our platform. We encourage you to review the privacy policies of those third parties separately.

📂 4. Information We Collect

We collect personal data and usage information that is reasonably necessary to deliver, secure, and improve the Sadhisu Services. The categories of information we collect are described below.

4.1 Information You Provide Directly

• Account information: Name, email address, profile photo, and Google account identifier provided when you sign in using Google Sign-In.
• Profile information: Target examination (e.g., KAS, PSI, FDA, TET), language preference (English / Kannada), and any other details you choose to add to your profile.
• User-generated content: Bookmarks, flagged questions, feedback, support queries, and any content you share within the app.
• Payment information: Billing name, contact details, and subscription history. Card numbers, UPI IDs, net-banking credentials, and similar payment instruments are collected and processed by our PCI DSS-compliant payment partner (Razorpay) and are never stored on Sadhisu servers.
• State of residence: Collected once at the time of purchase for tax compliance (GST place of supply) and shown on your invoice.
• Communication data: Messages, emails, and feedback form submissions you send to us.

4.2 Information Collected Automatically

• Device information: Device model, manufacturer, operating system and version (e.g., Android 14), unique device identifiers, screen resolution, language, time zone, and mobile network operator.
• App and usage data: Screens viewed, features used, tests attempted, quiz scores, time spent on questions, accuracy rates, streaks, session duration, click events, crashes, and performance metrics.
• Log data: IP address, browser type and version, referring URL, date and time stamps, and diagnostic data.
• Cookies and local storage: First-party cookies, local storage, and encrypted IndexedDB cache used for offline functionality, session management, and preferences.

4.3 Information from Third Parties

• Google Sign-In: When you authenticate using Google, we receive your name, email, Google profile photo URL, and a unique Google user ID, in accordance with the permissions you grant in the Google consent screen.
• Analytics partners: Aggregated and pseudonymised information from analytics providers such as Firebase Analytics and similar tools.
• Payment processors: Transaction status, payment confirmation, and similar limited information from Razorpay for reconciliation and fraud prevention.

👶 5. Children's Data

Sadhisu is intended for individuals aged 18 years and above who are preparing for or aspiring to write competitive examinations. We do not knowingly collect personal data from children under 18 without verifiable parental consent.

If you are a parent or guardian and you believe that a child under 18 has provided personal information to Sadhisu without your consent, please contact us at sadhisuapp@gmail.com and we will take prompt steps to delete that information in accordance with the DPDP Act, 2023.

🔧 6. How We Use Your Information

We use your information for the following purposes:

• Provide the Service: Enable access, authenticate users, process subscriptions, deliver study content, track learning progress, and provide customer support.
• Improve the Platform: Analyse usage patterns, identify bugs, measure feature adoption, and develop new features and content.
• Maintain safety and security: Prevent fraud, investigate misuse, enforce single-device login policy, enforce our Terms, and protect user safety.
• Communicate: Send payment receipts, subscription confirmations, service updates, and (with your consent) study tips and current-affairs digests.

We do not sell, trade, or otherwise exploit your personal information to others. We do not use Personal Information for automated decision-making or profiling beyond what is described in this Policy.

✅ 7. Consent

By creating an account on Sadhisu, you provide your informed consent for us to collect, store, and process your personal data as described in this Policy. Specifically:

• You consent to the collection of your name and email via Google Sign-In for account creation and authentication.
• You consent to the storage of your usage data (quiz scores, progress, bookmarks, streaks) on Firebase for delivering the Service.
• You consent to the processing of your payment information by Razorpay for subscription management.
• You consent to receiving push notifications via Firebase Cloud Messaging. You may disable push notifications at any time through your device settings.

You may withdraw your consent at any time by deleting your account from the App settings or by contacting us at sadhisuapp@gmail.com. Withdrawal of consent will result in deletion of your account and data, and you will no longer be able to use the Service.

🔗 8. How We Share Your Information

We do not sell your personal data. We share information only in the limited circumstances described below.

8.1 Service providers and processors

We share data with vendors who help us run Sadhisu, including:

• Cloud hosting and storage providers (Google Cloud / Firebase);
• Content delivery and media hosting (Cloudflare R2);
• Authentication providers (Google Sign-In);
• Payment processors (Razorpay);
• Analytics and crash-reporting tools (Firebase Analytics, Firebase Crashlytics);
• Push notification delivery (Firebase Cloud Messaging);
• Feedback collection (Google Forms).

Each provider is contractually bound to handle your data confidentially and only for the purposes we authorise. No user personal data is sent to AI models — only content generation prompts.

8.2 Legal and safety disclosures

We may disclose personal data when we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request; to protect the rights, property, or safety of Sadhisu, our users, or the public; or to prevent fraud, abuse, or violations of our Terms.

8.3 Business transfers

If Sadhisu is involved in a merger, acquisition, restructuring, sale of assets, or insolvency proceeding, your data may be transferred as part of that transaction. We will notify you of any such change in ownership and material change in data handling.

🗄️ 9. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes set out in this Policy, subject to applicable legal, tax, and accounting obligations.

• Account and profile data: Retained while your account is active. When you delete your account from the App settings, your account and study data are deleted immediately from our active systems. Erasure requests sent by email are actioned within 30 days.
• Usage and learning data: Retained while your account is active to provide progress tracking and personalised recommendations. Deleted upon account deletion.
• Payment and subscription records: Retained even after account deletion, as required by applicable tax and accounting law (which may require retention for up to eight years). These records are kept only for legal, tax, and dispute-resolution purposes.
• Log and diagnostic data: Technical logs, crash reports, and security telemetry are retained for short periods — typically between 30 days and 12 months depending on the system — and are then automatically deleted. Payment-related error records are retained for up to one year for dispute resolution. These logs are used solely for security, debugging, and service reliability.
• Anonymised and aggregated analytics: May be retained indefinitely in de-identified form that cannot reasonably be linked to you.

🛡️ 10. Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Firebase Security Rules to restrict database access to authenticated users only;
• Device attestation (Firebase App Check with Google Play Integrity) to detect unauthorised API access;
• Single-device login enforcement to prevent unauthorised account sharing;
• Server-side payment validation (Razorpay webhook verification with server-side pricing);
• Use of OAuth 2.0 for third-party sign-in flows;
• No storage of passwords — authentication handled entirely by Google Sign-In;
• Incident-response procedures aligned with the DPDP Act and CERT-In directions.

Despite these efforts, no method of transmission over the internet or electronic storage is 100% secure. In the event of a personal-data breach that is likely to result in significant risk to you, we will notify the Data Protection Board of India and affected users in accordance with the DPDP Act, 2023.

🍪 11. Cookies and Tracking Technologies

Our website and app use cookies and similar technologies to operate the Services, remember your preferences, and analyse usage. The categories we use are:

• Strictly necessary: Required for sign-in, security, and core functionality. These cannot be disabled.
• Functional: Remember your language, theme, and exam preferences.
• Analytics: Help us understand which features are useful and where users get stuck.

Sadhisu does not use advertising cookies or tracking pixels. We do not display advertisements within the app.

You can manage cookies through your browser settings or your device settings. Disabling certain cookies may affect the functionality of the Services.

⚖️ 12. Your Rights and Choices

Subject to applicable law, you have the following rights regarding your personal data.

12.1 Rights under the DPDP Act, 2023 (India)

• Right to access: Obtain a summary of personal data we process about you and the processing activities undertaken.
• Right to correction and erasure: Correct inaccurate or misleading data; complete incomplete data; update or erase data no longer necessary.
• Right to grievance redressal: Raise a grievance with our designated grievance officer (see Section 16).
• Right to nominate: Nominate another individual to exercise your rights in case of death or incapacity.
• Right to withdraw consent: Withdraw consent at any time, with effect for future processing.

12.2 How to exercise your rights

To exercise any of these rights, write to sadhisuapp@gmail.com from the email address associated with your account, or use the in-app account deletion feature. We will respond within the timelines required by applicable law (typically within 30 days).

12.3 Your choices

• Limit information: You can choose what information to provide. Lack of certain information may limit access to features.
• Manage notifications: Disable push notifications at any time through your device settings.
• Reject cookies: You may reject or remove cookies via browser settings, but some features may not function properly.
• Delete account: You can delete your account from the App settings at any time. This permanently removes your data from our active systems.

📢 13. Marketing Communications

With your consent, we may send product updates, study tips, current-affairs digests, and promotional offers via email or push notification. You can opt out at any time by:

• Clicking the "unsubscribe" link at the bottom of any marketing email;
• Disabling push notifications in your device settings;
• Contacting us at sadhisuapp@gmail.com.

Even after you opt out of marketing, we may still send essential service messages such as payment receipts, security alerts, and important policy updates.

🌐 14. International Data Transfers

Sadhisu primarily stores data on servers located in India (Firebase asia-south1 / Mumbai region). Some of our service providers — including AI infrastructure providers (Google Cloud), content delivery (Cloudflare), and analytics tools — may process data in other countries, including the United States.

When we transfer personal data outside India, we rely on safeguards permitted under the DPDP Act, 2023 and only to the extent necessary to provide the Service. We do not transfer data to any country that has been notified by the Central Government as restricted under the DPDP Act. Google and Cloudflare maintain appropriate safeguards under their respective data protection frameworks.

📝 15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy;
• Post a prominent notice on our website and within the app;
• Where required by law, obtain your renewed consent before applying the changes to existing data.

Your continued use of the Services after an update constitutes your acceptance of the revised Policy, except where additional consent is required.

📌 16. Contact Us and Grievance Officer

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal data, please contact us:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it becomes operational under the DPDP Act, 2023, or with the relevant authority under the Information Technology Act, 2000.

✍️ 17. Acknowledgement

By creating an account, downloading the Sadhisu Android app, subscribing to Sadhisu Premium, or otherwise using our Services, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree, please do not use the Services.