Privacy Policy
Version 1.0 · Last updated: 22 March 2026
StudAI Loop ("we", "us", "our") operates the studai.ai website and learning platform. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
1. Data We Collect & Why
| Category | Data Collected | Purpose | Retention |
|---|---|---|---|
| Account | Name, email, hashed password | Create and authenticate your account | Until account deletion + 30 days |
| Learning Profile | Goals, time preferences, persona traits | Personalise your learning journey | Until account deletion |
| Learning Activity | Sessions, quiz answers, mastery scores, chapter progress | Deliver adaptive content and measure mastery | Until account deletion |
| AI Interactions | Prompts sent to AI, generated lessons & quizzes | Generate personalised learning content | Until account deletion |
| Billing | Plan, payment status, Razorpay IDs | Process payments and manage subscriptions | 7 years (legal requirement) |
| Credentials (VSI) | Verified skill credentials, assessment evidence | Issue and verify skill certificates | Permanent (verification endpoint) |
| Technical | IP address, user agent, request logs | Security, rate limiting, debugging | 90 days |
| Consent | Consent timestamps, versions, IP at consent | DPDP Act compliance proof | 7 years |
2. How AI Processes Your Data
StudAI Loop uses Amazon Bedrock (AWS) to generate personalised lessons, quizzes, and skill assessments. Your learning data (goals, quiz responses, mastery scores) is sent to Azure OpenAI for content generation. This data is:
- Processed within Microsoft's Azure infrastructure (data residency: your region)
- Not used by Microsoft to train models — we use the Amazon Bedrock Runtime, protected by AWS IAM and Bedrock Guardrails
- Handled according to the configured Amazon Bedrock data-protection terms
You must explicitly consent to AI data processing during signup. You may withdraw this consent at any time (see Section 6), which will trigger account deletion.
3. Third-Party Processors
| Processor | Purpose | Data Shared |
|---|---|---|
| Microsoft Azure | Cloud infrastructure, AI processing, data storage | All application data (encrypted at rest & in transit) |
| Razorpay | Payment processing | Email, plan selection (Razorpay handles card data directly) |
| Sentry | Error tracking | Technical error data (no PII by design) |
4. Data Retention
- Learning data: retained while your account is active
- Billing records: 7 years after transaction (legal requirement under Income Tax Act, GST Act)
- Skill credentials: retained permanently for employer verification (anonymised after account deletion)
- Technical logs: 90 days
- After account deletion: all personal data is deleted or anonymised within 30 days, except billing records and credential verification data
5. Data Security
- All data encrypted at rest (Azure Cosmos DB) and in transit (TLS 1.2+)
- Passwords hashed with bcrypt (never stored in plaintext)
- JWT-based authentication with token expiry
- Rate limiting per user to prevent abuse
- Audit logging for all sensitive operations
- Azure Key Vault for secret management
6. Your Rights Under the DPDP Act 2023
As a Data Principal, you have the right to:
- Access — Export all your data (Settings → Privacy → Export Data)
- Correction — Request correction of inaccurate personal data
- Erasure — Request deletion of your account and data (30-day grace period)
- Withdraw Consent — Revoke any consent at any time (may affect service access)
- Portability — Download your data in machine-readable format (JSON/ZIP)
- Grievance Redressal — Contact our Data Protection Officer
7. Consent
We obtain your explicit consent for all data processing at signup. Three consents are mandatory to use the platform:
- Privacy Policy acceptance
- Terms of Service acceptance
- Data processing consent (for AI-powered features)
Marketing email consent is optional. All consent actions are timestamped with your IP address and stored as audit records.
8. Children's Data
StudAI Loop is designed for users aged 16 and above. We do not knowingly collect data from children under 16. If you believe a child under 16 has registered, please contact our DPO immediately.
9. Data Protection Officer
Paul Joseph — Data Protection Officer
Email: dpo@studai.ai
Response time: within 30 days of receiving your request, as required by the DPDP Act 2023.
10. Grievance Redressal
If you have a complaint about how we handle your data, contact our DPO at dpo@studai.ai. If your complaint is not resolved within 30 days, you may escalate to the Data Protection Board of India as established under the DPDP Act 2023.
11. Changes to This Policy
We will notify you of material changes via email and an in-app banner. Continued use after notification constitutes acceptance of the updated policy. If you disagree, you may delete your account.
© 2026 StudAI Loop. All rights reserved.