This policy explains what personal data Aashita Technosoft Private Limited collects through EByAi, why we collect it, who we share it with and what you can do about it. It is written to satisfy the Information Technology (Reasonable Security Practices) Rules 2011 and is structured to meet the Digital Personal Data Protection Act 2023 as its provisions come into force.
If you are under 18, please read Children’s Privacy as well — different rules apply and your parent or guardian must consent.
01Who we are
- Data fiduciary: Aashita Technosoft Private Limited
- Registered address: S8, 2nd Floor, Jagdamba Tower, Amarpali Circle, Vaishali Nagar, Jaipur, Rajasthan 302021
- Contact: hr@aashita.ai · +91 92160 63146
- Grievance officer: Sunny Dhalia — see grievance redressal
02What we collect
You give us:
- Mobile number (this is how you sign in), name, email, date of birth
- A username — the unique public handle other students see you by. We generate one when you register; you can change it. It is display identity only, never a way to sign in.
- Your target exam, class and optionally city and state
- An avatar you select — we do not ask for a photograph
- Anything you type into doubts or community features
Generated as you use the service:
- Questions attempted, answers chosen, time taken, accuracy per chapter
- Mock test attempts and results, bookmarks, revision schedule
- Ranking points and leaderboard position
- Device type, browser, and log data including IP address
For payments: our payment partner processes your card or UPI details. We never see or store full card numbers.
For identity verification (only if you buy a paid plan and this is enabled): data received from DigiLocker with your consent. See Identity Verification for exactly what is received and what is not stored.
03Why we use it
- To run the service — authenticate you, save progress, generate analytics and adaptive practice.
- To take payment — process subscriptions and issue invoices.
- To support you — answer questions and investigate problems.
- To improve the product — aggregate, de-identified statistics about which chapters are hardest.
- To meet legal obligations — tax records, and responding to lawful requests.
04What we do not do
- We do not sell your personal data. Ever.
- We do not run third-party advertising networks on the service.
- We do not do behavioural profiling for advertising — and for users under 18 the DPDP Act prohibits it outright.
- We do not share your results with your school, coaching centre or anyone else without your instruction.
06How we protect it
- Encrypted in transit (HTTPS) throughout.
- Sign-in is by one-time password to your mobile — we do not store a password you could reuse elsewhere.
- Session tokens are short-lived; the long-lived refresh token is an httpOnly cookie a script cannot read.
- Access to production data is limited to staff who need it, and administrative actions are recorded in an audit log.
- Where identity data is handled, identifiers are stored as a keyed hash rather than in the clear.
07If there is a breach
No one can promise this never happens, so here is what we commit to if it does. Under the DPDP Act 2023 and the Digital Personal Data Protection Rules 2025 we will:
- tell you without delay — in plain language, what happened, what data was involved, what it could mean for you, what we have done about it, and what you should do;
- report it to the Data Protection Board of India within the periods the Rules require;
- not wait until we have the full picture to warn you, where waiting would leave you exposed.
If you think you have found a security problem, please tell us privately first: cto@aashita.ai, or see /.well-known/security.txt.
08How long we keep it
- Account and progress data — while your account is active.
- After deletion — removed or irreversibly anonymised within 30 days, except where law requires otherwise.
- Your username — held for the whole 30-day window, so if you change your mind and cancel the deletion you get your handle back rather than finding someone else wearing it. It is released when the account is finally deleted, and is then free for another student to take.
- Payment and tax records — kept as long as tax law requires (up to 8 years).
- Server logs — retained for 90 days, then deleted.
09Your rights
You can:
- Access the personal data we hold about you.
- Correct anything inaccurate — most of it is editable in your profile.
- Erase your account and its data — how to delete your account.
- Withdraw consent — and withdrawing must be as easy as giving it. For analytics that is one click, from Cookie Policy or the footer of any page.
- Nominate someone to exercise these rights if you cannot.
- Complain — to our grievance officer, and then to the Data Protection Board of India.
One limit on correction, stated plainly. Your username is unique across EByAi, so you cannot take one another student already holds. Your first change is free; after that you can change it once every 30 days. The limit is there because a handle is how other students recognise you: one that can be swapped daily is one that can be used to shed a reputation or to step into someone else’s. Everything else on your profile stays editable at any time, and if the handle itself is the problem — it identifies you, or it is being used against you — write to us and we will change it without making you wait.
Email hr@aashita.ai from your registered address. We respond within 48 hours and resolve within one month.
11Children
A large share of our users are under 18, which under the DPDP Act 2023 makes them children. We require verifiable parental consent, and we do not track, profile or advertise to them.
A child’s account has a public username like everyone else’s, and there is no anonymous posting: a doubt a child asks in a community feature carries their handle. So the handle we generate is two ordinary words and a few characters — never derived from a name, a date of birth or a school — and it is never used in an email or SMS we send, never printed on a payment receipt, and never attached to identity verification. If a child has chosen a handle that identifies them offline, a parent or guardian can ask us to change it, and we will, without waiting out the 30-day limit. Full detail is in Children’s Privacy.
12Grievance officer
In accordance with the Information Technology Act 2000 and rules made under it, and the Consumer Protection (E-Commerce) Rules 2020:
- Name: Sunny Dhalia
- Email: cto@aashita.ai
- Address: S8, 2nd Floor, Jagdamba Tower, Amarpali Circle, Vaishali Nagar, Jaipur, Rajasthan 302021
- Acknowledgement: within 48 hours · Resolution: within one month
Full process: grievance redressal.
13Changes to this policy
We will update this page as the service and the law change, and will notify you in the app or by email where a change is material. The date at the top always reflects the current version.