Privacy Policy

1. Who we are and what this policy covers

Quala Labs ("we", "us") provides a coding classroom platform for schools. This policy explains how we handle personal data in line with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP law"), and the Information Technology Act, 2000.

We handle personal data in two different roles, and this policy makes clear which applies:

2. The personal data we collect

When you contact us or register a school

Data	Where it comes from
Your name, school, role and work email	The walkthrough form on our home page
Your name, role, work email and, if you choose, phone number, city and state	The school registration form
Anything you choose to write in a message to us	Forms and email
Billing details: school name, state and payment reference	The checkout in the principal console. Card and bank details are entered with Razorpay and never reach us.

Inside the platform, on behalf of schools

Category	Examples
Account data	Names, school email addresses, roles, classes, and a securely hashed password
Learning records	Code written, submissions, test results, marks, teacher feedback and rubric scores
Live class participation	The name a student types to join, attendance, answers, requests for help and a log of session events
Examination conduct data	Tab switches, fullscreen exits, device binding records and integrity flags, collected only during examinations and supervised assignments
Supervised assignment recordings	Low-resolution camera video with no audio, only when a teacher has chosen a supervised assignment
AI hint history	Where the school's plan includes AI, the hints a student asked for and received. Teachers can see this history.
Technical data	IP address, browser type and security logs, used to keep the Service secure and to stop abuse

3. Why we use it

• To reply to enquiries and arrange walkthroughs.
• To review and approve school registrations, and to set up the administrator's account.
• To provide, maintain and secure the Service, including preventing fraud and abuse.
• To bill schools, issue invoices and meet our tax and accounting obligations.
• To send service messages, such as account set-up links, invoices, renewal reminders and important changes. We do not send marketing to students.

We process data you give us through our forms on the basis of your consent, which you can withdraw at any time, and for the other legitimate uses the DPDP law allows, such as complying with law. We process school data on the basis of the school's instructions.

4. Children

Many students who use Quala Labs are under eighteen. Their data is collected and controlled by their school, which is responsible for any consent required from parents or guardians. In addition:

• We never direct advertising at children, and never track or profile children for any purpose of our own.
• Integrity monitoring, such as tab-switch records and supervised assignment recordings, happens only during assessments, only for the school's educational activities and only at the school's direction, as the DPDP Rules permit for educational institutions.
• Students never receive marketing from us.

5. Who we share it with

We do not sell personal data, and we do not share it for advertising. We share it only with service providers who help us run the Service, under contracts that limit their use of it, and where the law requires.

Provider	Purpose	Data involved
Our cloud hosting provider	Servers that run the Service and store its data	All platform data, encrypted in transit
Razorpay	Payment processing	Payment details entered with Razorpay, amounts and payment references
Brevo	Sending service emails, such as set-up links and invoices	Recipient name and email address, email content
Zoho Mail	Our business mailbox	Emails you send to us
Groq	AI features, only for schools whose plan includes them	The question, the relevant code and test results. Never student names or contact details.
Google Fonts	Typefaces on our website	Your IP address and browser details, when the website loads

Some providers process data outside India. Where they do, we rely on the cross-border transfer rules of the DPDP law and choose providers who protect data to a standard consistent with this policy.

6. How long we keep it

Data	How long
Website enquiries that do not lead to an account	Up to 24 months, then deleted
School and administrator account data	While the school's account is open, then as set out in the Data Processing Addendum
Learning records: code, submissions and marks	While the school's account is open, as part of the school's academic record, unless the school deletes them sooner
Examination conduct data and live class activity logs	90 days by default. The school can choose any period from 30 to 365 days.
Supervised assignment recordings	Deleted once the teacher has finished marking, and never kept for more than 30 days
Invoices and payment records	As long as Indian tax and accounting law requires, currently up to eight years
Security logs	Kept only as long as needed to protect the Service, and as the law requires

7. How we protect it

We protect personal data with technical and organisational safeguards that include encryption in transit, securely hashed passwords, strict separation of each school's data, role-based access, isolated environments for running code and append-only audit records. Read more on our Security page. If a personal data breach occurs, we will inform affected schools and individuals and the Data Protection Board of India as the DPDP law requires.

8. Your rights

Under the DPDP law you have the right to:

• Access a summary of the personal data we hold about you and how it is used;
• Correct, complete or update inaccurate or incomplete data;
• Erase data that is no longer needed, or that you withdraw consent for;
• Withdraw consent at any time, as easily as you gave it, without affecting processing already done;
• Nominate another person to exercise your rights if you die or become incapacitated; and
• Seek redress through our grievance process, and then from the Data Protection Board of India.

If you are a teacher or student, your school controls your data in the platform. Please contact your school first. If you contact us, we will pass your request to your school and help it respond.

9. Grievance Officer

10. Cookies

Our website and platform do not use advertising or analytics cookies. See our Cookie Policy.

11. Changes to this policy

We will update this policy when our practices or the law change. Every version is numbered and dated at the top of this page, and we will tell schools about material changes in advance.