Privacy Policy

1. Introduction

Welcome to The Academix (“we,” “our,” or “us”). We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our learning management system platform and services (collectively, the “Services”).

The Academix provides educational technology services primarily to educational institutions, schools, universities, corporations, and individual trainers (our “Institutional Customers”), who in turn provide access to learners and students (“End Users”).

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Services.

Contact Information: The Academix, 67, Ajit Colony, Jodhpur, 342001, Rajasthan, India. Email: [email protected]. Website: www.theacademix.com.

2. Scope of This Policy

This Privacy Policy applies to:

• Institutional Customers (educational institutions, schools, universities, corporations, training centers, individual trainers)
• End Users (students, learners, employees accessing the platform through Institutional Customers)
• Parents and guardians whom an Institutional Customer gives access to the parent portal
• Visitors to our website
• Any other individuals whose personal information we process

3. Information We Collect

3.1 Information Collected from Institutional Customers

When you register as an Institutional Customer, we collect:

• Institution name, type, and registration details
• Administrator contact information (name, email address, designation)
• Billing information and payment details
• Branch information and organizational structure
• Course and curriculum data
• Staff and tutor information
• Technical configuration preferences
• Communication and correspondence records

3.2 Information Collected from End Users

When Institutional Customers add End Users to the platform, we collect:

• Full name and student/employee identification numbers
• Email address
• Profile information (as configured by the institution)
• Course enrollment data
• Academic records and performance data
• Assignment submissions and assessment results
• Attendance records
• Learning progress and activity logs
• Discussion board posts and communications
• Device information and IP addresses

3.3 Information about Parents and Guardians

When an Institutional Customer turns on the parent portal and adds a parent or guardian, we collect:

• Name
• Mobile number (with country code)
• Email address, if the institution provides one
• Which student or students the parent or guardian is linked to

When the parent or guardian activates their account, we also record:

• A password, stored only as a one-way hash
• Their acceptance of the data notice shown at activation, and when they accepted it
• Session information and when they last used the portal
• Callback requests they choose to make (a reason picked from a fixed list), where the institution has turned this on

3.4 Information Collected Automatically

We automatically collect certain information when you use our Services:

• Log data (IP address, browser type, operating system)
• Device information (device type, unique device identifiers)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies
• Session information
• Performance and diagnostic data

3.5 Information from Third-Party Sources

We may receive information from:

• Payment processors (transaction details, payment status)
• Third-party authentication services (Google, Microsoft, etc.)
• Video conferencing platforms (Google Meet, BigBlueButton)
• Cloud storage services (Google Drive)
• Plagiarism detection services (Copyleaks)
• Analytics service providers
• Advertising platforms (Google Ads, for conversion tracking)

4. How We Use Your Information

4.1 For Institutional Customers

We use information from Institutional Customers to:

• Provide, maintain, and improve our Services
• Create and manage institutional accounts
• Process payments and manage subscriptions
• Provide customer support and respond to inquiries
• Send service updates, technical notices, and administrative messages
• Monitor and analyze usage patterns to improve functionality
• Ensure platform security and prevent fraud
• Comply with legal obligations
• Develop new features and services

4.2 For End Users

We use End User information to:

• Facilitate access to courses and learning materials
• Track learning progress and performance
• Enable communication between tutors and students
• Generate assessments and provide feedback
• Issue certificates and credentials
• Maintain attendance records
• Provide personalized learning experiences
• Generate analytics for educational improvement
• Enable collaboration and discussion features

4.3 Communications

We may send you:

• Service-related announcements and updates
• Course notifications and reminders
• Assignment and assessment notifications
• Technical updates and security alerts
• Responses to your inquiries and support requests

Note: Marketing communications are sent only with your explicit consent and you can opt out at any time.

5. Legal Basis for Processing (GDPR Compliance)

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar data protection laws, we process personal information based on:

• Contractual Necessity: To fulfill our contractual obligations to Institutional Customers
• Legitimate Interests: To improve our Services, ensure security, and provide customer support
• Legal Compliance: To comply with applicable laws and regulations
• Consent: Where required by law, we obtain explicit consent for specific processing activities

6. How We Share Your Information

6.1 Within the Platform

• Institutional administrators can access information about their End Users
• Tutors can access information about students in their assigned classes
• Students can view their own academic records and performance data
• Parents and guardians can view the information about their own linked child that the institution has chosen to share in the parent portal (see Section 19.8)
• Certain information may be shared within discussion boards and collaborative features

6.2 With Third-Party Service Providers

We share information with trusted third-party providers who assist us in operating our Services:

• Cloud Infrastructure: DigitalOcean (application servers and database, in Bengaluru, India); Cloudflare (storage of uploaded files and videos on Cloudflare R2, content delivery, and hosting of our web apps); Amazon Web Services (a backup copy of uploaded files, video processing, encryption key management, and hosting of the parent portal)
• Payment Processors: Razorpay and Stripe, for processing subscription payments and transactions
• Video Conferencing: Google Meet for live classes; BigBlueButton runs on a server the institution itself connects
• Messaging and Push Notifications: Google Firebase (Cloud Firestore stores in-app chat and discussion messages; Firebase Cloud Messaging delivers mobile app notifications)
• AI Services: Google (Gemini API), for the AI-assisted features described in Section 19.9
• Plagiarism Detection: Copyleaks for academic integrity
• Analytics Providers: For usage analytics and platform improvement
• Advertising Providers: Google Ads for conversion tracking and remarketing (see Section 12.4)
• Email Service Providers: Brevo, for sending notifications and communications, including the parent weekly summary
• Content Delivery Networks: Cloudflare and Amazon CloudFront, for efficient content distribution

All third-party providers are contractually obligated to protect your information and use it only for the purposes we specify.

6.3 For Legal Reasons

We may disclose information when required by law or when we believe disclosure is necessary to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service and other agreements
• Protect the rights, property, or safety of The Academix, our users, or others
• Prevent fraud, security issues, or technical problems
• Respond to claims of violation of third-party rights

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have.

6.5 With Your Consent

We may share information for any other purpose with your explicit consent.

7. Data Retention

7.1 Institutional Customer Data

We retain Institutional Customer data for as long as:

• The subscription remains active
• Required to provide Services
• Required by law or regulatory obligations
• Necessary for legitimate business purposes

Upon termination of service, we will:

• Provide a data export option within 30 days
• Delete or anonymize data after 90 days, unless legally required to retain longer
• Maintain financial records as required by applicable tax and accounting laws

7.2 End User Data

End User academic records, performance data, and learning materials are retained according to:

• Institutional Customer’s retention policies and instructions
• Legal and regulatory requirements for educational records
• Standard educational record-keeping practices

Students and learners may request deletion of their personal information, subject to:

• Institutional policies and requirements
• Legal obligations to maintain educational records
• Legitimate institutional needs for academic integrity

7.3 Backup and Archive Data

Backup copies may persist for up to 90 days after deletion from active systems.

8. Data Security

8.1 Security Measures

We implement comprehensive security measures to protect your information:

Technical Safeguards:

• Industry-standard encryption for data in transit (SSL/TLS)
• Encryption for sensitive data at rest
• Secure authentication and session management
• Regular security patches and updates
• Firewall protection and intrusion detection
• DDoS mitigation through Cloudflare for our websites, web apps, and file and video delivery
• Lecture videos streamed as encrypted adaptive (HLS) segments, with the key issued only to signed-in, enrolled users

Administrative Safeguards:

• Role-based access controls
• Regular security audits and assessments
• Employee training on data protection
• Incident response procedures
• Vendor security assessments

Physical Safeguards:

• Secure data centers with restricted access, operated by our hosting providers (DigitalOcean, Cloudflare, and AWS)
• Environmental controls and monitoring
• Redundant systems and backup procedures

8.2 Hosting Providers

Our platform runs on infrastructure operated by DigitalOcean, Cloudflare, and Amazon Web Services (AWS). Each of these providers maintains its own security and compliance programme and publishes its own independent audit reports and certifications. Those certifications belong to the providers; they are not certifications of The Academix itself.

8.3 User Responsibilities

You are responsible for:

• Maintaining the confidentiality of your account credentials
• Using strong, unique passwords
• Reporting any unauthorized access immediately
• Ensuring your devices are secure

8.4 Limitations

While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your information. You use our Services at your own risk.

9. Your Rights and Choices

9.1 Access and Portability

You have the right to:

• Access your personal information
• Request a copy of your data in a portable format
• Review and verify the accuracy of your information

9.2 Correction and Update

You can:

• Update your account information through the platform
• Request correction of inaccurate information
• Contact us to update information you cannot change directly

9.3 Deletion

You may request deletion of your personal information, subject to:

• Legal obligations to retain certain records
• Institutional policies for academic records
• Legitimate business needs

For End Users, deletion requests must typically be coordinated with your Institutional Customer.

9.4 Objection and Restriction

You have the right to:

• Object to certain types of processing
• Request restriction of processing in specific circumstances
• Opt out of marketing communications

9.5 Data Portability (GDPR)

EU/EEA users can request their data in a structured, commonly used, machine-readable format.

9.6 Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

9.7 How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected] with:

• Your name and contact information
• Description of your request
• Verification of your identity
• Relevant account or user information

We will respond to verified requests within 30 days (or as required by applicable law).

10. Children’s Privacy

10.1 General Policy

The Academix is designed for use by educational institutions that serve users of all ages, including minors under 13 (or the applicable age of digital consent in your jurisdiction).

10.2 Institutional Responsibility

When Institutional Customers provide access to minors:

• The institution is responsible for obtaining necessary parental consent
• The institution must comply with applicable children’s privacy laws (COPPA, GDPR, etc.)
• We act as a service provider to the educational institution

10.3 Parental Rights

Parents and guardians may contact the Institutional Customer to:

• Review their child’s personal information
• Request deletion of their child’s information
• Refuse further collection of their child’s information

Where the institution has turned on the parent portal, a parent or guardian with a portal account can also see their child’s information there (see Section 19.8), and can ask the institution to correct their own details or remove their access.

10.4 Limited Use

Information collected from children is used solely for educational purposes as directed by the Institutional Customer.

11. International Data Transfers

11.1 Data Location

Our application servers and primary database are located in DigitalOcean’s data center in Bengaluru, India. Your data may be processed and stored in:

• India (Bengaluru): application servers and database
• Cloudflare’s global network: uploaded files and videos (Cloudflare R2, at a storage location Cloudflare selects automatically, which is not restricted to India) and their delivery through Cloudflare’s content delivery network
• United States: a backup copy of uploaded files (Amazon S3), video processing (AWS Lambda), and encryption key management (AWS Key Management Service), in AWS’s US East region
• Other countries where the service providers listed in Section 6.2 operate (for example Google, for chat messages, push notifications, and AI-assisted features; Brevo, for email)

11.2 Cross-Border Transfers

Wherever you are located, your information may be transferred to and processed in India, the United States, or other countries where our service providers operate, as described in Section 11.1.

11.3 Transfer Safeguards

For international transfers, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Our service providers’ data processing terms and their compliance with international data protection frameworks
• Adequate security measures to protect data in transit and at rest

11.4 EU-India Transfers

For users in the European Union, we ensure appropriate safeguards are in place for data transfers to India through contractual commitments and technical measures.

12. Cookies and Tracking Technologies

12.1 Types of Cookies We Use

Essential Cookies:

• Authentication and security
• Session management
• Platform functionality

Performance Cookies:

• Usage analytics
• Error tracking
• Performance monitoring

12.2 How We Use Cookies

• Authenticate users and maintain sessions
• Remember user preferences and settings
• Analyze platform usage and performance
• Improve user experience
• Ensure security and prevent fraud

12.3 Third-Party Cookies

We may use third-party analytics and service providers that place cookies on your device. These parties have their own privacy policies.

12.4 Google Ads and Advertising Cookies

We use Google Ads, including Google’s tag (gtag.js), to measure the effectiveness of our advertising and understand how visitors reach our website. This involves:

• Placing conversion-tracking cookies on your device when you arrive at our website from a Google ad
• Sharing limited technical data (such as your IP address, browser information, and the pages you visit) with Google for conversion measurement and remarketing
• Using Google Consent Mode, which by default restricts ad-related cookies and data sharing until you respond to our cookie consent banner

You can control ad personalization and Google’s use of your data by:

• Choosing “Decline” in our cookie consent banner
• Adjusting your preferences at Google Ads Settings
• Installing the Google Analytics Opt-out Browser Add-on

Google’s privacy policy, describing how it processes data collected through its advertising products, is available at policies.google.com/privacy.

12.5 Cookie Management

You can control cookies through:

• Browser settings (disable, delete, or block cookies)
• Opt-out tools provided by third-party services

Note: Disabling essential cookies may affect platform functionality.

12.6 Do Not Track

We currently do not respond to “Do Not Track” signals from browsers, as there is no industry standard for handling such signals.

13. Third-Party Services and Links

13.1 Integrated Services

Our platform integrates with third-party services including:

• Google Meet and BigBlueButton (video conferencing)
• Google Calendar (live-class scheduling; see section 19.7)
• Google Drive (content storage)
• Google Gemini (AI-assisted features; see section 19.9)
• Google Firebase (in-app chat and mobile app notifications)
• Copyleaks (plagiarism detection)
• YouTube and Vimeo (video content)
• Payment processors

Each service has its own privacy policy and terms of service.

13.2 External Links

Our Services may contain links to third-party websites or resources. We are not responsible for the privacy practices of these external sites.

13.3 Content Imports

When you import content from third-party platforms, that content becomes subject to this Privacy Policy once stored on our platform.

14. Institutional Customer Responsibilities

14.1 Data Controller Obligations

Institutional Customers are data controllers for End User information and must:

• Obtain necessary consents and provide privacy notices to End Users
• Comply with applicable data protection laws
• Have a lawful basis for processing End User data
• Respond to End User privacy requests
• Ensure they have rights to upload and share content
• Maintain appropriate security for their account credentials

14.2 Instructions to The Academix

We process End User data according to Institutional Customer instructions through:

• Platform configuration and settings
• User management and access controls
• Content and course management

14.3 Data Processing Agreement

For Institutional Customers subject to GDPR or similar laws, a Data Processing Agreement (DPA) is available upon request and may be required.

15. Changes to This Privacy Policy

15.1 Updates

We may update this Privacy Policy from time to time to reflect:

• Changes in our practices
• Changes in applicable laws
• New features or services
• User feedback and improvements

15.2 Notification

We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the “Last Updated” date
• Sending email notifications to Institutional Customers
• Displaying a prominent notice on the platform

15.3 Continued Use

Your continued use of the Services after changes become effective constitutes acceptance of the updated Privacy Policy.

15.4 Review

We encourage you to review this Privacy Policy periodically.

16. Specific Regional Provisions

16.1 European Economic Area (EEA) and United Kingdom

For users in the EEA and UK:

• Legal basis for processing as outlined in Section 5
• Rights under GDPR as outlined in Section 9
• Right to lodge a complaint with your supervisory authority
• Data Protection Officer contact: [email protected]

16.2 India

For users in India:

• Compliance with Information Technology Act, 2000 and Rules
• Reasonable security practices as per applicable law
• Data retention as per legal requirements

16.3 California Privacy Rights (CCPA)

For California residents:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of sale of personal information
• Right to deletion
• Right to non-discrimination

We do not sell personal information to third parties.

16.4 Other Jurisdictions

We comply with applicable data protection laws in jurisdictions where we operate.

17. Data Breach Notification

17.1 Our Commitment

In the event of a data breach that affects your personal information:

• We will investigate and assess the breach
• Take immediate steps to mitigate harm
• Notify affected parties as required by law
• Notify relevant supervisory authorities if required

17.2 Notification Timeline

We will notify affected Institutional Customers and individuals without undue delay and within legally required timeframes (typically 72 hours for GDPR-covered breaches).

17.3 Institutional Responsibility

Institutional Customers are responsible for notifying their End Users of breaches as required by applicable law.

18. Contact Us and Complaints

18.1 Privacy Questions

For questions about this Privacy Policy or our privacy practices:

• Email: [email protected]
• Address: The Academix, 67, Ajit Colony, Jodhpur, 342001, Rajasthan, India
• Website: www.theacademix.com

18.2 Privacy Requests

To exercise your privacy rights, email [email protected] with:

• Subject line: “Privacy Request”
• Your name and contact information
• Description of your request
• Verification information

18.3 Complaints

If you have a complaint about our privacy practices:

• Contact us using the information above
• We will investigate and respond within 30 days

18.4 Supervisory Authority

EEA and UK users have the right to lodge a complaint with their data protection supervisory authority.

19. Specific Data Processing Activities

19.1 Educational Records

Academic records, grades, assessments, and performance data are:

• Processed to provide educational services
• Accessible to authorized institutional administrators and tutors
• Retained according to institutional and legal requirements
• Protected with role-based access controls

19.2 Communication Data

Messages, discussion board posts, and other communications:

• Are accessible to relevant participants and institutional administrators
• May be monitored for security and compliance purposes
• Are retained according to institutional policies

19.3 Video and Live Classes

For integrated video conferencing (Google Meet, BigBlueButton):

• Third-party privacy policies apply
• Recording and attendance automation for Google Meet is available only when an institute administrator explicitly connects their institution's Google Workspace account; it is off by default
• When connected, we access Google Meet conference metadata (space and conference record identifiers), participant join/leave records, and recording/transcript availability via the Google Meet API
• Meeting recordings and transcripts are not downloaded or stored on our servers — we store a link to the file hosted in the institute's own Google Drive, which opens in Google's viewer
• Attendance records derived from this data are maintained on our platform
• An institute administrator can disconnect this integration at any time, which stops all further access

19.4 Assignment and Plagiarism Detection

Submitted assignments:

• Are checked for plagiarism using Copyleaks
• May be stored in plagiarism detection databases
• Are accessible to assigned tutors and administrators
• Copyleaks’ privacy policy applies to their processing

19.5 Payment Information

Payment and billing information:

• Is processed by third-party payment processors
• We do not store complete credit card numbers
• Transaction records are retained for accounting and tax purposes

19.6 Analytics Data

Usage analytics and platform performance data:

• Are aggregated and anonymized where possible
• Are used to improve platform functionality
• May be used for internal research and development

19.7 Google User Data

When a teacher or institute administrator connects a Google account, The Academix accesses the following Google user data through Google APIs, only to provide the features described here:

• Google account basics (name and email address): to show which Google account is connected.
• Google Calendar: when a teacher schedules, reschedules or cancels a live class, we create, update or delete that class's event, with its Google Meet link, on the teacher's primary Google Calendar. When a teacher chooses to add an existing meeting as a class, we read the events on their primary calendar and show only upcoming events they organise; other events are not stored.
• Google Meet: participant join/leave records and recording/transcript links, as described in section 19.3.

We use this data only to schedule live classes, keep them in sync with the teacher's calendar, and maintain attendance records. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized artificial intelligence or machine learning models. Our staff do not read it except with your permission for support, for security purposes, or where required by law.

Google access tokens are kept on our servers with access limited to the services that make these API calls, and are not shared with other institutes or third parties. Class events and attendance records are retained with the institute's other data as described in section 7.

You can disconnect your Google account in The Academix at any time, or remove our access at myaccount.google.com/permissions. To have stored Google data deleted, contact [email protected].

The Academix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

19.8 Parent Portal

The parent portal is off unless an Institutional Customer turns it on. When it is on:

• The institution decides which parents and guardians are invited, and can revoke a parent’s access to a child, or to the portal, at any time
• A parent or guardian has read-only access to information about their own linked child that the institution has chosen to share: attendance, results, assignments, notices, and class schedule, and lecture viewing activity only if the institution separately turns that on
• A parent or guardian cannot see who else is linked to the same child
• We send invitation links, password reset emails, and, where the institution has the weekly summary turned on and the parent has an email address, one summary email a week
• Callback requests a parent makes are passed to the institution, which decides whether and when to call
• Questions or requests about a child’s data should go to the institution, which controls it (see Section 10.3)

19.9 AI-Assisted Features

Some features use Google’s Gemini API:

• Generating questions from a PDF or photo a teacher uploads
• Drafting course content and institute website text
• The institute’s student help chatbot, which answers from the institution’s own course, syllabus, and FAQ content
• An in-product help assistant for institute staff, which answers questions about using The Academix

When a user invokes one of these features, the document or image they uploaded, the text they typed into the feature, and, for the chatbot, the relevant excerpts of the institution’s content are sent to Google for processing, and the generated result is returned to the platform. These features run only when a user invokes them. We do not use institution or user content to train AI models.

20. Definitions

• “Institutional Customer” – Educational institutions, schools, universities, corporations, training centers, and individual trainers who subscribe to our Services.
• “End User” – Students, learners, employees, and other individuals who access the platform through an Institutional Customer.
• “Parent Portal” – The read-only web portal through which a parent or guardian invited by an Institutional Customer can see information about their linked child.
• “Personal Information” – Information that identifies, relates to, or could reasonably be linked to an individual.
• “Process/Processing” – Any operation performed on personal information, including collection, storage, use, disclosure, and deletion.
• “Services” – The Academix learning management system platform, including web and mobile applications.

21. Acceptance of This Privacy Policy

By using our Services, you acknowledge that:

• You have read and understood this Privacy Policy
• You agree to the collection, use, and sharing of information as described
• If you are an Institutional Customer, you have the authority to agree on behalf of your institution
• If you are an End User, your institution has authorized your use of the platform

If you do not agree with this Privacy Policy, you must not use our Services.

Acknowledgment

This Privacy Policy is effective as of the date specified above and applies to all users of The Academix platform and services.

For the most current version of this Privacy Policy, please visit: www.theacademix.com/privacy-policy