Privacy Policy

1. Who we are

[REGISTERED ENTITY NAME], a [COMPANY TYPE] incorporated in India (CIN [CIN]), with its registered office at [REGISTERED ADDRESS], operates the CREST Champs platform at crestchamps.com (the “Platform”). In this policy “we”, “us” and “our” mean that entity.

Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described here — meaning we decide why and how it is processed, and we are accountable for it. You (the parent or guardian) and your child are Data Principals.

Questions about this policy: hello@crestchamps.com. To exercise a right or raise a complaint, see Grievance redressal.

2. The short version

The full policy is below, but these are the commitments that matter most, and we hold ourselves to them in the product itself, not just on this page:

These are not aspirations. They describe how the Platform is currently built, and if any of them changes, we will update this policy and tell you before the change takes effect.

3. What we collect

We collect the minimum needed to run a learning account. We do not ask for your child's address, phone number, photograph, government ID, Aadhaar, or precise location, and you should never send them to us.

3.1 The student account

An account is a single student account, created under a parent or guardian's supervision. We collect only what running it needs. A first name or nickname is fine for the student's name — we encourage it, since it may appear on a leaderboard.

3.2 Learning activity

As the student practises, we record their answers, whether each was correct, time taken, Practice Points and streaks earned, badges, placement and mock test results, worksheet attempts, level progression, and contest leaderboard entries. This is the substance of the service: it is what lets the Platform pitch the next question at the right difficulty and show progress.

3.3 Enquiry form (no account needed)

If you request a demo from our home page, we collect your name and phone number (required), your email and your child's grade (optional), so that a person can call you back. This is not a child's record and creates no account.

3.4 Free articles and the anonymous practice widget

Our public articles and the try-it practice widget need no login. Attempts there are stored against a random session token only. They are not linked to a name, an email, or any account.

3.5 Payments

Paid plans are not live yet. When they are, payments will be handled by a regulated payment gateway. We will not receive or store your card number — only a transaction reference, amount and status. We will update this policy before any payment feature launches.

4. Children's data

This is the most important section of this policy. Under Indian law a child is anyone under 18 — not 13. Substantially all learners on this Platform are children, so we treat the entire Platform as a children's service.

4.1 Accounts are created under adult supervision

A student account must be created and used under the supervision of a parent or legal guardian who is 18 or older. By registering, the supervising adult confirms that they hold that role and takes complete responsibility for the account and the student's use of the Platform. The login email is often the adult's — it is how the account signs in.

4.2 Verifiable parental consent

Before we process any child's personal data we obtain verifiable consent as required by Section 9 of the DPDP Act. At registration a single consent confirms acceptance of the Terms of Use and this Privacy Policy. By those Terms, the person registering confirms that the account is created under the supervision of the student's parent or legal guardian, who takes responsibility for it and consents to our processing of the student's personal data as described in this notice.

An account cannot be created until that consent is given. We record what was agreed to and when — including the exact published version of this policy shown at the time — so that a later change to this policy can never be treated as something already agreed to.

Because the account holder is the person who controls the registered email address, and requests to exercise rights must come from that address, a child cannot self-serve consent by ticking a box. [REVIEW WITH COUNSEL: once the DPDP Rules on verifiable consent are notified in final form, confirm whether this method suffices for your risk appetite or whether a stronger check (e.g. a token from an authorised entity, or a small refunded payment) is warranted.]

4.3 The Section 9 prohibitions we observe

We do measure how a child answers maths questions — that is the tutoring itself, and it is used only to choose the next question and to show you progress. It is never used to build an advertising or commercial profile, and it never leaves our systems for that purpose.

4.4 What a child can see and do

A child sees questions, their own progress, and their own badges. Children cannot make purchases, cannot message other users, and there is no open chat, no user-uploaded content and no public profile on the Platform. Leaderboards, where shown, display the name or nickname you chose for the profile — choose a nickname if you would rather it not show a real name.

4.5 If a child has registered without you

If you believe a child has created an account without a parent's or guardian's consent, contact hello@crestchamps.com and we will delete it and the associated data promptly.

5. Why we use it

We use personal data only for these purposes:

• To run the account — authenticate the login and keep the session active.
• To teach — select each next question at the right difficulty, schedule revision, award Practice Points and streaks, generate worksheets, run placement and mock tests.
• To report progress — the student's dashboard, which a supervising parent or guardian can view by logging in.
• To respond to you — answer support requests and call you back about a demo you asked for.
• To keep the Platform safe and working — prevent abuse, diagnose faults, keep backups.
• To meet legal obligations — tax, accounting and lawful requests from authorities.

We do not use personal data for automated decision-making that produces legal or similarly significant effects. Difficulty selection is an aid to learning, not a judgment about your child, and you can always see and override the level.

6. Consent, and how to withdraw it

We process personal data on the basis of your consent, given after you have read this notice, and — where applicable — for certain legitimate uses permitted by the DPDP Act, such as complying with a legal obligation.

Your consent is specific, informed and freely given, and covers only the purposes listed in Section 5. You may withdraw it at any time by emailing hello@crestchamps.com from your registered address and telling us you withdraw consent. You do not need to give a reason, and there is no charge. Withdrawal is not retrospective — it does not undo processing already lawfully carried out — and it will mean we can no longer provide the service, so we will close the account and delete the data as described in Section 10.

This notice is available in English and [LANGUAGES — the DPDP Act entitles a Data Principal to this notice in any language in the Eighth Schedule of the Constitution; confirm which you will offer].

7. Cookies

We use two cookies, both strictly necessary. We use no advertising, analytics or tracking cookies, which is why you see no cookie banner here — there is nothing to opt into.

Both are HTTP-only (script on the page cannot read them), sent only over HTTPS in production, and restricted to our own site. We store nothing in your browser's local storage.

8. Sharing and processors

We do not sell, rent, or trade personal data, and we do not share it for anyone else's marketing.

We share personal data only:

• With Data Processors acting on our instructions — currently our hosting provider ([HOSTING PROVIDER]) and, once payments launch, a regulated payment gateway. Each is bound by contract to process data only as we direct.
• When the law requires it — a valid order from a court or authorised authority. We will tell you unless legally barred from doing so.
• On a business transfer — if the Platform is acquired or merged, data may transfer to the successor, who will remain bound by this policy or give you notice and a choice before any material change.

9. Where data is stored

Our servers are hosted with [HOSTING PROVIDER] in [DATA CENTRE REGION — note: current infrastructure is EU-based; if you host in India instead, simplify this section]. This means your personal data may be stored and processed outside India.

The DPDP Act permits transfer of personal data outside India except to territories the Central Government restricts by notification. We do not transfer personal data to any restricted territory, and we will comply with any such notification if one is issued. Wherever the data sits, this policy and Indian law continue to govern how we handle it.

10. How long we keep it

We keep personal data only as long as it serves the purpose you gave it for, and then we erase it.

• Account and student data — for as long as your account is open. If you delete it, we erase it within [30] days, apart from backups, which roll off within a further [90] days.
• Dormant accounts — if you have not logged in for [24 MONTHS], we will email you, and if you do not respond we will delete the account and its data.
• Enquiry form submissions — [12 MONTHS] from your enquiry, then deleted.
• Anonymous practice attempts — retained as aggregate statistics with no identifier attached to them.
• Financial records — once payments launch, transaction records are kept for [8 YEARS] as Indian tax and company law require, even after account deletion. These contain no card details.

11. Security

We take reasonable security safeguards to prevent a personal data breach, as the DPDP Act requires. In practice: all traffic runs over encrypted HTTPS; passwords are stored only as one-way hashes and are never readable by us or our staff; session cookies are HTTP-only and are regenerated at login to defeat session-fixation; the adaptive engine is not exposed to the internet; and staff access to production data is limited to those who need it for a specific task.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal, as Section 8(6) of the DPDP Act requires.

12. Your rights

As a Data Principal you have these rights under the DPDP Act. Where the data belongs to your child, you exercise these rights on their behalf.

• Right to access — a summary of the personal data we hold about you and your child, what we are doing with it, and who we have shared it with.
• Right to correction and completion — fix anything inaccurate or incomplete. Most fields you can edit yourself in your account.
• Right to erasure — have your data deleted, unless we are legally required to retain it.
• Right to withdraw consent — at any time, as described in Section 6.
• Right to grievance redressal — a readily available means of raising a complaint with us; see below.
• Right to nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. Contact us to record a nomination.

A member of our team handles each request by hand and we will complete it within [30] days of verifying who you are. Requests are processed manually rather than by a self-service button, which means we can check them properly — but it also means we cannot act on a request we never receive, so please use the address above rather than any other channel.

The DPDP Act also places duties on you as a Data Principal: give us accurate information, do not impersonate anyone else, and do not file false or frivolous complaints.

13. Grievance redressal

We are required to publish, and do publish, the contact details of the person who will answer your questions about our processing of personal data.

If we do not resolve your grievance to your satisfaction, you may escalate it to the Data Protection Board of India. You must ordinarily raise it with us first.

14. Changes to this policy

If we change this policy, we will update the “Last updated” date at the top. For any change that materially affects how we handle your or your child's personal data — a new purpose, a new category of data, a new recipient — we will notify you by email and, where the law requires it, ask for fresh consent before the change takes effect. We will not quietly broaden what we do with a child's data.