At a glance
The short version. The full detail is below — this summary is not a substitute for it.
- We collect only what we need to tutor a student — name, age, sign-in contact, and learning data (lessons, attempts, scores). We don't sell your data or buy it from others.
- Children come first. If a student is under 18, the features that save or personalise their data stay locked until a parent or guardian gives consent.
- No tracking, no ads for children. We never run behavioural tracking, targeted advertising, or third-party ad/analytics trackers in the student app.
- You're in control. You can access, correct, or delete your data, and withdraw consent, at any time — contact details are in Section 15.
EdLM is an AI-assisted tutoring service for school students, operated by Genfox.ai ("EdLM", "GenFox", "we", "us"). This policy explains, in plain language, what personal data we collect, why, how we use and protect it, and the rights you have under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Because EdLM is built for students — many of whom are under 18 — protecting children's data is central to how the product works.
1Who we are
In short: Genfox.ai is responsible for your data; our Grievance Officer is your point of contact.
The Data Fiduciary responsible for your personal data is Genfox.ai, at Provident Cosmo, Pudupakkam, near SIPCOT IT Park, Chennai – 603103, Tamil Nadu, India. For any privacy question, or to exercise your rights, contact our Grievance Officer — details in Section 15.
2Data we collect
In short: just what's needed to run the tutoring — different for students, parents and tutors.
| From / about | What we collect |
|---|---|
| Students | Name, date of birth (to know whether a student is a minor), the email or phone used to sign in, class/board, the subjects studied, and learning data — lessons viewed, quiz and practice attempts, answers, scores, and progress over time. |
| Parents / guardians | Name, email and/or phone, the relationship to the student, and the record of the consent you give (what you approved and when). |
| Tutors | Name, contact details, the institute you teach at, and the list of students you have invited and support. |
| Payment data | Subscriptions are processed by our payment partner. We receive a confirmation that a payment succeeded and a reference ID — we do not collect or store your card, UPI, or bank details. |
| Technical data | Minimal, first-party information needed to keep the service working and secure — for example device/browser type and basic server-side logs. For student accounts this is kept strictly to what is necessary. |
3How we use it
In short: to teach, to connect tutors and students, to run accounts and billing, and to keep things safe.
- Deliver tutoring — show lessons, run practice and quizzes, grade answers, and track progress and readiness.
- Connect tutors and students — let a tutor see the progress of the students they support.
- Run accounts and billing — create and manage accounts, free trials, and subscriptions.
- Communicate — send sign-in links, consent requests to parents, and important service messages by email or SMS.
- Keep the service safe — security, fraud prevention, and fixing problems.
We use personal data only for the purposes described here.
4Consent & withdrawal
In short: we act on your consent, and you can take it back whenever you like.
We process personal data on the basis of consent — yours, or, for a student under 18, the verifiable consent of a parent or guardian (Section 5). We give you a clear notice of purpose before or when we ask for consent.
You can withdraw consent at any time — through your account settings, or by writing to our Grievance Officer (Section 15). Withdrawing consent is as easy as giving it. It won't affect processing we already carried out lawfully, and some limited processing may continue where the law requires it (for example, keeping billing records).
5Children & parents
In short: under-18 accounts need a parent's approval before saved/personalised features unlock.
Under the DPDP Act, a "child" is anyone under the age of 18. Before we process a child's personal data, we obtain the verifiable consent of a parent or lawful guardian, and we take reasonable steps to confirm the consenting adult is a real, identifiable adult.
How consent works in EdLM
A student account that belongs to a minor stays in a "pending consent" state until a parent or guardian approves it. Until then, the student can browse lessons and try sample questions, but the features that save or personalise a child's data — graded quizzes, saved practice, progress tracking, scores, and AI grading — stay locked. When the parent approves, those features unlock.
Consent is explicit and affirmative — never pre-ticked or assumed. A parent can withdraw consent at any time, after which the account returns to the limited state.
Where a tutor sets up an account for a school student, the tutor records the parent's contact details and the request goes to that parent for approval. Where a student or parent signs up directly, the parent completes consent through their own verified contact. We keep an append-only record of consents given and withdrawn. If a student turns 18 while using EdLM, the parental gate lifts and we ask the now-adult student for their own consent.
6A child's data — what we never do
In short: no behavioural tracking, no targeted ads, no third-party trackers — ever, for a child.
For accounts belonging to anyone under 18, even with parental consent, we do not:
- carry out behavioural tracking or monitoring of the child;
- show the child targeted or behavioural advertising;
- load any third-party advertising or analytics trackers in the student app;
- process a child's data in any way likely to cause harm to the child.
The only information we keep for a student is their educational record — the lessons, attempts, scores and progress needed to tutor them — and the minimum required to keep the service secure.
8AI processing
In short: AI powers lessons and grading; it's a study aid and can occasionally be wrong.
EdLM uses artificial-intelligence models to generate explanations, power the tutoring experience, and help grade answers. When a student submits an answer for grading, the relevant content is sent to our AI provider to produce a result. We do not permit our AI providers to use a student's personal data to train their models, and we rely on their contractual commitments to that effect. AI processing for a minor is limited to the educational purpose above. AI-generated explanations can occasionally be wrong — they are a study aid, not a guaranteed source of truth.
10How long we keep it
In short: only as long as needed; unconsented and closed accounts are purged.
- An account that stays in "pending consent" without a parent approving within 30 days is purged — we do not hold a child's data without consent any longer than necessary.
- While your account is active, we keep your account and learning data to provide the service.
- If you ask us to delete your account, there is a 14-day grace period during which it can be restored; after that, it is permanently removed.
- Any residual data after an account is closed is deleted or anonymised within 90 days, unless the law requires us to keep it longer (for example, billing records for tax).
- When you withdraw consent, we delete or anonymise the data we no longer need.
11Your rights
In short: access, correct, erase, withdraw consent, nominate, and complain.
Under the DPDP Act you (or, for a minor, the parent/guardian) can:
- Access a summary of the personal data we hold and how we process it;
- Correct, complete, or update inaccurate data;
- Erase data we no longer need a lawful reason to keep;
- Withdraw consent at any time (Section 4);
- Nominate another person to exercise these rights on your behalf in case of death or incapacity;
- Raise a grievance with us, and escalate to the Data Protection Board of India if unresolved.
To exercise any right, contact our Grievance Officer (Section 15). We will respond within the timelines required by law.
12Security & breaches
In short: we safeguard your data, and we'll notify you and the Board if something goes wrong.
We take the security of personal data seriously and apply reasonable technical and organisational safeguards designed to protect it, such as access controls, encryption in transit, and limiting who on our team can access personal data. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. In the event of a personal-data breach, we will notify the Data Protection Board of India and affected users in the manner and within the timelines prescribed under the DPDP Rules.
13Where data is processed
In short: some providers process data outside India under contractual protections.
Some of our service providers (for example cloud hosting and AI providers) may process data on servers located outside India. Where that happens, we rely on contractual protections and process such transfers in line with the DPDP Act and any restrictions notified by the Government.
14Changes to this policy
In short: we'll post updates here and flag significant ones.
We may update this policy as the service or the law changes. We will post the new version here with an updated effective date, and for significant changes we will notify you.
15Contact & grievances
In short: reach our Grievance Officer; unresolved complaints can go to the Board.
For any privacy question, to exercise a right, or to raise a grievance, contact our Grievance Officer. We operate a grievance-redress mechanism and aim to resolve complaints within 90 days.
If we do not resolve your grievance, you may complain to the Data Protection Board of India.