Privacy Policy
Last updated: [date]. Draft for lawyer review. Open points are in [brackets].
The short version
- We collect as little as we can: your name, email, school year, one subject, and your practice answers.
- No ads, no tracking pixels, no analytics, and we never sell your data.
- If you’re under 18, we tell your parent or guardian, and they can delete your account.
- You can delete everything yourself, any time, from your account page.
- Questions or worries? Email hello@hexistudy.com.
Who we are
Hexi (hexistudy.com) is a revision website for secondary school students. It is run by [full legal name of operator], an individual based in [city], India. In this policy “Hexi”, “we” and “us” mean the operator. [Update once a company or other business is set up.]
Under India’s Digital Personal Data Protection Act, 2023, we are the “Data Fiduciary” for your data. That means we decide what is collected and why, and we are responsible for looking after it.
What we collect and why
If you join the waitlist
- Your email address, so we can tell you when Hexi opens.
- Whether you’re a student, parent or teacher, and the subjects you’re interested in, so we know what to build first.
- That you ticked the box saying you’re 18 or over, or your parent or guardian agrees.
If you create an account
- Your name and email, so you can sign in and we can contact you about your account.
- Your school year and subject, so we show you the right questions.
- Whether you’re 18 or over, and that you confirmed you’re 13 or older.
- If you’re under 18: your parent or guardian’s email address, so we can tell them you’ve joined.
- Your practice answers and scores, so you can see your progress. [This feature is being built.]
- Records of the emails we send your parent and what they chose (for example, if they asked us to delete the account).
If you buy a Season Pass (from 15 December 2026)
- Your name, email, what you bought, the price, currency and date, and the payment reference. We need these for your receipt and because tax law makes us keep them.
- We never see or store your card or bank details. Our payment provider, Razorpay, handles those.
If you email us
- Your email address and whatever you write, so we can reply.
Things we don’t collect
- No passwords. You sign in with a one-time code or link we email you.
- No location tracking, no contacts, no photos, no ad IDs.
Students under 18
- You must be 13 or older to use Hexi. We refuse sign-ups from anyone under 13. If we find out an account belongs to someone under 13, we delete it.
- When a student under 18 creates an account, we email the parent or guardian address they give us. The email says what we store and includes a link to delete the account. The link works for 14 days. After that, the parent can email hello@hexistudy.com and we’ll delete the account.
- Parents and guardians can use all the rights in “Your rights” below on their child’s behalf.
- We never use a student’s data for advertising, and we don’t build profiles of students to sell or share.
[OPEN: from 13 May 2027, India’s law will require a parent’s verifiable consent before we use a child’s data. We plan to ask the parent to say “yes” before saving any practice history. Update this section when that change ships. See brief-for-lawyer.md.]
Cookies
We only use cookies that the site needs to work:
- Sign-in cookies keep you signed in. They can’t be read by scripts on the page.
- A short sign-in cookie remembers the email you typed for up to 30 minutes while you finish signing in.
That’s all. No analytics, advertising or tracking cookies. Because these cookies are strictly needed, we don’t ask you to accept them.
Our forms use Cloudflare Turnstile to block spam bots. Turnstile checks some signals from your browser (like how the page was loaded) to tell people and bots apart. Cloudflare says it does not use this for advertising. [Link to Cloudflare’s Turnstile privacy notice.]
Who helps us run Hexi
We use a few trusted companies to run the site. They process data only on our instructions and only to provide their service.
| Company | What they do | Where the data is |
|---|---|---|
| Cloudflare | Hosts the website, blocks spam bots (Turnstile) | Worldwide network |
| Supabase | Stores accounts and waitlist; runs sign-in | Mumbai, India |
| Resend | Sends our emails (sign-in codes, parent emails, receipts) | Sent from Tokyo, Japan; US company |
| Razorpay (from 15 Dec 2026) | Takes payments in INR and USD | India |
| Bunny.net (from 15 Dec 2026) | Streams our videos | EU company; worldwide network |
We don’t sell or rent data to anyone. We’d only share it with others if the law requires it (for example, a valid order from a court or government authority).
Data outside India
Our main database is in India. Some providers (Cloudflare, Resend, Bunny.net) handle data in other countries to deliver the service. India’s law allows this, except to countries the government restricts. [Lawyer to confirm no restricted countries are involved.]
How long we keep it
| What | How long |
|---|---|
| Waitlist entries | Until [31 March 2027], or sooner if you ask. If you create an account, we delete your waitlist entry then. |
| Accounts and practice history | While your account is open. If you don’t sign in for [2 years], we email you, then delete the account [30 days] later if you don’t sign in. |
| Sign-ups never finished | Deleted after [30 days]. |
| Under-18 accounts the parent asks us to delete | Deleted straight away. |
| Payment records and receipts | [8 years], because tax and GST law make us keep them. [CA to confirm.] |
| Emails you send us | [2 years] after we’ve sorted your question, unless we need them longer for a dispute. |
| Backups | Deleted data can stay in encrypted backups for up to [7 days] before it is overwritten. |
| Basic security and activity logs | [1 year]. [From 13 May 2027 the DPDP Rules require at least one year.] |
When you delete your account
Press “Delete my data” on your account page. We delete your account, profile, parent’s email, consent records, practice history, passes and waitlist entry straight away.
We keep only what the law makes us keep:
- payment records and receipts (see above), and
- [a short record that the account existed and was deleted, kept for 1 year, as the DPDP Rules require from 13 May 2027. Lawyer to confirm.]
Your rights
You (or your parent or guardian, if you’re under 18) can ask us to:
- See a summary of the data we hold about you and who we’ve shared it with.
- Correct anything that’s wrong or out of date.
- Delete your data. You can do this yourself on your account page.
- Withdraw consent at any time. It’s as easy as deleting your account or emailing us. Withdrawing doesn’t undo things we’ve already done lawfully.
- Complain to our Grievance Officer (see the Contact & Grievance page).
- Nominate someone to use these rights for you if you die or can’t act for yourself.
To use a right, email hello@hexistudy.com from the email on your account. We’ll confirm we got your request within 48 hours, aim to finish within [15 days], and always finish within one month.
If you’re not happy with our answer, you can complain to the Data Protection Board of India. [Lawyer to confirm when the Board’s complaint process is open.]
Students outside India: you may have extra rights under your own country’s law (for example the GDPR in the EU or UK). Email us and we’ll help.
Keeping data safe
- Data is encrypted when it travels and when it’s stored.
- Only [the operator] can see student data. Every database table has row-level security, so each signed-in user can only reach their own records.
- Sign-in links and parent links are random and expire. We store only a scrambled (hashed) copy of parent links.
- There are no passwords to steal.
If there’s ever a data breach that affects you, we’ll tell you (and your parent, if you’re under 18) as soon as we can, and report it to the Data Protection Board as the law requires.
Changes to this policy
If we make an important change, we’ll email account holders before it takes effect. The date at the top shows the latest version.
Contact
Email hello@hexistudy.com. For complaints, see our Contact & Grievance page.