Privacy notice
This notice explains what personal data Mridanga Seva keeps about students, parents, guardians and volunteers, why, who else handles it, and what you can ask of us.
Version 0.1-draft, dated . It covers this website and the Mridanga Seva app. To confirm: legal review before the class opens
In short
- This website sets no cookies, has no analytics and no trackers, and has no forms.
- The app keeps only what the class needs to teach you and keep children safe. We never sell data and never show ads.
- For a student under 18, a parent or guardian gives consent in writing.
- You can ask to see, correct or delete your data, or withdraw your consent, by writing to privacy@mridangaseva.com.
Who is responsible
The data fiduciary (under the GDPR, the “controller”) is Mridanga Seva, a volunteer team in Hyderabad, India. To confirm: the legal name and postal address of the person or body responsible for the data
Privacy contact and grievance officer: privacy@mridangaseva.com. To confirm: the name or role of the person who answers privacy requests
This website
This website only shows information. It sets no cookies, uses no analytics or advertising tools, loads nothing from other websites, and has no forms. That is why it shows no cookie banner.
The website is hosted by Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes your IP address and browser details for a short time, under its own privacy policy. We do not receive or keep these logs.
If you write to us by email, we keep your message and address to answer you (see How long we keep data).
What the app keeps
| About | What |
|---|---|
| Students | Name, date of birth, roll number, phone or email, area or PIN code (not the full address), level, a photo only if consent was given, the app language. |
| Parents and guardians of students under 18 | Name, relation to the student, phone number, and the consent record: date, who checked it, and which kind of ID document was looked at. The ID number itself is never stored. |
| Learning | Visits (check-in and check-out times), syllabus items learnt, assessments and answers you send, practice minutes, level changes. |
| Follow-up | When a student stops coming, a coordinator may call; the date, the reason given and a short note are kept. |
| Messages | Announcements you have read, your replies, and the notification token of your phone so it can receive notices. |
| Volunteers | Name, email, role, duty hours, and a log of the changes they make to student records. |
Location: when a coordinator checks a student in, the app checks once whether the coordinator's phone is at the class. Only the result (at the class, away, or not known) and the distance are kept, never the position itself, and nothing is tracked in the background.
Why we use it, and on what basis
- Running the class: registering students, recording visits and progress, assessments, follow-up calls and announcements. Basis: your consent, or for a child the consent of a parent or guardian (DPDP Act section 6; GDPR Article 6(1)(a)).
- Keeping children safe: knowing who is responsible for a child and how to reach them. Basis: the parent's or guardian's consent.
- Security and accountability: logs of who changed what, so that misuse can be found and fixed. Basis: our legal duties to protect personal data (DPDP Act section 8; GDPR Article 6(1)(c) and our legitimate interest under Article 6(1)(f)).
We do not use personal data for advertising, profiling or selling, and we do not make decisions about people by automated means.
Children
Under Indian law a child is anyone under 18. A child is registered only together with the verifiable consent of a parent or lawful guardian: the parent or guardian fills in and signs a written consent form at the desk, and a coordinator checks an ID document. A photo of a child is kept only if the parent agreed to it separately.
We do not track or monitor the behaviour of children and never direct advertising at them. Children should not create an app login on their own; a parent can ask the coordinators. To confirm: decision D4-08, how the app checks age at sign-up
At 18, a student is asked to give their own consent. To confirm: confirm
Who can see it
- A student sees their own record, progress and visits.
- Coordinators see the students' details they need to teach and follow up. To confirm: decision D4-09, whether all coordinators or only a student's mentor and the facilitator see parents' phone numbers and consent records
- The facilitator sees everything in the class and the log of changes.
Services that handle data for us
We use these services to run the app and the website. Each handles data only on our instructions and under its own data protection terms.
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, logins and stored files of the app | Mumbai, India To confirm: confirm the region of the live project |
| Expo (650 Industries) | App updates; passes notifications to phones | USA |
| Google Firebase Cloud Messaging | Delivers notifications to Android phones | Worldwide |
| Brevo | Sends sign-up and password-reset emails | European Union |
| Cloudflare | Hosts this website and the web version of the app | Worldwide network |
| Zoho Mail | The team's email, including info@mridangaseva.com and privacy@mridangaseva.com | To confirm: confirm the Zoho data centre |
| YouTube (Google) | Plays lesson videos inside the app; YouTube may set its own cookies when a video plays | Worldwide |
Some of these services may handle data outside India. Indian law allows this except to countries the Government of India restricts; for people in the European Union or the United Kingdom, such transfers rely on the services' standard contractual clauses or an adequacy decision. To confirm: decision D4-12, the final list of services and transfers
How long we keep data
To confirm: decision D4-07; the periods below are a proposal, not yet agreed
- Students who have left: erased two years after leaving; only the roll number and the dates are kept so that numbers are never reused.
- App logins that were never linked to a student: deleted after 30 days.
- Logs of changes and of access to sensitive data: at least one year, as the DPDP Rules require, at most two years.
- Notification tokens of phones no longer used: deleted after 90 days.
- Emails to the team: To confirm: how long.
When you withdraw consent or ask for erasure, we stop using your data and erase it, keeping only what the law requires us to keep.
How we protect it
Data travels encrypted (HTTPS). Database rules decide, row by row, who may read or change what. Changes to student records are logged. Backups are encrypted. If a breach happens, we tell the people affected and the Data Protection Board of India without delay, as the law requires.
Your rights
You, or a parent or guardian for a child, can ask us to:
- tell you what data we keep about you, and with whom it was shared;
- correct, complete or update it;
- erase it;
- withdraw your consent, as easily as you gave it (what was done before stays lawful);
- name another person to act for you if you die or cannot act yourself (DPDP Act section 14).
If the GDPR applies to you, you also have the rights to restrict or object to processing and to receive your data in a portable format.
Write to privacy@mridangaseva.com, or speak to a coordinator at the desk. We may ask you to confirm who you are. We reply within 30 days. To confirm: confirm the reply period
Complaints
Please write to us first, so we can put things right. If you are not satisfied with our answer, you can complain to the Data Protection Board of India. If you live in the European Union or the United Kingdom, you can also complain to your local data protection authority.
Changes to this notice
When this notice changes in a way that matters, we change its version and date above and tell app users in an announcement. Translations are provided for convenience; To confirm: whether the English text prevails if a translation differs