Privacy Policy

1.Who we are and what this covers

Duebox is a software platform for tuition and enrichment centres, operated by DevIt International (“Duebox”, “we”, “us”), [Registered office address, City, State PIN].

This policy covers our website, the Duebox web app, the parent and tutor portals, the hosted trial-booking and payment pages, and the WhatsApp and email messages we send on behalf of centres. It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Act”), and the Information Technology Act, 2000 with its rules on reasonable security practices and sensitive personal data.

2.Our two roles: fiduciary and processor

Centres (our customers) use Duebox to manage students, families, tutors, classes and fees. That means we handle personal data in two different capacities:

• For your centre's records, the centre is in charge.When a centre adds or collects personal data about its students, parents, guardians or tutors, the centre is the Data Fiduciary. It decides why and how that data is used. Duebox is its Data Processor: we process that data only on the centre's instructions and under our Terms of Service with the centre.
• For our own customers and visitors, we are in charge. When you create a Duebox account for a centre, browse our website or contact us, Duebox is the Data Fiduciary for that data.

If you are a parent, student or tutor with a question about how your centre uses your data, please contact the centre first. We will help the centre respond, and you can always write to us as well.

3.What we collect

Centre owners and staff

Name, email address, password (stored only as a one-way hash), centre name and details, role, sign-in activity, and the billing details needed for your subscription.

Parents and guardians

Name, WhatsApp number, email address (optional), the family and child you are linked to, fee invoices, payment status and receipts, consent records, and make-up class bookings.

Students

Name, level or grade, class enrolments, attendance, make-up credits, and any notes the centre chooses to record. We do not ask for Aadhaar or any other government identity number.

Tutors

Name, contact details, class assignments, sessions taught, rates, payout and tax deduction (TDS) calculations, and acceptance of the tutor service agreement.

Payments

Payments are processed by Razorpay. From Razorpay we receive the order reference, amount, payment method type (for example, UPI), status and time. We never see or store card numbers, CVVs, UPI PINs or net-banking credentials.

Technical data

IP address, device and browser type, pages requested, timestamps and security logs, plus the session cookie that keeps you signed in.

4.How we use it

• To run the service: invoices, receipts, payment links, attendance, timetables, make-up classes, and the parent and tutor portals.
• To send transactional messages on a centre's behalf over WhatsApp and email: invoices, fee reminders, receipts, attendance alerts and sign-in links.
• To process payments and reconcile them with Razorpay.
• To produce reports for the centre, such as class economics and the weekly owner digest.
• To keep Duebox secure, prevent fraud, fix problems and keep security logs.
• To meet legal obligations, such as keeping tax records.
• To answer you when you contact us.

We do not sell personal data, we do not use it for advertising, and we do not build profiles of children.

5.Consent and legitimate uses

We process personal data on the basis of consent, or for a legitimate use the DPDP Act recognises, such as a purpose for which you voluntarily gave us the data, or complying with the law.

Our trial-booking form shows a dated consent notice. Consent to process data is required to book; consent to photos and videos, and to marketing messages, is optional and asked for separately. Every consent and every withdrawal is recorded with the notice version and time, and these records are never edited or deleted.

You can withdraw consent at any time, as easily as you gave it, by contacting the centre or us. Withdrawal does not affect processing that happened before it. The centre may be unable to continue a service that depends on that data, and records we are required by law to keep will be retained.

6.Children's data

Most students are under 18 and are “children” under the DPDP Act. Centres must obtain verifiable consent from a parent or lawful guardian before processing a child's data, and Duebox's consent flows record that guardian consent.

We do not track or behaviourally monitor children, do not direct advertising at them, and do not process their data in any way likely to harm their well-being. Students do not have Duebox accounts; the portals are for parents, guardians and tutors.

7.AI features

Some reports, such as the weekly owner digest, use a third-party AI model to turn figures into a plain-language summary. We send only aggregated business figures, such as collections, occupancy, and class subjects and levels. We do not send names, contact details or other personal data of students, parents or tutors. All figures are calculated by Duebox, not by the AI model. We do not use personal data to train AI models.

8.Who we share it with

We use the service providers below to run Duebox. Each is bound by contract to protect the data and use it only to provide its service to us.

• Vercel Inc.: application hosting and delivery (United States, with a global edge network).
• Neon: managed PostgreSQL database (Singapore).
• Razorpay Software Private Limited: payment processing (India).
• Meta Platforms (WhatsApp Business Platform): delivering WhatsApp messages.
• Resend: delivering transactional email (United States).
• AI model providers (Anthropic, Google): writing summaries from aggregated figures only.

We also share personal data:

• Within your centre.Data in a centre's account is visible to the staff that centre authorises.
• When the law requires it. To comply with a law, court order or lawful request from a government authority, or to protect rights and safety and prevent fraud.
• In a business transfer. If Duebox is merged or acquired, the data stays protected by this policy, or we will notify you first.

We update this list when our providers change.

9.Where your data is stored

Our database is hosted in Singapore, and some of our providers process data in the United States and elsewhere. The DPDP Act allows personal data to be transferred outside India except to countries the Central Government restricts, and we will follow any such restriction.

Payment instrument data is held by Razorpay in India, in line with Reserve Bank of India rules. We store only payment references and status.

10.How long we keep it

• While the centre's subscription is active, we keep its data so the service works.
• After a centre closes its account, it has 30 days to export its data. We then delete or anonymise it within 90 days.
• Invoices, receipts and payment records are kept for as long as GST, income-tax and other applicable laws require.
• Consent records are kept for as long as needed to show that consent was obtained.
• Security logs are kept for at least one year, as the DPDP Rules require.

A centre can ask us to erase specific records sooner. We act on such requests within 30 days, subject to the legal retention periods above.

11.How we protect it

• All traffic is encrypted in transit (HTTPS), and data is encrypted at rest.
• Each centre's data is isolated at the database level with row-level security, and we test that one centre cannot read another's records.
• Passwords are stored only as hashes, and parents and tutors sign in with single-use links instead of passwords.
• Access to production systems is limited to people who need it.
• Financial changes and consents are written to append-only audit records.

If a personal data breach occurs, we will tell affected centres without undue delay so they can meet their own obligations. Where we are the Data Fiduciary, we will notify the Data Protection Board of India and the affected people as the DPDP Act requires. No system is perfectly secure, but we work to keep risks low.

12.Cookies and local storage

• Session cookie (strictly necessary): keeps you signed in. Without it, you cannot sign in.
• Theme preference (local storage): remembers whether you chose light or dark mode on this device.

We do not use advertising, cross-site tracking or analytics cookies. If we add analytics later, we will update this policy first and ask for consent where the law requires it.

13.Your rights

Under the DPDP Act you have the right to:

• get a summary of your personal data and how it is processed, and know who it has been shared with;
• have your data corrected, completed or updated;
• have data erased once it is no longer needed, unless the law requires us to keep it;
• withdraw your consent;
• have your grievances addressed; and
• nominate another person to exercise these rights if you die or become unable to.

To use any of these rights, write to our Grievance Officer at [grievance@yourdomain.com]. If the request concerns data a centre controls, we will pass it to that centre within 24 hours and help it respond. We may need to verify your identity first.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

14.Grievance Officer

For any question, complaint or request about your personal data, contact:

Name

[Full name]

Designation

Grievance Officer

Email

[grievance@yourdomain.com]

Address

DevIt International, [Registered office address, City, State PIN]

We acknowledge every grievance within 24 hours and resolve it within 15 days.

15.Changes to this policy

When we change this policy, we update the date at the top of this page. For significant changes, we tell centres by email or in the app before the changes take effect.