How Brain Grain handles personal data

Who We Are

Brain Grain Learning Centre (UDYAM Registration: UDYAM-TN-02-0446699) provides Samacheer Kalvi study resources for Classes 6–12, exam preparation for TET, CTET, TNPSC, SSC CGL, RRB NTPC, UPSC CSE, and other competitive exams, along with AI academic doubt support, question papers, reviews, and support tools. Operated by Amul. Contact: thebraingrain@gmail.com. Location: Chennai, Tamil Nadu, India.

Data We Collect

We collect the following categories of personal and usage data:

Data you give us directly

• Contact and support requests: Name, email address, phone number, topic, and message when you submit a support form.
• Reviews and feedback: Name, star rating, and comments when you post a review.
• Payment details: Name, email, phone number, amount, order ID, and payment status when purchasing paid access (processed via Cashfree).
• Phone number for login (OTP): When you use phone-based login, your phone number is collected to send and verify a one-time password (OTP) via Supabase Authentication. Your phone number is stored as your authentication identity.
• WhatsApp notification subscription: When you submit a support request, your phone number may be stored in our WhatsApp subscriber list to allow us to send you status updates or replies.

Data we generate automatically

• Anonymous visitor identifier (bg_cid): A randomly generated identifier stored in your browser (localStorage) that is created automatically on your first visit. It links your study XP and progress without identifying you personally.
• XP, study streak, and progress data: Your experience points (XP), daily XP, study streak count, and optional display name are stored in our database, linked to your bg_cid (anonymous) or your logged-in account.
• AI doubt questions: The grade, subject, question text, selected page context, usage count, and session identifier for each question submitted to the AI doubt solver.
• Login session tokens: Authentication session tokens stored in your browser (localStorage under sb-auth-token) to keep you signed in across visits.
• Site error logs: When a site error occurs, we automatically log the page URL, browser/device type, viewport size, and scroll position to help us diagnose and fix issues.
• Analytics data: Page views, click events, and usage patterns via Google Analytics 4 and Microsoft Clarity (which also captures session replays and heatmaps). These are processed under Google's and Microsoft's own privacy policies.
• Technical signals: Approximate device/network signals used for abuse prevention and AI usage limits.

Why We Use Data

• To deliver study pages, AI doubt solving, XP progress tracking, and study streak features.
• To process payments and activate paid AI access.
• To respond to support requests and send WhatsApp updates where subscribed.
• To prevent misuse, enforce fair usage limits, and protect paid content.
• To debug errors and improve site reliability.
• To understand how the site is used and improve content quality.

Services We Use

We rely on the following third-party services, each operating under its own privacy policy:

• Supabase — Phone OTP authentication, and database storage for XP, progress, orders, reviews, support requests, WhatsApp subscribers, and error logs.
• Cashfree Payments — Payment processing for paid AI access.
• OpenAI — AI doubt answers generated server-side. Only the question, subject, and grade are sent to the OpenAI API; no personal identifiers are included.
• Google Analytics 4 — Site usage analytics. Data is processed by Google.
• Microsoft Clarity — Session recordings and heatmaps for UX improvement. Data is processed by Microsoft.
• Resend — Email delivery for internal support and notification emails.
• Netlify — Web hosting and serverless backend functions.

Children, Parents, and the DPDP Act 2023

Brain Grain is primarily used by school students (Classes 6–12) and exam aspirants. We take our obligations under the Digital Personal Data Protection Act 2023 (DPDP Act) seriously.

• Students under 18 should use paid access, phone login, AI doubts, support forms, and reviews with parent or lawful guardian involvement.
• Under the DPDP Act 2023, processing personal data of children (persons under 18 years of age) requires verifiable parental or guardian consent. We do not knowingly collect personal data from minors without such consent.
• We do not use any student data for targeted advertising, behavioural profiling, or commercial tracking.
• Anonymous study data (bg_cid, XP, streak) does not contain any directly identifying information and is used solely to support the learner's experience on our platform.
• If a parent or guardian believes we hold a child's personal data without proper consent, please contact us immediately at thebraingrain@gmail.com and we will delete the relevant data promptly.

Your Rights and Choices

Under applicable Indian law, including the DPDP Act 2023, you have the right to:

• Access a summary of personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion ("right to erasure") of your personal data where it is no longer necessary.
• Withdraw consent where our processing is based on consent.
• Nominate another person to exercise these rights on your behalf.
• Raise a grievance with our Grievance Officer (see below).

To exercise any right, email thebraingrain@gmail.com with enough detail to identify your request (for example, your phone number, order ID, or registered email).

Browser Storage and Cookies

We use browser localStorage (not traditional cookies) to store your anonymous visitor identifier (bg_cid), login session token (sb-auth-token), and study progress preferences. Google Analytics 4 and Microsoft Clarity set their own cookies for analytics. You can clear localStorage and cookies at any time using your browser settings; this will reset your local study progress and log you out.

Data Retention and Security

We keep personal data only as long as reasonably needed for the purposes described in this policy — typically for as long as you have active account activity, plus reasonable periods required for payment records, legal compliance, and abuse prevention. We use HTTPS, server-side API keys, and Supabase access controls to protect data. No internet service can guarantee absolute security.

Grievance Officer

In accordance with the Information Technology Act 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the following Grievance Officer is designated to address complaints and concerns about personal data and content:

• Name: Amul
• Designation: Grievance Officer, Brain Grain Learning Centre
• UDYAM Registration: UDYAM-TN-02-0446699
• Email: thebraingrain@gmail.com
• Address: Chennai, Tamil Nadu, India

We will acknowledge your complaint within 24 hours of receipt and endeavour to resolve it within 15 days of receipt, as required under applicable law.

Governing Law

This Privacy Policy and any disputes arising from it are governed by the laws of India. Any unresolved disputes are subject to the exclusive jurisdiction of the courts of Chennai, Tamil Nadu, India.

Contact and Complaints

For any privacy concern, contact us first at thebraingrain@gmail.com. If you are not satisfied with our response, you may escalate to our Grievance Officer above, or use remedies available under the DPDP Act 2023 and IT Act 2000.