Privacy Policy | Bharat Tuition

Bharat Tuition (referred to as “Bharat Tuition”, “us”, “our”, “website”, “site”, “company”, or “we”) respects your privacy and is committed to protecting your personal information and sensitive data. Users of our educational platform (including students, parents, and educators/teachers) are referred to as “user”, “you”, or “your”.

Please read this Privacy Policy carefully. By accessing or using our website, services, or mobile applications, you acknowledge and agree to the practices described in this policy. If there are any terms in this privacy policy that you do not agree with, please discontinue use of our site and services immediately.

If you have questions, concerns, or requests regarding this Privacy Policy or our security practices, contact us anytime at education@bharattuition.com.

1. Data Collection and Usage

We collect personal information that you voluntarily provide to us when registering an account, expressing interest in our tutoring services, scheduling sessions, or communicating with us. This information may include:

Profile Information: Full name, email address, phone number, academic grade/standard, subjects of interest, educational bio, and profile photo.
Authentication Information: Securely hashed passwords, login credentials, and authentication tokens managed through AWS Cognito.
Class & Academic Records: Demo class bookings, scheduled 1-on-1 tutoring sessions, group class enrollments, and attendance logs.
Device and Usage Data: IP address, browser type, operating system, device identifiers, referring URLs, and interaction timestamps collected automatically to ensure system security and performance.

Bharat Tuition processes personal information based on valid legal grounds, including your explicit consent, the fulfillment of contractual educational obligations, compliance with applicable legal requirements, and legitimate interests in protecting user safety and preventing platform abuse.

2. Google User Data & OAuth 2.0 Integration

Bharat Tuition offers educators optional integration with Google services via Google OAuth 2.0 to facilitate online class scheduling and seamless video conference creation.

Scopes Requested & Purpose:

https://www.googleapis.com/auth/calendar.events: Used exclusively to create, update, and manage tuition class events and automatically generate Google Meet video conferencing links on behalf of the educator for scheduled student sessions.
https://www.googleapis.com/auth/userinfo.email: Used exclusively to display the connected Google account email in the educator’s dashboard to confirm connection status.

Strict Scope Limitations: Bharat Tuition does NOT access, read, or process personal emails, Gmail inbox messages, Google Drive files, contacts, or any personal calendar entries unrelated to classes conducted through Bharat Tuition.

3. Data Protection Mechanisms for Sensitive Data

We implement comprehensive technical, organizational, and physical security measures to ensure that sensitive data, including Google user data and OAuth tokens, is protected against unauthorized access, disclosure, alteration, or destruction:

🔒 Encryption in Transit

All network transmissions and API communications between client devices, Bharat Tuition servers, and external third-party endpoints (including Google APIs) are encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 and TLS 1.3) over HTTPS. Plain-text, unencrypted HTTP connections are strictly prohibited and automatically redirected.

🛡️ Encryption at Rest

All sensitive user records, including OAuth 2.0 access tokens and refresh tokens, user authentication secrets, and personal information, are encrypted at rest using AES-256 (Advanced Encryption Standard with 256-bit keys). Data is stored in secure, enterprise-grade cloud datastores (Amazon DynamoDB) managed through AWS Key Management Service (AWS KMS) with automated key rotation.

🔑 Strict Access Control & Principle of Least Privilege

Access to sensitive data and cryptographic tokens is strictly restricted according to the principle of least privilege. Only automated backend serverless functions performing authorized scheduling tasks possess programmatic access to tokens. Tokens are never exposed to client-side code, web browsers, or mobile application state. Administrative infrastructure access requires Multi-Factor Authentication (MFA) and is audited via continuous AWS CloudTrail logs.

🚫 Strict Safeguards on Sensitive Data & Google Information

No Commercial Sale: We never sell, rent, lease, trade, or monetize sensitive user data or Google user data under any circumstances.
No Advertising Use: Sensitive data and Google user data are never used or transferred to third parties for advertising, marketing campaigns, retargeting, or data broker operations.
No AI/ML Model Training: Sensitive user data and Google user data are never used to train or fine-tune artificial intelligence or machine learning models.
No Human Inspection: No human personnel at Bharat Tuition reads or inspects private Google user data, unless we have received your explicit consent for technical troubleshooting, or when required by law or for vital security investigations.

4. Data Retention, Token Revocation, and Deletion Mechanisms

We retain personal information only for as long as necessary to provide educational services and maintain your active account. We provide explicit, immediate mechanisms for users to revoke permissions and delete sensitive data:

Google Account Disconnection: Educators can disconnect their Google account at any time with a single click in their Teacher Dashboard > Calendar Settings. Disconnecting immediately revokes and permanently deletes all stored Google OAuth refresh tokens and connected credentials from our databases.
Google Security Revocation: Users can also independently review and revoke Bharat Tuition’s access permissions at any time directly through the Google Account Permissions dashboard at myaccount.google.com/permissions.
Permanent Account Deletion: Users may permanently delete their account at any time through their profile settings or by following the instructions at Steps to Delete Account. Upon deletion confirmation, all user records, profile information, class histories, and associated authentication tokens are immediately, irreversibly, and permanently purged from our databases.

5. Google API Services User Data Policy Compliance (Limited Use Disclosure)

Bharat Tuition’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Third-Party Service Providers

We only share data with trusted third-party providers who perform essential infrastructure and operational services on our behalf (e.g., AWS cloud hosting, payment gateways like Razorpay, and transactional email delivery via AWS SES). All third-party service providers are bound by strict confidentiality and data protection obligations and are prohibited from using personal information for any secondary or unauthorized purpose.

7. Cookies & Tracking

Bharat Tuition uses essential cookies and local storage tokens to maintain user authentication sessions and preserve user interface preferences. You can adjust your browser settings to decline non-essential cookies; however, disabling essential session tokens may limit your ability to access authenticated areas of the website.

8. Contact Us

If you have questions, privacy inquiries, or wish to exercise your data rights, please contact our Data Protection team at:

Bharat Tuition
Email: education@bharattuition.com
Website: https://www.bharattuition.com