In short
Graddly is a learning companion for parents of K–12 students in India. We collect the minimum information needed to give you an honest read on your child's work, we delete photos within 90 days, and we never sell your data. The rest of this document explains the specifics in plain language. Where it gets technical, we've tried to footnote.
What we collect
When you sign in and use Graddly, we collect:
- Your account info, name and email from your Google account (via OAuth).
- About your child, first name (or nickname), class, board (CBSE/ICSE), and optionally school name.
- Photos of schoolwork, worksheets, notebook pages, and tests you choose to upload for analysis.
- App usage, anonymised events (e.g. "scanned a page", "opened a report") so we can improve the product. We do not use third-party analytics tied to personal identifiers.
- Payment metadata, when you subscribe, PayU handles the transaction. We receive only the subscription status and a reference ID; we never see your card or bank details.
Where photos live
Photos are stored in Cloudflare R2, an encrypted object store. Access happens through signed URLs that expire within 15 minutes; no public URL ever points to your child's work. We auto-delete original photos after 90 days. The summarised analysis (text only) stays in your account so you can look back at past weeks.
You can delete any photo manually, at any time, from the app: tap the photo → Delete. You can also wipe everything in one go via Profile → Delete account (see below).
Third-party processors
We rely on a small, deliberate set of vendors. Each one signs a data processing agreement with us and is bound by Indian law where applicable:
- Supabase, application database (account, child profile, report text). Region: India (ap-south-1).
- Cloudflare, photo storage (R2), CDN, and DDoS protection.
- Anthropic, AI analysis of uploaded photos. Photos and child data are not used by Anthropic to train models.
- PayU, payment processing for Indian subscriptions.
- Google, sign-in only (OAuth). We request the minimum scopes: openid, email, profile.
We do not share your data with anyone outside this list.
Children's data & consent
Graddly is for parents, not children. The account holder is the parent or legal guardian. Under India's Digital Personal Data Protection Act §9, processing of a child's personal data requires the verifiable consent of the parent or guardian, by creating an account and adding your child's profile, you are providing that consent.
We do not profile children for advertising. We do not show ads. We do not sell or share children's data. You may withdraw consent and delete your child's profile at any time.
Your rights
Under the DPDP Act, you have the right to:
- Access the personal data we hold about you and your child.
- Correct or update any of it.
- Withdraw consent and have your data erased.
- Nominate someone to exercise these rights on your behalf.
- Lodge a complaint with the Data Protection Board of India.
To exercise any of these, email hello@graddly.com. We'll respond within 7 working days.
Deleting your account
In the app: Profile → Delete account. This removes your account, every child profile under it, every photo, and every report, within 30 days. Some anonymised transactional records (e.g. tax invoices) are retained as required by Indian law.
Contact
Questions about this policy or about your data:
- Email: hello@graddly.com
- Post: Mamps Ventures Private Limited, India
This document may be updated. When we make material changes, we'll notify you in the app and update the effective date at the top of this page.