1. Who this policy covers
This policy is issued by Frest Systems India Private Limited (“Frest Systems India”, “we”), CIN U72200MH2019PTC322243, registered office Sai Darshan Dham CHS Ltd, C Wing, Flat 5, Old Dombivli, Dombivli (West), Thane, Maharashtra 421202, India. It covers the StudyMade website (studymade.com), the StudyMade console used by our staff and sales partners, every institute workspace and parent or student portal we host under an institute’s own name, and printing ordered through StudyMade from Frest Prints. StudyMade and Frest Prints are divisions of Frest Systems India, so data held by either is held by one company under this one policy.
It is written to comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000. Under the DPDP Act anyone under 18 is a child, and almost every learner on StudyMade is one; the children’s rules are therefore our default, not an exception.
2. Who decides, and who processes
| Data about | Data fiduciary | Data processor |
|---|---|---|
| Students and parents (roster, attendance, marks, homework, fees) | Your institute — it decides who is enrolled, what is taught and recorded, and for how long | Frest Systems India — we hold and process it only on the institute's instructions |
| Institute owners and staff (account, billing, support) | Frest Systems India | — |
| Website visitors and sales enquiries | Frest Systems India | — |
In practice this means a parent’s request about their child’s record goes first to the institute, which can act on it directly inside StudyMade; the institute’s requests come to us.
3. What we collect, and why
| Audience | What | Why | Basis |
|---|---|---|---|
| Visitor or enquirer | Name, phone, institute name, city and the campaign code or page you arrived from, when you press Talk to Sales or a referral link | To call you back about StudyMade and to know which campaign brought you | Consent — you fill in the form |
| Institute owner and staff | Name, phone, email, role, institute address, state and GSTIN, plan, invoices and payment references | To run your workspace, bill you and issue GST invoices | Contract and legal obligation |
| Student and parent | Name, class and batch, guardian's phone, attendance, marks, homework and feedback, notices, fee lines, payments and receipts | To run the class the institute has enrolled the child in | The family's engagement with the institute; stated as a notice in the portal |
| Student and parent | A learner's question and submitted work, sent to an AI model | AI help with schoolwork and checking of homework | Consent, given by a guardian in their own portal; withdrawable |
| Student and parent | Photographs of homework | Hand-in by photo | Consent, given by a guardian; withdrawable, and stored photos are erased |
| Student and parent | Photos and short clips of a child in the institute's app, and the child tagged in them | Performance and class photos shared with the families of the child's own batch only | Consent, given by a guardian in their own portal; withdrawable — photos the child is tagged in are hidden at once |
| Student and parent | A child's photo and first name — never the surname, school, phone number or address — on the institute's website, posters and social posts | The institute's results, achievements and testimonials shown in public | A separate consent, given by a guardian in their own portal; withdrawable — new use stops at once, and the institute takes down what it has already posted or printed on request |
| Student and parent | A child's released test answers with their final marks — after names, roll numbers, phone numbers, faces and file details are removed, and with no student id | To measure and improve how accurately the app marks tests. Only where the institute has joined the programme and the guardian has said yes | A separate consent, given by a guardian in their own portal and unticked until they do; withdrawable — no new answers are used, and every answer of the child's already held is deleted |
| Student and parent | Web push subscription for the device | Notices and reminders on the phone | Consent, given by a guardian; withdrawable at once |
| Institute, and learners only in aggregate | Institute facts — fees, kind of institute, PIN code, class ranges, which modules are on — and totals over at least ten institutes, never a row about a child: for example how often a kind of question is answered correctly, or which topics a grade finds hard in a board or region | To improve StudyMade and to show institutes how they compare, such as a fee against the median for their kind of institute in their area. Learning patterns across institutes are used inside StudyMade only — to improve marking and decide which study material to make — and are never shown to an institute | Institute facts: contract with the institute. Learner totals: the institute's instruction in its agreement with us; stated in the portal's notice |
| Everyone | Who changed what, when | Security and audit; undo | Legitimate interest and legal obligation |
We do not ask for Aadhaar or any government ID number. We do not collect location, contacts or anything from a device beyond what the browser sends to load a page.
4. Children
- A learner cannot give consent for themselves. Where a purpose needs consent, it is asked of the guardian in the guardian’s own portal, and a tick made by the institute on a family’s behalf is recorded but does not count.
- No behavioural tracking, profiling or targeted advertising is directed at a child. There are no streaks, points, badges or leaderboards, and no offers on any student or parent screen.
- Photos of a child are two separate choices, both the guardian’s: in the institute’s app, seen only by the families of the child’s batch; and in public, on the institute’s website, posters and social posts, with the first name only. Photos of homework are a third, different permission, used only to hand in and mark work. A choice recorded by the institute on a family’s behalf, or given by message or on paper, does not count.
- Consent is per purpose and versioned. If the words of a purpose change materially, the guardian is asked again, and withdrawing a consent stops the feature it covers.
5. Where data is stored and processed
All StudyMade data is stored on Amazon Web Services in Mumbai (ap-south-1), with a disaster-recovery copy in Hyderabad (ap-south-2). AI features run on Amazon Bedrock in the Mumbai region; prompts and outputs are not used to train any model, and assistant transcripts are not retained unless an institute switches retention on and records a reason. The one exception is the marking programme in §3: test answers a guardian has agreed to share, with the child’s details removed, are kept in a separate store in Mumbai for three years and used to measure and improve marking. Training a model on them would be a further decision, announced here first. No learner data leaves India. Our website and console pages are served from Vercel’s Mumbai edge; those servers hold no records, only the pages.
7. How long we keep it
| Data | Kept for |
|---|---|
| Learner records | While the learner is enrolled, plus the institute's own stated period; erased on request |
| Homework photographs | Until the work is marked, plus the above |
| Photos and clips the institute shares in its app | While the institute keeps the post; hidden from families as soon as a guardian withdraws consent |
| Records you delete (“Recently deleted”) | 30 days, then purged automatically |
| Test answers shared to improve marking | 3 years from when they were shared, then deleted automatically; deleted at once if the guardian withdraws consent or the learner's records are erased |
| Voice notes | Deleted once transcribed; the transcript is the record |
| Fee receipts, subscription invoices, credit notes | 8 years, as GST record rules require |
| Audit trail | Kept, but stripped of personal content when a record is erased (see §8) |
| System logs | 400 days, in India |
| Institute data after a subscription ends | 90 days for export, then deleted |
8. Your rights
- Access and a copy. An institute can export everything it holds — records and files — from its workspace at any time. A family asks their institute for their own copy.
- Correction. Every screen that shows a value can correct it, and corrections are recorded with a reason.
- Erasure. A learner’s or an institute’s records can be erased on request: every homework photo is removed, logins are deleted, and the audit trail keeps only that something happened and when, with the personal content removed. Receipts keep only what tax law requires.
- Withdrawing consent. From the consent panel in the parent portal, at any time; the feature stops immediately.
- Complaint. To the grievance officer below, and if you are not satisfied, to the Data Protection Board of India.
9. Security and incidents
Data is encrypted in transit and at rest. Sessions use secure, HttpOnly cookies. Access is role-based and every change is audited. Staff access to production data is limited to what support needs and is logged. If a security incident affects personal data we follow a written response plan: report to CERT-In within six hours as required, notify the Data Protection Board, and inform the affected institute, which informs its families.
10. Cookies
StudyMade uses a session cookie to keep you signed in, a cookie that remembers your language, and on the marketing site one cookie that records the first page you arrived on so we can tell which campaign brought you. It holds no name or number. We use no advertising or cross-site tracking cookies.
11. Grievance officer
Questions, requests and complaints about personal data go to our grievance officer under the DPDP Act and the IT Rules:
- Name
- Sreejit Panikar
- Phone
- +91 90828 81890
- Address
- Frest Systems India Private Limited, Sai Darshan Dham CHS Ltd, C Wing, Flat 5, Old Dombivli, Dombivli (West), Thane, Maharashtra 421202, India
- Response
- Acknowledged within 2 working days; resolved within 30 days
12. Changes
The date at the top shows when this policy last changed. A material change is notified to institute owners in the workspace; a change to a consent purpose is put to guardians again in the portal. Our Terms & Conditions and Contact pages have the rest.