Privacy Policy

This notice is issued by StudyDesk — [LEGAL ENTITY NAME], [REGISTERED ADDRESS] — which is the Data Fiduciary for the personal data processed through our website, our library dashboard and our Android app. We decide why personal data about you is processed and how it is processed; the hosting, payment and messaging providers we instruct are Data Processors.

This notice is the privacy notice required by section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It explains what we collect, on what basis, what we do with it, how long we keep it, and the rights you have over it.

The DPDP Act applies to personal data that is digital or has been digitised. Paper records a library keeps on its own premises are outside its scope, which is one practical reason we encourage you to move operations onto StudyDesk.

We apply the same core protections — access, correction, erasure, and no sale of personal data — to everyone we serve, wherever they are. Section 10 sets out the additional rights available to users outside India.

This notice is written against the law as it stands today:

• The Digital Personal Data Protection Act, 2023 (22 of 2023), in force from 11 August 2023.
• The Digital Personal Data Protection Rules, 2025, notified on 13 November 2025.
• The Information Technology Act, 2000, including section 43A (reasonable security practices) and section 65B (electronic records).
• The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, for our dealings with consumers.

The DPDP Rules, 2025 come into force in stages, and the staged dates matter for this notice:

• From 13 November 2025 — the Data Protection Board of India is established, and the rules about its constitution and procedure apply.
• From 13 November 2026 — the rules on Consent Managers apply.
• From 13 May 2027 — the substantive compliance obligations apply: the notice requirements, security safeguards, breach notification, retention, children's data, the duties of Significant Data Fiduciaries, your rights, and transfers outside India.

We have already built to the substantive standard rather than waiting for the 13 May 2027 date. Where a phased commencement date is still in the future, we say so in the relevant section below.

One point of hierarchy is worth stating plainly: section 38 of the DPDP Act provides that the Act prevails over the IT Act 2000 in matters of personal data. We therefore follow the DPDP Act on personal data protection, and the IT Act on everything else.

Section 5 of the DPDP Act and the notice rules require us to itemise what we collect and the specific purpose of each item. This is that list. We collect only what each purpose actually needs.

• Account data — name, email address, phone number, a one-way password hash, and your profile photo. Used to create and secure your account, to identify you, and to let staff find your record at the desk.
• Membership and library data — the library you belong to, seat, shift, plan, admission and identification details, locker assignment, and the start and end dates of your membership. Used to operate memberships, seat allocations and billing.
• Attendance data — check-in and check-out timestamps and the QR identifiers used at the gate. Used to record occupancy, verify entry, and produce an auditable attendance record.
• Payment references — amount, status, and the transaction identifier returned by the payment gateway. Used to record and reconcile payments and to produce invoices. We never receive or store card numbers, CVVs, UPI PINs, or bank credentials; those are handled inside the payment gateway.
• Support and communication data — messages you send the desk, complaints you file, support emails, and the log of notifications we send you. Used to assist you and to keep an audit trail of what was communicated.
• Technical data — device and app version, crash logs, session tokens, and IP-derived region used for tax and currency determination. Used for security, performance and legal compliance.

If you sign in with Google, we receive your verified name, email address and Google account identifier, and use them for authentication only.

Section 4 of the DPDP Act sets out the grounds on which personal data may be processed: consent, certain legitimate uses (including performing a contract you asked for, complying with law, and responding to a medical emergency or disaster), and provision of a service offered by the State or its instrumentalities.

In practice, most of what StudyDesk does falls within the legitimate uses in section 7 rather than requiring separate consent for each action — for example, stamping an attendance record when you scan the gate QR pass at a library you have an active membership with, or issuing a receipt for a payment you made. Consent is used where we need it, principally at account creation and at checkout.

Where we do rely on consent, it is free, specific, informed and given by a clear affirmative action. Each request for consent is accompanied by a standalone, itemised notice telling you what is being collected and for what purpose — you are not asked to agree to a list buried in a longer document.

Consent is limited to the purpose it was given for. It does not become a general permission to process your data for anything else.

You may withdraw consent at any time, and you may do it with the same ease with which you gave it — from your account settings, or by writing to us at the address in section 20.

Withdrawing consent ends further processing for the purpose it covered. It does not undo processing that was already lawful when it was done, and it does not require us to delete records we are obliged to keep for another reason — for example, tax invoices, or security logs needed to investigate an incident.

Withdrawing consent for your account means the account itself, and your access to StudyDesk, cannot continue.

Under section 2(7) of the DPDP Act, a child is anyone under 18. Section 9 governs processing the personal data of children, and the rules made under it add the detail.

Before processing a child's personal data we must obtain verifiable consent from a parent or lawful guardian. Verification may rely on identity details we already hold, a virtual identity token, or an authorised identity service such as Digital Locker — we do not need to re-collect identity documents for this.

We do not track, behaviourally monitor, or serve targeted advertising to children. The rules provide limited exemptions for certain purposes such as healthcare, education and child safety, but we do not rely on them to build advertising profiles of minors.

Account creation requires you to be 18 or older. A student under 18 uses StudyDesk through a parent or lawful guardian, or through a library-managed admission where the library has confirmed it holds the necessary parental authorisation. If you believe a child's data has reached us without proper consent, write to us at the address in section 20 and we will delete it.

Where a person has a disability and cannot act independently, the rules require us to obtain the verifiable consent of a lawful guardian before processing their personal data, and to satisfy ourselves that the guardianship is valid — for example, that it was appointed by a court or designated by a competent authority.

Library admissions that record such a guardianship will record the basis, so we can rely on it later. We do not require a guardian to re-verify on every visit.

We never sell personal data. Not to advertisers, not to data brokers, not to anyone else. There is no product we sell that depends on that.

Sharing happens in these cases, and only these cases:

• Your library administrator. If you are a member, the staff of the library you are registered with can see your name, contact details, seat, shift, attendance and payment status. This is operationally necessary to run the library, and it is scoped to that library.
• Processors acting on our instructions. We list them in section 9. They are bound to process personal data only as we instruct.
• Legal and safety purposes. Courts, regulators and law enforcement where applicable law requires it, and to prevent fraud or protect vital interests.

We do not share personal data with advertisers, and we do not build advertising audiences from your library activity.

These providers process personal data on our instructions, under contractual safeguards:

• Razorpay — member payments into your library's account.
• Dodo Payments, as Merchant of Record — StudyDesk's own subscription billing, tax invoices and indirect-tax compliance.
• Vercel — hosting and edge delivery.
• Firebase Cloud Messaging — push notifications.
• Cloudinary — profile photo storage.
• SMTP providers — transactional email.
• Our WhatsApp gateway — login codes and service notifications.

Each acts as a Data Processor rather than a Data Fiduciary for your data. We are responsible for choosing them and for the instructions we give them. If you want the current list, or a copy of the data processing terms, ask us and we will send them.

Section 16 of the DPDP Act permits personal data to be processed outside India. Some of our processors operate or replicate outside India, so transfers do occur.

Where the Central Government notifies requirements for making data available to a foreign State or its agencies, or notifies a country in which transfers are restricted, we comply with those requirements and do not transfer to a restricted jurisdiction.

For users in the EU and the UK, where GDPR or UK GDPR applies, we rely on adequacy decisions or Standard Contractual Clauses as appropriate. Write to us for a copy of the safeguards we use, or for the details of where your data is processed.

Note that the data processing provisions of the DPDP Rules, 2025 come into force on 13 May 2027. We do not wait for that date before applying transfer safeguards.

Section 8(5) of the DPDP Act requires reasonable security safeguards, and the rules describe what that means in practice. The safeguards we apply include:

• Encryption of personal data in transit and at rest, with payment secrets held under keys kept separate from session secrets.
• Access control on computer resources, least-privilege production access, and role-based permissions so staff see only what their role needs.
• Logs and monitoring to detect, investigate and prevent unauthorised access, retained for a defined period.
• Backups for continuity, with tested restores.
• Contractual security obligations imposed on every Data Processor listed in section 9.
• Tenant isolation enforced server-side on every query, so one library can never reach another's records.

Passwords are stored as bcrypt hashes — one-way values used to verify a password without retaining it.

No system is impregnable, including ours. Two things help materially: use a strong, unique password, and never share your QR pass, a one-time passcode, or your login details with anyone — not even someone claiming to be from our support team. If you suspect misuse, report it to us immediately.

Section 8(6) of the DPDP Act and the rules require a two-track response.

To you: on becoming aware of a personal data breach we inform each affected Data Principal without delay. That notice is in plain language and describes what happened, the likely consequences, the measures we have taken, and the steps you can take to protect yourself.

To the regulator: we give the Data Protection Board of India an initial intimation without delay, followed by a detailed report within 72 hours. That period can be extended on request where the facts require it. The detailed report covers the facts of the breach, the categories and approximate volume of data and records affected, the likely consequences, the measures taken, and the remedial action proposed.

We preserve the relevant logs for investigation, as the law requires.

The substantive breach provisions come into force on 13 May 2027 under the staged commencement of the DPDP Rules, 2025. We have implemented the notification process ahead of that date.

Sections 8(7) and 8(8) require us to erase personal data once the purpose for which it was collected is no longer served, unless another law requires us to keep it.

In practice that means:

• Account and profile data is kept while your account is active, and is deleted after we verify a deletion request.
• Membership, attendance and payment records are kept while needed to operate the library, to resolve disputes, and to meet tax and legal record-keeping obligations. Financial records are kept for the retention periods the applicable tax law requires. After that they are erased or irreversibly anonymised.
• Support messages and notification logs are kept for our retention windows and then deleted.
• Backups roll off on their own cycle, so a residual copy may persist until rotation completes.
• Anonymised, aggregated statistics that cannot identify any individual may be kept indefinitely to improve the service.

The rules additionally set specific retention periods by class of fiduciary, and a longer default for very large e-commerce, social media and online gaming platforms. StudyDesk is not a platform of that scale and those provisions do not apply to us.

Chapter III of the DPDP Act gives you these rights, and we will help you use them:

• Access (section 11) — ask for a summary of the personal data we process about you, the purposes of that processing, the categories of data concerned, and the recipients we have shared it with.
• Correction and completion (section 12) — ask us to correct inaccurate data or complete incomplete data. Much of this you can do yourself in the app.
• Erasure (section 12) — ask us to erase your personal data, unless retention is necessary for the purpose it was collected for or for law.
• Grievance redressal (section 13) — complain to us, and expect an answer.
• Nomination (section 14) — nominate another person to exercise these rights on your behalf if you die or become incapacitated.

How to exercise them: write to [DPO EMAIL] from the email address registered to your account, or raise it through in-app support. You do not need to write to us from the same address in every case, but we will ask you to verify your identity before we disclose anything, so that we cannot hand your record to someone who is not you.

How quickly we answer: we respond to rights requests within 90 days. We answer grievances within 30 days. Both are faster in practice, and we will tell you if a request is going to take longer.

If a grievance is not redressed within 30 days, section 13(3) lets you approach the Data Protection Board of India.

Section 15 of the DPDP Act places duties on you as well as on us, and we depend on you meeting them.

Keep the information in your account accurate and current. Tell us promptly if it is not. We rely on it for occupancy, billing and access decisions, and an error that reaches a seat allocation or an invoice is an error we cannot see from our side.

Do not share your credentials, your QR pass, or a one-time passcode with anyone. Do not use another member's pass to enter. If you believe someone else has used your pass, tell us straight away so we can check the attendance record while the evidence is still recoverable.

We use only what the product needs.

• Strictly necessary — session and authentication cookies and security tokens. The site cannot function without these, so they cannot be switched off.
• Preferences — interface choices such as theme, stored on your device.

We do not use advertising trackers. We do not sell browsing behaviour. We do not profile you across sites.

The Android app stores installation and push tokens, used for authentication and notifications only.

You can manage cookies in your browser settings; blocking strictly necessary cookies will sign you out. "Do Not Track" signals have no agreed standard meaning and we do not act on them separately.

We apply the core protections to everyone, wherever they are. If you are in the EU, UK, California or elsewhere, there may be additional rights under your local law.

GDPR and UK GDPR: you may have the rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions producing legal or similarly significant effects. Write to [DPO EMAIL] to exercise them; you may also complain to your supervisory authority.

California (CCPA/CPRA): you may have the right to know what is collected and shared, to delete, to correct, and to opt out of sale or sharing. We sell nothing and share only as described in section 8, so there is nothing to opt out of. We do not discriminate against you for exercising a privacy right.

Library customers operating under GDPR can request a Data Processing Agreement.

The Data Protection Board of India is the authority established under the DPDP Act. It was notified on 13 November 2025, and complaints can be filed with it once our internal grievance process has been exhausted. Appeals against its orders go to the Appellate Tribunal, which for these matters is the Telecom Disputes Settlement and Appellate Tribunal.

Penalties are set by the Schedule to section 33 of the Act, and the Board sets the amount within those caps having regard to the gravity, duration and impact of the breach and whether the person mitigated it. The caps include up to ₹250 crore for failure to take reasonable security safeguards, up to ₹200 crore for failing to notify a personal data breach, and up to ₹200 crore for failures relating to children's data. Breach of any other provision can attract up to ₹50 crore.

We have not been notified as a Significant Data Fiduciary. If the Government notifies us or our class under section 10, the additional obligations in that section — annual Data Protection Impact Assessments, an annual independent audit reported to the Board, and a Data Protection Officer based in India — will apply to us in addition to everything described here.

We update this notice as the service or the law changes. Material changes are notified in advance by email and by in-app notice, and the "Last updated" date below changes.

If you continue to use StudyDesk after the effective date of a revision, you accept the revised notice. If you do not agree with it, stop using the service and exercise your right to erasure — section 14 explains how.

Privacy questions, rights requests and complaints can all come to the same place:

• Data Protection contact: [DPO EMAIL]
• Grievance Officer: [GRIEVANCE OFFICER NAME] — [GRIEVANCE EMAIL]
• General support: support.studydesk@gmail.com · +91 91429 26740

Our timelines, whichever route you use:

• Rights requests (access, correction, erasure, nomination) — answered within 90 days.
• Privacy grievances — answered within 30 days. If you are not satisfied, section 13(3) lets you approach the Data Protection Board of India.
• Consumer complaints — acknowledged within 48 hours and resolved within one month, as required by rule 6 of the Consumer Protection (E-Commerce) Rules, 2020.

Please send accurate information and avoid frivolous complaints. A fabricated or repeatedly baseless complaint diverts the same support capacity from real ones.

If a complaint is a consumer dispute rather than a privacy matter, the Consumer Protection Act, 2019 also gives you the right to approach the District, State or National Consumer Disputes Redressal Commission, and to use the National Consumer Helpline.