StudyLens — Privacy Policy

Version 5

StudyLens is a service of Connectz Digital Services, Bhubaneswar, Odisha, India. StudyLens is a product name, not a separate company — where this document says "we", "us" or "our", it means Connectz Digital Services, and Connectz Digital Services is who you are dealing with and who is responsible to you. “Connectzz”, used in our email address and website, is a brand name of Connectz Digital Services and is not a separate company.

---

What this is. This policy explains what we collect, why, and what we genuinely cannot see.

Who this is for. Two kinds of people use StudyLens: tutors, who record academic progress for the students they teach, and parents or legal guardians, who see the student’s record. A student never has an account and never uses the app.

Read this together with the Terms of Service for your role.

---

1. Our role: we carry the message. That is all.

StudyLens is a noticeboard between a tutor and a parent. We have no role whatsoever in the tutoring.

The tutor teaches. The tutor decides what to write down. The parent reads it. We move it from one phone to the other, and we cannot read the student’s records.

We have no role in:

• The teaching. We do not teach, tutor, coach, assess, mark, grade or examine anyone
• What gets recorded. Which student, what about them, and whether it is true — all the tutor’s decision, none of ours
• Who teaches whom. We do not find tutors for parents, or parents for tutors. We do not introduce, recommend, vet, or check anyone’s qualifications
• The money between you. We do not set, collect, hold, or handle tuition fees. Ever
• The relationship itself. Its price, its timings, its quality, its disputes, its ending — none of it is ours

If a tutor teaches badly, records something wrong, or behaves badly, that is between you and that tutor. We are not their employer, their agent, their guarantor or their referee. We supplied the noticeboard.

1b. Who is responsible, in law

Responsibility follows what is actually being done with the data, and in StudyLens it splits in two:

For a student’s records — the tutor is the Data Fiduciary and we are the Data Processor. Under the Digital Personal Data Protection Act 2023 the tutor decides which student to record, what to record, and which parent may see it. We store the result encrypted and cannot read it. Every tutor accepts this in the Data Processing Agreement.

For your own account, whether you are a tutor or a parent, we are responsible (the Data Fiduciary).

• Everyone: your name, mobile number, app language, crash reports, the records of what you agreed to, and the security checks at sign-in.
• Tutors also: PIN code or country, email (if you add one), and subscription records.

We decide why we keep these and for how long, so we answer for them. §2 and §3 list each one.

The one thing that is ours throughout: keeping what we hold safe. §8 says how.

---

1a. The most important technical fact

Most of what StudyLens stores, StudyLens cannot read.

The student’s name, board, class, subjects, every test score, attendance, homework and the fee charged are encrypted on the tutor’s and the parent’s own phones, before anything is sent to us. The key that unlocks them is created on the device and stored in the phone’s secure keystore. It is never sent to us and we never hold a copy.

This is not a promise about how we behave. It is how the system is built. If our database were stolen tomorrow, the thief would get unreadable ciphertext. If a court ordered us to hand over a student’s marks, we could hand over only ciphertext, because that is genuinely all we have.

What is not encrypted, and why

We would rather be precise than impressive. These are stored in plain form:

• The dates entries were made on, so a history can be shown in order without loading all of it
• Internal reference numbers for a student and a tutor, because the server-side security rules check them to decide who may read what — encrypt these and the protection itself stops working
• Whether a homework item was cancelled, for the same rule-checking reason

What that reveals, stated honestly: that an entry was made on a date, against a reference number that means nothing on its own. It does not reveal a student’s name, their marks, or what anyone pays. This is a deliberate, named trade, not an oversight.

What follows from all this, and what you must do about it

Because the key exists only on the device, StudyLens is technically incapable of recovering encrypted records if the key is lost — for example when a phone is lost, reset or replaced without completing the recovery process. This is a property of end-to-end encryption, not a service failure, and there is no configuration in which we could restore that data.

So StudyLens provides these, and you are expected to use them:

• A recovery process, set up on the device, which restores access if it is completed
• Export at any time, to a file, CSV or PDF — a tutor can take a full copy of every record whenever they wish

Keeping an export is the tutor’s responsibility. We tell you this before you begin, we make the tools available at no cost and without restriction, and we remind you inside the app.

Nothing in this section limits any liability that cannot be limited under Indian law.

---

2. What we can read

From every account holder — an adult:

• The name you enter for yourself
• Your mobile number, used to sign you in (verified by Google Firebase Phone Authentication)
• Your chosen app language
• Whether you are a tutor, a parent, or both
• When you signed up

From tutors only, in addition:

• The PIN code of the area you teach in, or the country you teach in if you teach outside India
• Your email address, if you choose to add it in Settings. It is optional. You confirm it with a link we send you. We use it to send you notices about your account

Technical and operational data:

• Which student records belong to which tutor and which guardian — identifiers only, no names
• Whether a student is currently being taught, and the price band used to calculate the tutor’s bill. This carries the board category and nothing that identifies a student
• The dates and counts of entries — that a score was recorded on 14 August, never what it was
• Basic diagnostic information if the app crashes

We collect only what StudyLens needs to work for you, and nothing more. We do not access your location, contacts, photos, microphone or browsing, and we do not use advertising identifiers.

---

3. Why we hold it

---

4. Students’ data

StudyLens is the tool a tutor uses to record a student’s academic progress. StudyLens does not record it, does not decide what is recorded, and cannot read what is recorded. The tutor decides; we carry.

The tutor is the Data Fiduciary for that student (§1b). It is the tutor’s legal obligation to obtain the verifiable consent of the student’s parent or legal guardian before recording anything about them, and the app requires the tutor to confirm, for each individual student, that they have it.

A tick in an app is not the same as consent having been validly obtained. The confirmation records that the tutor says they have permission. It is evidence of their undertaking to us — it is not itself the guardian’s consent, and it does not relieve the tutor of obtaining it.

What we are responsible for, and hold ourselves to regardless:

• A student never holds an account. Only adults sign in.
• A student’s identity is encrypted end-to-end and is not visible to us at any point.
• A parent or legal guardian must confirm they are the guardian before they can see a student’s record.
• A tutor must confirm they have the guardian’s permission before recording anything about a student.
• We do not profile students, track their behaviour, or permit any third party to. Targeted advertising directed at students is prohibited by law, and we comply with that.
• StudyLens does not currently show advertising of any kind. If that ever changes we will update this policy and tell you before it does.
• We do not sell or rent personal data to anyone for their own purposes.

If you are a parent using StudyLens, you can act yourself, in the app, on the student’s screen:

• Pause updates from your tutor: the tutor can add nothing new; you can resume at any time.
• End with this tutor: the tutor can never add anything again for that student, and everything about that student is deleted 30 days later. You can download a copy first.
• To leave StudyLens altogether: Settings → Delete my account.

If you are a guardian who does not use StudyLens and believe a student’s record is held without your permission, write to info@connectzz.com. We will look into it and take appropriate action, which may include requiring the tutor to remove the record, and restricting or suspending the account.

---

5. Who else touches the data

We use no advertising networks, no analytics brokers, and no data enrichment services.

5a. Where the data physically sits

Our infrastructure runs on Google Cloud, and Google may store or process information outside the state or country you live in. Where personal data crosses a border, we handle it in line with applicable Indian law and any restriction or safeguard that law requires for the transfer.

What crosses is what we hold — which for a student’s records is ciphertext. A change of country does not change what is readable, because nobody outside the two phones holds the key.

If the law on cross-border transfers changes, we will update this policy.

---

6. How long we keep it, and when it is deleted

In short: we keep a student’s records only while a tutor is actually keeping them, and we tell people before anything is deleted.

When a student’s records are deleted

• The tutor marks the student "Left", or deletes their own account. After 30 days, everything about that student is deleted from our systems. The parent can download a copy before then.
• The tutor records nothing for a student for 6 months. At 6 months the student is marked "Left" automatically, and the 30-day rule applies.
• A parent ends with the tutor ("End with this tutor", in the app). The tutor can add nothing more for that student, and the parent can download a copy. After 30 days, everything about that student is deleted.
• A parent deletes their own account. The parent’s own account and their links to students are deleted. The tutor’s records stay, because they are the tutor’s records of their own teaching.

When a tutor stops renewing

• When a tutor’s subscription ends — or their months at no cost end, if they never subscribed — the account becomes view and export only for 3 months.
• For the next 3 months (a grace period), the account stays the same: the tutor can still renew, or download a copy of all their records.
• At the end of those 6 months, the tutor’s account and all their students’ records are deleted. Parents can download a copy at any time before then.
• Renewing at any time before then keeps everything.

Deleting your account

Tap "Delete my account" in Settings, use our deletion page at connectzz.com/studylens-delete-account, or write to info@connectzz.com. You can ask this way even if you have uninstalled the app.

• In the app, every encryption key on that phone is destroyed straight away and you are signed out, so the records become unreadable to everyone at once. Your request reaches us at the same moment.
• We complete the deletion on our systems within 30 days and confirm it to you. Your own details go first. A tutor’s students’ records follow the 30-day rule above.
• Before we delete anything, we confirm the request is really yours. Tutors: we reply to your registered email address and ask you to confirm, or, if you have not given us one, we contact you on your registered mobile number. Parents: we contact you on your registered mobile number to confirm. If we cannot confirm a request, we do not delete the account.

The keys exist only on the phones, so the records are unreadable to us at every stage. Deletion removes them from our systems as well.

Backups

Information can persist for a while in backup and disaster-recovery systems after it is removed from live systems. That is true of essentially every online service, including ours. Those copies are held under the same security as everything else and age out on their normal cycle.

---

7. Your rights

Under the Digital Personal Data Protection Act 2023 you may:

• Access the personal data we hold about you
• Correct anything inaccurate
• Erase your data, subject to what law requires us to keep
• Withdraw consent, which stops further processing
• Nominate someone to exercise these rights if you cannot
• Complain to us, and then to the Data Protection Board of India

You do not need to ask us to get your data out. Export is built into the app. A tutor can export every record, at any time, as a file, CSV or PDF — including while an account is suspended for non-payment. We will never withhold your data to make you pay or to stop you leaving.

To exercise any right, write to info@connectzz.com. We will respond within 30 days.

We will check that you are who you say you are, and we will not apologise for it.

This is an app about students. "I am the parent, send me the records" is exactly the message someone would send if they were not the parent — a separated spouse, a relative, anyone. So before we act on a request about a student we will confirm your identity, normally by contacting you on the mobile number already registered on the account.

• We ask for as little as possible to be satisfied — never a stack of documents
• If we cannot satisfy ourselves that you are entitled to it, we will refuse, and tell you why. You can take that to our grievance officer and then to the Data Protection Board of India
• For a student’s own records, the request usually belongs with the tutor, who holds them and is the Data Fiduciary — see the Terms of Service. We will tell you if that is the case rather than leaving you waiting

---

8. Security

• Client-side encryption of every academic field, using XSalsa20-Poly1305 (NaCl secretbox)
• Keys held in the device secure keystore (Android Keystore), never transmitted
• Server-side access rules enforced by the database, not by the app — a modified app cannot read another person’s data
• Optional app lock with a PIN, salted and rate-limited
• Device backup of app data disabled
• App permissions reduced to the minimum required

No internet-connected service can promise that no incident will ever happen, and we do not. What we can tell you is what we hold and in what form, which is what §1a and §2 do.

You should also protect your phone, your SIM and mobile number, your app lock, your recovery method, and any exported files containing a student’s information.

If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.

---

9. If the business changes hands, or StudyLens closes

If Connectz Digital Services is involved in a merger, restructuring or sale of the business, information we hold may transfer as part of that transaction — subject to applicable law and to the protections in this policy continuing to apply.

Encryption travels with the data. A new owner would inherit the same ciphertext and the same inability to read it. They would not receive keys, because we have none to give.

If StudyLens has to close, including for reasons we did not foresee:

• We will give as much notice as we practically can, in the app.
• Export will keep working for as long as we are able, so tutors can take a full copy of their records. Parents can ask their tutor for a copy.
• Once the service has closed, we delete the information we hold, apart from records the law requires us to keep, such as billing and consent records. These contain no student details.

---

10. Other services you may reach

StudyLens links to and relies on services run by others — app stores, Google Firebase, Google’s notification service. Those services operate under their own terms and privacy policies, which this policy does not control.

---

11. Grievance officer

As required by Indian law:

Ravi Venkat

info@connectzz.com · +91 78150 80585

Connectz Digital Services

Sahidnagar, Bhubaneswar, Odisha, India

We aim to acknowledge within 7 working days and resolve within 30 days.

---

12. Changes

If we change this policy in a way that materially affects you, we will ask you to read and accept the new version inside the app. We will not apply new terms to an old acceptance. Every version is dated, and the version you agreed to is recorded against your account.

---

13. Governing law

This policy is governed by the laws of India. Courts at Bhubaneswar have exclusive jurisdiction, subject to any right the law requires to be available to you elsewhere.

---

Version 5.