Privacy Policy

This Privacy Policy explains how BookYaar Private Limited ("BookYaar", "we", "us") collects, uses, stores, shares and protects personal data when you use bookyaar.com, our web app and related services (the "Platform"). BookYaar is a software platform that helps tuition and coaching teachers organise their classes, student records, fee records and study material. BookYaar does not run a marketplace and does not collect tuition fees on a tutor's behalf.

Legal entity

BookYaar Private Limited · CIN U85500UP2026PTC241192

Registered office

Ghazipur (Zamania), Uttar Pradesh 232328

Operations office

Plot 282, Block AG, Shalimar Bagh, North West Delhi 110088

General contact

official@bookyaar.com · +91 70768 83071

Privacy & data questions

grievance@bookyaar.com (see Section 11)

This policy is published under the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. It is aligned with the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025.

Under the current Starter plan, the Platform is used only by tutors, who must be 18 or older. This policy covers:

• Tutors who create an account;
• Students and parents/guardians whose details a tutor enters into their records (they do not have their own accounts in Starter), including parents who receive class updates from us at the tutor's request;
• Visitors to bookyaar.com, including anyone who sends us an enquiry through the contact form.

When we later add student and parent accounts, paid plans, Coins or other features, we will update this policy and publish any additional terms before those features go live.

We do not ask for or store full card or bank account numbers, Aadhaar, or health information.

We use personal data to:

• create and run your account;
• provide the Platform's features (classes, records, fee summaries, statements, study material);
• verify your identity and keep the Platform secure, including detecting misuse and fraud;
• send service messages;
• respond to enquiries, support requests and grievances;
• understand our user base through aggregate reporting;
• improve the Platform;
• meet legal, tax and regulatory obligations.

Our lawful basis under the DPDP Act is your consent, which you give at signup, and the legitimate uses the Act permits (for example, data you voluntarily provide for a specific purpose, and compliance with law).

Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the stated purpose. You may withdraw it at any time, as easily as you gave it (Section 10). Withdrawal does not affect processing already done, but we may then be unable to provide the Platform to you.

We do not sell personal data, use it for third-party advertising, or build advertising profiles.

• For student records a tutor enters, the tutor decides what to collect and why, so the tutor is the Data Fiduciary for that data. BookYaar acts as the tutor's Data Processor. We process that data only to provide the Platform to the tutor and on the tutor's instructions.
• Before adding a student's or parent's details, the tutor must have the permission of the student's parent/guardian, and gives a written undertaking on the Platform each time (Section 6). The tutor should add only the details they need. Our responsibilities as processor are set out in the Data Processing Terms, which form part of the Terms of Service.

Students and parents may contact the tutor, or our Grievance Officer (Section 11), about this data. We will help the tutor respond or act on the request.

Service messages to tutors — OTPs, account, security and important service notices. We send them by SMS through a TRAI DLT-registered sender (as required by the Telecom Commercial Communications Customer Preference Regulations, 2018), by email, or in the app. These are needed to run your account.

Class updates to parents — a tutor may add a parent's mobile number so that the parent receives class updates. This works as follows:

1. The tutor gives an undertaking that the parent has agreed to share the number with BookYaar for class updates.
2. We send the parent one opt-in message (WhatsApp, or SMS if WhatsApp is not available) explaining who added the number and why, with a link to this policy, and asking the parent to choose YES or NO.
3. Only if the parent chooses YES do we send class updates: class reminders, schedule changes or cancellations, and the monthly statement after the tutor has reviewed it. If the parent chooses NO or does not reply, we send nothing further.
4. The parent can stop the updates at any time by replying STOP, using the stop option in the message, or writing to our Grievance Officer.
5. We keep a record of each opt-in, opt-out and STOP request as proof of consent (Section 9).

No advertising to parents. We never use a parent's number for promotions or advertising. If we ever want to, we will first ask the parent for separate, express consent.

Promotional messages to tutors — only with your consent. You can opt out at any time by replying STOP (SMS), using the unsubscribe link (email), or writing to us.

We share personal data only with service providers who help us run the Platform. They are bound to use it only for these purposes and to protect it.

Changes to our service providers

If we add or replace a service provider that stores or processes your personal data, or move your data to a new location, we will:

• tell you at least 30 days in advance, by email and in the app, with reminders before the change;
• let you object during that period. If you object, you may close your account; we will delete your data before the change takes effect and will not transfer it, and we will refund any unused part of a paid add-on;
• have the old provider delete our data within 90 days of the change, including from its backups.

In an emergency (for example a security incident, a provider shutting down or failing, or a legal order), we may make the change immediately to protect your data and keep the service running. We will then tell you within 72 hours, and you keep the same right to close your account.

We may also disclose data:

• where required by law, court order or a lawful request from a government authority;
• to protect the rights, property and safety of our users, the public or BookYaar;
• to a successor entity in a merger or acquisition, under the same protections.

In Starter, we do not share users' personal data with artificial-intelligence (AI) service providers.

We use only essential cookies and browser storage. They keep you signed in, keep your session secure, and remember simple preferences (such as the sidebar layout). We do not use advertising cookies or third-party analytics trackers. Blocking essential cookies in your browser may stop the Platform from working. If we ever add analytics or other non-essential cookies, we will update this policy and ask for your consent first.

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires. After that, we delete or anonymise it.

Under the DPDP Act, you have the right to:

• get a summary of your personal data and how we process it;
• correct, complete or update your data;
• have your data erased, where the law allows;
• withdraw consent;
• nominate another person to exercise your rights if you die or become incapacitated;
• have your grievances addressed.

How: most details can be edited directly in your account. To ask for a data summary, erasure, consent withdrawal or account deletion, use the Privacy & Data options in account settings (where available), or email grievance@bookyaar.com from your registered email or mobile. We will acknowledge within 24 hours and respond within 30 days. We may need to verify your identity first. Every reply will include our contact details for privacy questions.

Grievance Officer

Achintya Upadhyay, Grievance Officer, BookYaar Private Limited

Email

grievance@bookyaar.com

Phone

+91 72660 19278 (Monday–Saturday, 10:00 am – 6:00 pm)

Address

Plot 282, Block AG, Shalimar Bagh, North West Delhi 110088

Timelines

Acknowledgement within 24 hours with a ticket number. Resolution within 15 days. Unlawful content is removed within 24–72 hours as the law requires. Matters about a child's safety or privacy are treated as urgent.

The Grievance Officer is also the person who answers questions about how we process personal data. If you are not satisfied with the Grievance Officer's decision, or your complaint is not resolved in time:

• you may appeal to the Grievance Appellate Committee under the IT Rules, 2021 within 30 days (gac.gov.in);
• for personal-data matters, you may complain to the Data Protection Board of India after using our grievance process.

We follow reasonable security practices aligned to ISO/IEC 27001 and the safeguards required by the DPDP Rules, 2025. These include:

• encryption of data in transit (HTTPS) and one-way hashing of passwords;
• role-based access controls with least-privilege access;
• monitoring and access logs;
• regular backups;
• security clauses in our contracts with service providers;
• a documented Information Security Policy that we review every year.

No system is completely secure, but we work continuously to protect your data.

If a personal-data breach happens, we will act promptly to contain it and assess its impact. We will:

• inform affected users without delay through their account or registered contact details, explaining what happened, the likely consequences, what we are doing, and what they can do;
• notify the Data Protection Board of India without delay, with a detailed report within 72 hours of becoming aware of the breach, as required by the DPDP Rules, 2025;
• keep a record of every incident and our response.

Our website, app, API and database run on a Hostinger server in Mumbai, India, and files are stored in the AWS Mumbai region. Hostinger takes a weekly backup of our server, which it keeps and manages under its own policy (linked in Section 7). These backups are kept primarily in India, but Hostinger may store backup copies in other locations. WhatsApp messages are delivered through Meta's systems, which may be outside India. Some providers, such as Google for sign-in, may also process data outside India. In every such case we make sure appropriate safeguards are in place, and we will not transfer data to any country the Government of India restricts under the DPDP Act.

The Starter plan is for tutors aged 18 or older. Children do not create accounts or use the Platform directly in Starter. A child's details reach us only as student records entered by a tutor with parent/guardian permission (Section 5). Class updates that mention a child are sent only to a parent who has chosen YES (Section 6). We do not track the behaviour of, monitor, or target advertising at children.

When we introduce student and parent accounts, we will obtain verifiable consent from a parent/guardian before processing a child's data, as required by Section 9 of the DPDP Act, and publish a separate Children's Data & Parental Consent Policy.

We may update this policy from time to time. We will post the new version with a new effective date and version number, and tell you about material changes by email or in the app. Where the law requires, or where a change materially affects your rights, we will ask you to accept the updated policy again. At least once a year, we will also remind users of this policy and of the Terms of Service.

By ticking the box at signup yourself (it is never pre-ticked), or by continuing with Google after being shown this policy, and by using the Platform, you confirm that you have read and understood this Privacy Policy and consent to the processing described in it.

• Terms of Service (including the Data Processing Terms)
• Refund & Cancellation Policy
• Grievance Redressal