Privacy policy

Kidversal is run by [Company legal name], [registered address] (“we”). This policy explains what we collect, why, and the choices parents have. It is written for India’s Digital Personal Data Protection Act, 2023 (DPDP Act), which treats everyone under 18 as a child.

Parents are in charge

• Only a parent or legal guardian can create an account. Children never sign up on their own.
• We only process a child’s data after their parent gives verifiable consent, recorded with the date and the version of the consent text.
• A parent can see everything their child does, pause the account at any time, and ask us to delete it.

What we collect

• About parents: name, email address, WhatsApp number and password (stored encrypted), and the date you verified your contact details.
• About children: first name and surname initial (shown as “Nitya S.”), an age band (not a date of birth), a login name and a PIN (stored encrypted), and what they do in the app — books listed, lent and borrowed, friends, circles, badges and reviews.
• Technical: IP address and browser details for security and to record consent.

We do not collect a child’s email, phone number, photo, school name, address or location.

Why we use it

• To run the service: libraries, circles, friendships, handoffs, reminders and badges.
• To keep children safe: parent approvals, moderation and an audit record of consents and approvals.
• To send parents verification codes, approval requests, reminders and (if enabled) an evening summary.

What we never do

• No advertising, and no ads aimed at children.
• No tracking or behavioural monitoring of children, and no third-party tracking or analytics tools.
• We never sell personal data.

Who can see what

• Other children only see a child’s first name and initial, and only inside circles their parent joined. Nothing is public and nobody can search for a child by name.
• Handoff places are named spots (like “Society clubhouse”) shown only to approved borrowers — never home addresses.
• We use service providers to run Kidversal: hosting, email (Amazon Web Services) and WhatsApp messaging (BiteSpeed). They process data only on our instructions.

How long we keep it

While the account is active. When a parent deletes a child’s account, we erase the child’s profile and activity straight away; encrypted backups roll off within [backup retention period]. We keep a minimal record that consent was given or withdrawn, as the law requires.

Your rights

Parents can access, correct or erase their own and their child’s data, withdraw consent (which pauses or deletes the child’s account), and raise a grievance. Most of this is available in your parent settings; for anything else, contact our Grievance Officer.

Grievance Officer

[Name], hello@kidversal.com. We aim to respond within [number] days. If you are not satisfied, you may complain to the Data Protection Board of India.