Privacy Policy — Shlokshaala
1. Who we are
Shlokshaala (“Shlokshaala”, “we”, “us”, “our”) is a sole proprietorship owned by M/S STRATOSALLY, with its principal place of business at SHAILVANI, KOTDWARA, UTTARAKHAND, 246149, India.
We operate the Shlokshaala mobile application and the website at https://shlokshaala.com (together, the “Service”) — a Sanskrit shloka and Indic-stories learning service for children.
- Under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025, we are the Data Fiduciary for the personal data described in this policy.
- Under the EU/UK General Data Protection Regulation (“GDPR”), we are the Data Controller.
Contact: info@shlokshaala.com
2. The one thing to know first
Shlokshaala accounts belong to parents, not children.
Only a parent or lawful guardian aged 18 or over may create an account. A child uses the Service through a profile inside the parent's account, under that parent's supervision and consent. We do not issue independent logins to children.
We also want to be direct about what this means in practice:
- We do not collect a child's name, date of birth, gender, photograph, address, school, or contact details.
- We do not track, profile, or behaviourally monitor children.
- We do not show advertising of any kind, personalised or otherwise.
- We do not sell, rent, or trade personal data. Ever.
- We do not record your child's voice, and the app does not use your microphone or camera outside live sessions.
These are not aspirations. Sections 6 and 7 set out exactly what we do collect.
3. Scope
This policy covers the Shlokshaala app, our website, and our live mentor sessions. It does not cover third-party services you reach through us — Microsoft Teams, Razorpay, and the Google Play Store each have their own privacy policies, and we link to them in Section 12.
4. Children's data — our specific commitments
Under Section 2(f) of the DPDP Act, a “child” in India is anyone under 18 years of age. Because our entire audience is children aged roughly 4 to 14, we treat every learner on the Service as a child, and we apply the following to all users regardless of country.
4.1 Verifiable parental consent
Before any child's data is processed, we obtain verifiable consent from a parent or lawful guardian. We do this by:
- Verifying a mobile number by OTP. The account can only be created and accessed by a person in control of that number.
- Presenting an explicit consent screen in which the account holder confirms, as a positive action, that they are aged 18 or over, that they are the parent or lawful guardian of the child who will use the Service, and that they consent to the processing described in this policy. This declaration is recorded with a timestamp and retained as our record of consent.
- Corroborating adult status through the payment mandate where a paid subscription is taken, since payment instruments are issued to adults and are registered in an adult's name.
You can withdraw this consent at any time. Section 15 explains how.
4.2 What we deliberately do not do
In line with Section 9(3) of the DPDP Act, we do not:
- track a child, or monitor their behaviour;
- carry out advertising targeted at a child;
- build advertising, marketing, or interest profiles of any user;
- use automated decision-making or profiling that produces legal or similarly significant effects;
- process a child's data in any way likely to cause a detrimental effect on the child's well-being.
We hold no advertising SDKs, no attribution SDKs, and no advertising identifiers.
4.3 The device access lock
The app can require a device passcode, PIN, or fingerprint/face unlock when it is opened and again after a continuous period of use. This is a child-access and screen-time control for parents. It is not identity verification and we do not treat it as such.
Your biometric data never reaches us. Fingerprint and face data is held in your device's secure hardware and checked by your device's operating system. The app receives only a yes-or-no result. We never receive, see, store, or transmit any biometric information.
4.4 Religious and cultural content
Shlokshaala teaches Sanskrit shlokas, stotras, and stories from the Ramayana, Mahabharata, Bhagavad Gita, and Panchatantra. Under Article 9 of the GDPR, information that reveals religious or philosophical beliefs is “special category” data, and the act of enrolling a child in a devotional-education service may reveal such information.
Where the GDPR applies to you, we rely on your explicit consent under Article 9(2)(a) as our condition for this processing. You give that consent knowingly when you create an account, and you may withdraw it at any time by deleting the account. Under the DPDP Act, this data is treated as personal data processed on the basis of your consent.
We do not use this information for anything other than delivering the Service to you.
5. Categories of people whose data we handle
- Parents / guardians — the account holders.
- Children — learners using a profile within a parent's account.
- Mentors — engaged by us to deliver live sessions. Their data is handled under a separate arrangement and is not covered by this policy.
6. What we collect
| What | From whom | Why | Legal basis (DPDP) | Legal basis (GDPR) |
|---|---|---|---|---|
| Mobile number | Parent | Account creation and login by OTP; account security; service notices | Consent (s.6) | Contract, Art 6(1)(b) |
| Email address | Parent | Live-session invitations, receipts, service communication, support | Consent (s.6) | Contract, Art 6(1)(b) |
| Record of parental consent (declaration, timestamp) | Parent | To evidence lawful processing of a child's data | Legal obligation / Consent | Legal obligation, Art 6(1)(c) |
| Child's age or age range | Parent, at live-session booking | To place the child in an age-appropriate session group | Consent (s.6) | Consent, Art 6(1)(a) |
| Child's chosen learning path and progress (shlokas started, completed, streaks) | Generated in-app | To show progress and continue the child's learning where they left off | Consent (s.6) | Contract, Art 6(1)(b) |
| Interest in devotional/Sanskrit education (inherent in use) | Inherent | To deliver the Service | Consent (s.6) | Explicit consent, Art 9(2)(a) |
| Subscription status, plan, renewal date, transaction ID, payment status | Razorpay / Google Play | To give access to paid content; refunds; accounting | Contract / Legal obligation | Contract, Art 6(1)(b); Legal obligation, Art 6(1)(c) |
| Device model, OS version, app version, crash and diagnostic logs, coarse country from IP | Device | To keep the app working and fix crashes | Legitimate use / Consent | Legitimate interests, Art 6(1)(f) |
| Live session participation — attendance, in-session video and chat while the session runs | Live session | To deliver the class | Consent (s.6) | Contract, Art 6(1)(b) |
| Support correspondence | You | To answer you | Consent / Contract | Contract, Art 6(1)(b) |
Progress data is used only to run the learning journey and show it to you. It is not used to profile the child, to advertise, or to make inferences about the child beyond the lesson they are on.
7. What we do not collect
To be explicit, and because parents ask:
- A child's name, date of birth, gender, photograph, avatar image, address, school, or mother tongue as a stored record
- Any contact details for a child
- Precise or GPS location
- Contacts, photos, files, SMS, or call logs
- Voice or audio recordings — the app does not record your child speaking, and listen-and-repeat exercises involve no capture of any kind
- Biometric data (see Section 4.3)
- Advertising identifiers, and we do not use the Android Advertising ID
- Any data fed to a third-party artificial-intelligence or large-language-model service. We do not use AI features and we do not send your data to any AI provider.
8. Payments
Subscriptions are billed through Razorpay Software Private Limited and/or Google Play Billing, depending on how you subscribe.
We never see or store your card number, CVV, UPI PIN, net-banking credentials, or bank account details. Those go directly to the payment provider, which is PCI-DSS compliant. We receive only the outcome: a transaction identifier, plan, amount, status, and renewal date.
Each provider is an independent controller for the payment data it collects. Razorpay's privacy policy: https://razorpay.com/privacy/. Google's: https://policies.google.com/privacy.
9. Live sessions
Live mentor sessions are delivered over Microsoft Teams.
- Sessions are group sessions and are not recorded by Shlokshaala. We do not record, store, or retain any video or audio.
- Cameras are on. Your child will be visible to the mentor and to the other children and parents in that session. Other participants can see your child's video and any chat messages sent during the session. Please treat this as a considered decision and only join if you are comfortable with it.
- Participants are prohibited from recording, screenshotting, or photographing any session. This is a term of use, and breach can result in removal and account termination. We enforce it where we can, but we cannot technically prevent a determined participant from capturing their own screen, and you should factor that in.
- In-session chat exists for the duration of the session and is not retained by us afterwards.
- Mentors are engaged by us and are verified before they take sessions.
- Sessions are supervised by a mentor throughout. We recommend a parent remains nearby.
About Microsoft. Joining a session means Microsoft processes connection and session data — IP address, device and connection diagnostics, and the live audio and video stream while the session runs — as an independent processor under its own terms. This processing may take place on Microsoft infrastructure outside India, including in the European Union or the United States. See Section 13. Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement.
If you would prefer your child not appear on camera, contact us before the session and we will tell you whether an audio-only or observer arrangement is possible for that class.
10. How we use personal data
We use personal data only to:
- create and secure your account and log you in;
- give your child access to shlokas, stories, audio, and lessons;
- remember where your child got to, and show progress and streaks;
- schedule, deliver, and follow up on live sessions;
- process subscriptions, renewals, refunds, and issue receipts;
- answer your questions and provide support;
- keep the Service working — diagnose crashes, prevent abuse and fraud, and maintain security;
- comply with law, including tax, accounting, and lawful requests from authorities.
We do not use personal data for advertising, for sale to third parties, for training AI models, or for any purpose you have not been told about.
11. Automated decision-making
We do not carry out automated decision-making that produces legal effects or similarly significantly affects any user, and we do not profile users, within the meaning of Article 22 of the GDPR.
12. Who we share data with
We do not sell personal data. We share only with the following, only for the purposes listed, and only under written terms requiring confidentiality and security.
| Recipient | Role | What they receive | Where processed |
|---|---|---|---|
| HOSTINGER | Processor — hosting and database | Account and progress data at rest | India |
| Razorpay Software Pvt. Ltd. | Independent controller — payments | Payment instrument data (direct from you), transaction records | India |
| Google LLC / Google India | Independent controller — Play Store distribution and Play Billing where used | Purchase tokens, subscription status | Global |
| Microsoft Corporation | Processor/controller, live session delivery via Teams | Session connection data, live audio/video during session only | Global, including EU and US |
| [EMAIL / SMS PROVIDER NAME, e.g. AWS SES, MSG91, Twilio] | Processor — OTP and transactional email | Mobile number, email address | [REGION] |
| [ANALYTICS / CRASH PROVIDER, IF ANY] | Processor — diagnostics | Device and crash data | [REGION] |
| Professional advisers, auditors, and authorities | As required | Only what is legally necessary | India |
We may also disclose personal data where required by law, court order, or a lawful request from a government agency, or where necessary to establish, exercise, or defend legal claims, or to protect the safety of a child.
If the business is sold or transferred, personal data may transfer with it. You will be told before that happens and your rights will not be reduced.
13. International transfers
Our servers are located in India, and account, progress, and subscription data is stored in India.
Two flows leave India:
- Live sessions on Microsoft Teams, as described in Section 9.
- [ANY NON-INDIAN ANALYTICS, EMAIL OR CRASH PROVIDER YOU CONFIRM]
Under the DPDP Act, transfer of personal data outside India is permitted except to territories the Central Government restricts by notification. We do not transfer data to any restricted territory.
Under the GDPR, where we transfer personal data outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical and organisational measures. Microsoft's transfers operate under its Data Protection Addendum and the EU-US Data Privacy Framework. You may request a copy of the relevant safeguards from info@shlokshaala.com.
14. How long we keep data
| Data | Retention |
|---|---|
| Account data (mobile number, email) | For as long as the account is active |
| Child profile and learning progress | For as long as the account is active |
| Record of parental consent | For the life of the account, plus 3 years, as evidence of lawful processing |
| Live session attendance record | 12 months |
| Live session video, audio, chat | Not retained. Not recorded. |
| Payment and transaction records | 8 years from the end of the relevant financial year, as required by the Income-tax Act, 1961 and GST law |
| Crash and diagnostic logs | 90 days |
| Support correspondence | 24 months |
On deletion: when you delete your account, we delete your account data, child profile, and learning progress from our live systems within 30 days, and from encrypted backups within a further 90 days, after which backups are overwritten in the ordinary cycle.
We are, however, legally required to retain transaction and tax records for the period above, and to retain the record of your parental consent. Those records are kept in restricted-access storage and are used for no purpose other than legal compliance. We cannot delete them on request and no service will tell you otherwise honestly.
Where an account is inactive for 24 consecutive months, we will notify you and, absent a response, delete it.
15. Your rights
15.1 Under the DPDP Act (India)
- Right to access a summary of the personal data we process about you and your child, and the identities of those we have shared it with.
- Right to correction, completion, updating, and erasure.
- Right to grievance redressal — see Section 18. You must use our grievance process before approaching the Data Protection Board of India.
- Right to nominate another individual to exercise your rights in the event of your death or incapacity.
- Right to withdraw consent at any time, as easily as it was given.
As the parent, you may exercise all of these on behalf of your child, and you may at any time ask to review the data held about your child.
15.2 Under the GDPR (EEA / UK)
In addition to the above: the right of access (Art 15), rectification (16), erasure (17), restriction (18), data portability (20), objection (21), and the right not to be subject to automated decision-making (22). You may withdraw consent at any time under Article 7(3) without affecting the lawfulness of processing before withdrawal.
You have the right to lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office.
[BEFORE EU LAUNCH — you must appoint an EU representative under GDPR Article 27, and a UK representative under UK GDPR Article 27, and their names and addresses must appear here.]
15.3 How to exercise your rights
Email info@shlokshaala.com from the email address on the account, or write to our Grievance Officer at Section 18. We will respond within 30 days (and within one month for GDPR requests, extendable by two months for complex requests, with notice).
We may need to verify that you are the account holder before acting, usually by OTP to the registered number. We will not ask you for identity documents unless we genuinely cannot verify you otherwise.
There is no charge. If a request is manifestly unfounded or excessive we may charge a reasonable fee or decline, and we will explain why.
15.4 Deleting your account
You can delete your account inside the app, at Settings → Account → Delete Account.
You can also request deletion without installing the app, at https://shlokshaala.com/delete-account [CREATE THIS PAGE — Google Play requires a web-accessible deletion route], or by emailing info@shlokshaala.com.
16. Security
We apply reasonable security safeguards as required by Section 8(5) of the DPDP Act and Article 32 of the GDPR, including:
- encryption of data in transit (TLS) and at rest;
- access to personal data restricted to personnel who need it, on a least-privilege basis;
- OTP-based authentication with no passwords stored by us;
- no storage of payment credentials of any kind;
- logging and monitoring of administrative access;
- periodic review of security practices and of our processors.
No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected user in the manner and within the timelines prescribed under the DPDP Rules, and — where the GDPR applies — the relevant supervisory authority within 72 hours, and affected individuals without undue delay where the risk to them is high.
17. Cookies and our website
The app does not use cookies.
Our website uses only strictly necessary cookies required to serve the site. We do not run advertising, marketing, or cross-site tracking cookies, and we do not use Google Analytics or any similar visitor-tracking product.
[CONFIRM — if you add any analytics or embedded video to the website, this section must change and, for EEA/UK visitors, you will need a consent banner that blocks non-essential cookies until consent is given.]
18. Grievance Officer and contact
In accordance with Section 13 of the DPDP Act and Rule 4 of the Consumer Protection (E-Commerce) Rules, 2020:
Sonali Balodhi
Shlokshaala
Response: acknowledgement within 48 hours; resolution within 30 days
If you are not satisfied with our response, you may complain to the Data Protection Board of India, or, if you are in the EEA or UK, to your supervisory authority.
19. Changes to this policy
We will post any change here with a new “Last updated” date. If a change materially affects how we handle your or your child's personal data, we will notify you in the app and by email before it takes effect, and — where the change requires it — ask for fresh consent. Continuing to use the Service after a material change, without objecting, does not by itself constitute consent to new processing that requires consent.
20. Consent notice — summary
The DPDP Rules require a consent notice in clear and plain language, presented separately from other terms. This is the text shown on our consent screen.
Shlokshaala asks your permission to process: your mobile number and email address, to run your account and contact you; your child's age at live-session booking, to place them in the right group; and your child's learning progress, to continue their journey.
We use this only to run Shlokshaala. We do not advertise to your child, track them, profile them, record them, or sell anyone's data.
You are confirming you are 18 or over and are the parent or guardian of the child who will use this app.
You can withdraw this permission at any time in Settings, or by emailing info@shlokshaala.com. Withdrawing means we stop processing and delete the data, except records we must keep by law.
Read the full Privacy Policy: https://shlokshaala.com/privacy. Raise a grievance: info@shlokshaala.com. You may complain to the Data Protection Board of India.