TaraAll policies

Policy

Privacy Policy

Last updated 31 July 2026

In short

A parent creates the account. A child never signs up on their own and never gives us an email address, a phone number or a password.

We do not show advertising, we do not build advertising profiles, and we do not sell or share personal data. There are no third-party trackers in Tara.

Homework photos and tutor conversations belong to your family. You can read them, export them, or delete them at any time.

Who we are

Tara is a homework companion for children in Grades 1 to 8, operated by AK Infra and Realty Developers(“we”, “us”), whose registered office is at C2 Sana Palace, Hazratganj, Lucknow, Uttar Pradesh, India. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for the personal data described here.

How we treat children’s data

Every user of the child experience is a minor. Under the DPDP Act that means we must obtain verifiable consent from a parent or lawful guardian before processing any of their data, and we must not track them or target advertising at them. We have built the product around those rules rather than bolting them on:

  • Children cannot create accounts. A parent registers, verifies themselves, and then adds a child profile.
  • Children sign in with an avatar and a 4-digit PIN. We never ask a child for an email address, phone number, school name, home address or photograph of themselves.
  • No behavioural advertising or profiling. We do not run ads, and we do not build interest profiles.
  • No third-party analytics or advertising SDKs are loaded in the child experience.

What we collect

From the parent

  • Name, email address and mobile number
  • Record of consent: what was agreed, and when
  • Billing details, if you are on a paid plan
  • Notification preferences and quiet hours

From the child profile

  • A first name or nickname chosen by the parent
  • Grade, board and preferred language
  • Chosen buddy avatar and a PIN, stored only as a secure hash
  • Photographs of homework pages, and the text extracted from them
  • Tutor conversation transcripts
  • Progress records: items completed, stars earned, time spent

Collected automatically

Server logs containing IP address, device type and timestamps, kept for security and abuse investigation. These are not linked to an advertising identifier and are not used to profile a child.

Why we process it

  1. To run the service the parent asked us to provide
  2. To let the AI tutor understand the homework in front of the child
  3. To show the parent what their child worked on
  4. To send the reminders the parent has enabled
  5. To keep the service safe, and to investigate misuse
  6. To meet legal and accounting obligations

Our lawful basis for all child-related processing is the verifiable consent of the parent or guardian.

How the AI works, and what it does not do

Homework text and conversation turns are sent to Amazon Bedrock, running in Amazon Web Services’ Mumbai (ap-south-1) region, to generate the tutor’s replies. Under the AWS service terms, content sent to Bedrock is not used to train the underlying models and is not shared with the model provider.

We do not send the child’s name, PIN, or your contact details to the model. See our Child Safety & AI Policy for the limits placed on what the tutor is allowed to say.

Who we share data with

We do not sell personal data, and we do not share it for anyone else’s marketing. We use a small number of processors, each bound by contract to act only on our instructions:

  • Amazon Web Services — hosting, storage and AI inference (Mumbai)
  • Our email and messaging provider — parent notifications only
  • Our payment processor — billing on paid plans only

We may disclose data where required by law, or to protect the safety of a child.

Where data is stored

Primary storage and AI processing are in India (AWS Mumbai). Where a processor operates outside India, we rely on contractual safeguards and only transfer to jurisdictions permitted under the DPDP Act.

How long we keep it

  • Homework scans: 12 months, or until you delete them
  • Tutor transcripts: 12 months, so parents can review them
  • Progress records: for the life of the account
  • Server logs: 90 days
  • Billing records: as required by Indian tax law

When a parent closes an account we delete personal data within 30 days, except where we are legally required to retain it.

How we protect it

  • Encryption in transit (TLS 1.2+) and at rest
  • PINs stored only as salted hashes, never in plain text
  • Access to production data limited to named staff and logged
  • Homework images stored in private buckets, served via short-lived signed links

Your rights

As the parent, you may exercise these rights on behalf of your child at any time. See Parental Consent & Your Rights for how, and Grievance Redressal if you are not satisfied with our response.

Changes to this policy

If we make a material change affecting children’s data, we will notify the parent by email and ask for fresh consent before the change takes effect.