Privacy Policy

1. Introduction

This Privacy Policy describes how GPU Tech Private Limited ("Company", "we", "us", or "our"), the developer of BluePen AI, collects, uses, stores, shares, and protects your personal data when you use our mobile application, Bluetooth-enabled pen device, associated hardware, website (bluepenai.in), and any related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you are a parent or legal guardian registering a child under 18 years of age, you consent to the collection and processing of your child's data as described herein.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, device identifiers, and voice data.
• "Child" or "Student User" means any user under the age of 18 years.
• "Parent Account" means the account registered by a parent or legal guardian on behalf of a Student User.
• "Session Data" means data generated during an AI tutoring session, including voice queries, topics accessed, session duration, and AI-generated responses.
• "Device Data" means information collected from the BluePen AI pen, neckband, or the mobile device running the app, including Bluetooth identifiers, device model, operating system version, and connectivity status.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.

3. Data We Collect

3.1 Information You Provide Directly

• Account Registration Data: Full name of parent/guardian, email address, phone number, city, and password.
• Student Profile Data: Student's first name (or pseudonym), class/grade, education board, preferred language, and selected AI teacher persona.
• Payment Data: Subscription plan selection, payment method, and transaction ID. We do not store full credit/debit card numbers. Payments are processed by third-party payment gateways (such as Razorpay and Stripe) under their own privacy policies.
• Support and Communication Data: Messages, emails, or feedback you send to us via in-app support, email (gputech@trybluepen.com), or other channels.

3.2 Information Collected Automatically

• Voice Query Data: Audio recordings of questions spoken by the student via the BluePen AI pen. These are transmitted to the AI for processing and are not permanently stored on our servers after the session ends (see Section 5).
• Session and Usage Data: Topics accessed, chapters studied, session start/end times, session duration, AI teacher persona selected, number of questions asked, and learning engagement metrics.
• Device and Technical Data: Bluetooth connection status, device model, operating system version, app version, IP address (anonymised), crash logs, and diagnostic data.
• Parent Notification Data: Session completion status sent to the parent's phone number via WhatsApp (Twilio) or SMS.

3.3 Information from Third Parties

We may receive limited data from third-party services integrated with BluePen AI, including AI session processing metadata, Twilio (message delivery status), and analytics services. We do not purchase or otherwise acquire Personal Data from data brokers.

4. How We Use Your Data

We process your Personal Data for the following purposes:

• Service Delivery: To provide AI-powered tutoring sessions, personalise the learning experience based on class, board, and language preferences, and deliver curriculum-aligned content.
• Parent Reporting: To generate session summaries and weekly progress reports for parents/guardians via WhatsApp, SMS, or in-app dashboards.
• Account Management: To create and manage your account, authenticate users, and process subscription payments.
• Product Improvement: To analyse aggregated, anonymised usage patterns to improve AI accuracy, content quality, and app performance. Individual voice recordings are not used for model training.
• Safety and Security: To detect fraud, prevent misuse, and ensure the security of our Services.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Communication: To send service-related notifications, respond to support requests, and (with your consent) send promotional updates. You may opt out of promotional communications at any time.

5. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy:

• Account Data: Retained for the duration of your active account plus 90 days after a deletion request, to allow for account recovery.
• Session Data (metadata): Retained for 24 months for progress tracking and reporting. Older data is anonymised and aggregated.
• Voice Query Audio: Transmitted to the AI for real-time processing. Audio is not stored on our servers after the AI response is generated.
• Payment Data: Transaction records retained for 7 years as required by Indian tax and accounting regulations.
• Anonymised/Aggregated Data: May be retained indefinitely for research, analytics, and product improvement. This data cannot be used to identify any individual.

6. Children's Privacy and Student Data Protection

BluePen AI is designed for students aged 6 to 18 years. We are committed to protecting children's privacy and comply with the following principles:

• Parental Consent: A parent or legal guardian must create the account and provide verifiable consent before a child can use the Services. Children cannot create accounts independently.
• Minimal Data Collection: We collect only the minimum data necessary to provide the tutoring service.
• No Behavioural Advertising: We do not serve advertisements to children. We do not use children's data for targeted advertising or marketing profiling.
• No Social Features: The app does not include chat rooms, forums, social networking features, or any functionality that allows children to communicate with strangers.
• Parental Access and Control: Parents/guardians have full access to their child's usage data, session history, and progress reports. Parents may request correction or deletion of their child's data at any time.
• Voice Data Handling: Voice queries from children are processed in real-time by the AI and are not permanently stored. We do not create voice profiles or biometric identifiers from children's voice data.

7. Data Sharing and Third-Party Services

We do not sell, rent, or trade your Personal Data. We may share data with the following categories of third parties, solely to provide and improve the Services:

• AI API: Voice queries and session content are processed by the AI to generate tutoring responses. Data is processed under its Cloud Data Processing Addendum.
• Twilio: Parent phone numbers and session completion status are shared with Twilio to deliver WhatsApp/SMS notifications.
• Payment Processors: Razorpay, Stripe, or equivalent payment gateways process subscription payments. We share only the data necessary to complete the transaction.
• Analytics Providers: We use anonymised and aggregated data with analytics tools to understand usage patterns. No personally identifiable information is shared.
• Legal and Regulatory: We may disclose data if required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of GPU Tech Private Limited, our users, or the public.

We require all third-party service providers to maintain appropriate security measures and to process data only in accordance with our instructions and this Privacy Policy.

8. Data Security

We implement industry-standard technical and organisational measures to protect your Personal Data:

• Encryption: All data is encrypted in transit using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted to authorised personnel on a need-to-know basis, protected by multi-factor authentication.
• Bluetooth Security: Communication between the BluePen AI pen and the companion app uses standard Bluetooth Low Energy (BLE) pairing protocols with encryption.
• Incident Response: We maintain an incident response plan. In the event of a data breach affecting your Personal Data, we will notify affected users and relevant authorities within 72 hours as required by applicable law.

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

BluePen AI operates in India and Germany. Your data may be transferred to and processed in countries other than your country of residence, including:

• India: Where GPU Tech Private Limited is headquartered.
• United States: Where Twilio servers may process data.

For transfers from the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms under the GDPR. For transfers involving Indian residents, we comply with the DPDPA 2023 provisions on cross-border data transfers.

10. Your Rights

10.1 For All Users

• Right to Access: Request a copy of the Personal Data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your account and associated data (subject to legal retention requirements).
• Right to Withdraw Consent: Withdraw consent for processing at any time.
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable format.

10.2 Additional Rights for EU/EEA Residents (under GDPR)

• Right to Restriction: Request restriction of processing in certain circumstances.
• Right to Object: Object to processing based on legitimate interests.
• Right to Lodge a Complaint: File a complaint with your local data protection authority.

10.3 Additional Rights for Indian Residents (under DPDPA 2023)

• Right of Grievance Redressal: Contact our Grievance Officer (details below) for any complaints regarding data processing.
• Right to Nominate: Nominate a person to exercise your rights in case of death or incapacity.

To exercise any of these rights, contact us at gputech@trybluepen.com. We will respond within 30 days (or sooner if required by applicable law).

11. Cookies and Similar Technologies

Our website (bluepenai.in) may use essential cookies to maintain session state and preferences. We do not use tracking cookies, advertising cookies, or cross-site tracking technologies. The BluePen AI mobile app does not use cookies.

12. Legal Basis for Processing (GDPR)

For users in the EU/EEA, we process Personal Data on the following legal bases:

• Consent: For account creation, processing children's data (parental consent), and promotional communications.
• Contractual Necessity: To provide the Services you have subscribed to.
• Legitimate Interests: For product improvement (using anonymised data), fraud prevention, and security.
• Legal Obligation: For tax records, regulatory compliance, and responding to legal requests.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by posting the updated Policy in the app and on our website, and by sending a notification to the email address associated with your account. The "Last Updated" date at the top indicates the most recent revision. Continued use of the Services after notification constitutes acceptance of the updated Policy.

14. Grievance Officer and Contact Information

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the details of the Grievance Officer are:

The Grievance Officer shall acknowledge your complaint within 48 hours and resolve it within 30 days of receipt.

© 2026 GPU Tech Private Limited. All rights reserved.