Your privacy at Chitty Hub

Chitty Hub is a product of PupilTree — Fika Applied AI Research Labs Pvt. Ltd. We are the Data Fiduciary responsible for your information under India's Digital Personal Data Protection Act, 2023 ("DPDP").

Our users are individual teachers. Parents and children do not have accounts: children are the subjects of the notes a teacher sends, never users of the app.

We only hold what is needed to run the service:

• Your teacher account Your name, the role label you display (e.g. "Class teacher"), and your email address, used to sign you in.
• Your class roster For each child: their first name only. For each family: the guardian's name, WhatsApp number, preferred language, and consent status. No surnames, dates of birth, addresses, photos, or grades.
• The notes you send The positive messages, cards and announcements you review and send, plus private "Quiet Notes" that stay with you and are never sent to a parent.
• WhatsApp delivery data (only if you link your WhatsApp) If you choose to connect your own WhatsApp number to Chitty Hub (see section 3): the encrypted session credentials that keep that link alive, the delivery status of each note (sent, delivered, read), and the replies families send back — text, pictures and voice notes, in your 1-to-1 chats with consented guardians and in the class groups you choose.

We do not collect location, your phone's contacts, photos or videos of children, biometrics, health or financial data, and we do not use advertising identifiers.

Depending on your setup, notes travel one of two ways — in both, you approve every note before it goes anywhere, and nothing is ever sent automatically:

• Share mode Chitty Hub opens WhatsApp on your phone with the approved note ready. You press send yourself, from your own WhatsApp.
• Linked mode You can link your own WhatsApp number to Chitty Hub by scanning a QR code. After that, when you approve a note, Chitty Hub sends it for you — as your number — to the guardian, or to a class group you are a member of and have chosen. Sending is done by a WhatsApp delivery service provider that acts only on our instructions (see section 8). Sends are deliberately paced and rate-limited to protect your number, and you can unlink your WhatsApp at any time.

In both modes the message itself travels over WhatsApp, which is operated by Meta. Your use of WhatsApp is governed by WhatsApp's own terms and privacy policy.

If you use linked mode, replies that arrive on your linked number — from consented guardians in 1-to-1 chats, and messages in the class groups you chose — are shown to you inside Chitty Hub, so you can see a family's response next to the note it answers.

• Messages from numbers that are not consented guardians in your roster are dropped, not stored.
• Your personal WhatsApp chats are never read, stored, or shown in Chitty Hub.
• A reply appearing in Chitty Hub does not mark it as read on WhatsApp — the sender never sees blue ticks because of us.
• We never reply, react, or send anything from your number on our own.

We use this information solely to provide Chitty Hub: to let you sign in, build your class, draft notes in each family's language, deliver them over WhatsApp, show you replies, and show you a weekly view of which families you have reached. We do not use it for advertising, profiling, or any purpose you would not expect from a teacher's communication tool.

When a teacher adds a family, they confirm that the guardian has agreed to receive school messages on WhatsApp. That consent is recorded, and sends are blocked for any family marked as opted out. Guardians can withdraw consent at any time by telling the teacher or writing to us.

We practise data minimisation for children: a first name and class are enough to send a warm note, so that is all we keep. There is no tracking, profiling, or advertising involving any child.

Your data is stored on infrastructure located in India — Google Cloud (asia-south1, Mumbai) and MongoDB Atlas (Mumbai). WhatsApp session credentials and in-transit message content handled by our delivery service provider are also hosted in India, stored encrypted, and isolated per teacher — one teacher's link can never see another's.

Everything is encrypted in transit using TLS, and access is protected by authenticated, token-based sign-in. Passwords are stored only as salted hashes, never in plain text.

We do not sell your data and we do not share it with third parties for their own purposes. Three things are worth naming clearly:

• WhatsApp (Meta). Your notes and families' replies travel over WhatsApp itself. WhatsApp's own terms and privacy policy govern that transport.
• Our WhatsApp delivery service provider. In linked mode, a delivery provider operates the link to your WhatsApp number on our behalf — a processor under contract. It delivers the notes you approved, reports delivery status, and forwards replies to us. It is India-hosted, does not use your data for anything of its own, adds no content of its own, and does not keep message content beyond what delivery requires.
• Infrastructure providers. Cloud hosting and database providers process data on our behalf, under contract, only to run the service — not for their own use.

To help you write, Chitty Hub drafts notes using Google's Gemini AI service, which processes the request on Google's cloud as our service provider. Only the details you provide — the reason you tapped and the family's language — are sent to produce a draft you then review and edit. Nothing is sent automatically; you always approve. Drafts are grounded only in what you chose, so the app does not invent facts about a real child, and we do not permit this content to be used for advertising or to train unrelated models.

We keep your account and class data for as long as you use Chitty Hub, so your history and rosters are there when you return. Replies and their attachments are kept only as long as needed to show them to you. If you unlink your WhatsApp, the session credentials are deleted.

You can delete your account and everything in it yourself, at any time, from the app: Profile → Delete account (see how deletion works). You can also ask us to delete or export your data by emailing founders@powersmy.biz.

As a Data Principal under the DPDP Act, you can:

• Access the personal data we hold about you.
• Ask us to correct or update inaccurate data.
• Ask us to erase your data when it is no longer needed.
• Withdraw consent you previously gave.
• Raise a grievance and have it addressed.

To exercise any of these, write to us at the address below and we will respond within the timelines the law requires.

If we change this policy, we will update the date at the top and, for significant changes, let you know in the app. For any question, request, or grievance about your data, contact our grievance point: