1. Introduction, scope and contact
This Privacy Policy explains how ChitraYantra Technologies Private Limited ("ChitraYantra", "we", "us" or "our") handles personal data through this website and while providing EdTech and HealthTech software, reporting and support services. It applies to visitors, enquiry contacts, and representatives of institutions, employers, health programmes, law firms, and other organisations and data processed for an Institute engagement. Individual product accounts may have a separate product-specific privacy notice covering registration, uploads, recordings, or other account data. Review that notice before using the product. This website policy does not replace a signed MOU, Work Order or data-processing schedule; where one applies, that document governs the particular engagement.
Our registered office is Basunagar, Madhyamgram, Kolkata - 700129, West Bengal, India. Our Privacy Contact and Grievance Officer may be contacted at info@chitrayantra.com.
2. India’s DPDP framework
We seek to handle personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and rules made under it, and India’s Digital Personal Data Protection (DPDP) Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent their provisions have commenced and apply to our processing. This Policy is not a waiver of any right or obligation under applicable law.
3. Institute data and our role
For Institute services, the Institute determines the purpose and lawful basis for its student, participant, faculty, staff or other institutional data. ChitraYantra does not independently collect, own, sell or use that data. We may access or process it only as necessary to perform a signed MOU, Work Order, purchase order or other written Institute engagement and documented instructions from an authorised Institute representative.
The Institute is responsible for having the necessary authority, notices and, where applicable, valid consent or other legal basis to provide the data to us. ChitraYantra remains responsible for its own legal and contractual obligations for data in its possession or control. Any data-processing schedule in the MOU or Work Order should identify the permitted purpose, data categories, security arrangements, authorised access, deletion or return, incident cooperation and any approved subcontractor.
4. Categories, purposes and limits of Institute processing
Depending on the engagement, Institute data may include identifiers, academic or participation records, candidate sources, health-screening records, matter documents, submitted responses, performance inputs and data needed to produce the agreed output. We process only the minimum data needed to deploy or support the software, produce the agreed report, respond to Institute requests, maintain security, or comply with law.
We do not use student or participant data for advertising, independent profiling, sale, rental, training unrelated products or any separate commercial purpose. We do not make final academic, sporting, administrative, disciplinary or other decisions about an individual.
5. Deployment, access and retention
Deployment is product-specific and may use a hosted service, an organisation-controlled environment, or an agreed mobile workflow. The applicable engagement defines hosting, access, source-data responsibilities, and permitted support processing. If temporary access, transfer or support processing is needed, it is limited to the agreed scope. After report delivery or hand-over, we delete or return temporary copies and credentials under our control unless the MOU, Work Order, other written engagement or law requires otherwise.
Deletion does not require removal from backups before their ordinary rotation. We may retain the minimum business, security, audit, financial or legal records needed for the stated purpose, legal compliance or dispute resolution. Data remaining solely on Institute-controlled systems remains under the Institute's control.
6. Website enquiries, analytics and security
When you contact us or request a demo, we process the information you submit, such as name, work email, message and preferred demo time. We use it to respond, arrange a demonstration, maintain an enquiry record and protect our services. Enquiry messages are delivered through Resend. We process IP address and technical request information briefly to rate-limit and prevent abuse of forms.
7. Sharing, transfers and disclosures
We do not sell or rent Institute data. We disclose it only to authorised personnel or service providers strictly necessary to perform the written engagement, on the Institute's written instruction, or where required by applicable law or a lawful request of a competent authority. Website enquiry data is disclosed to Resend for email delivery and to Google when optional analytics is accepted, and Cloudflare for website hosting and technical request handling.
Google, Cloudflare and Resend may process limited website information outside India. We use them subject to applicable law and appropriate contractual or technical safeguards. We do not disclose data merely on an informal request; we evaluate requests and disclose only where legally required or authorised.
8. Payments
Where an approved gateway is used, Razorpay, PayU or PayPal processes payment information under its own privacy policy and terms. We do not store full card or gateway payment credentials. For bank transfers and cheques, we process the limited payer and transaction information needed to reconcile payment, maintain financial records and meet legal obligations. We do not accept cash payments.
9. External links
Our website may link to third-party websites or services, including social networks and payment providers. Their privacy practices, content and security are governed by their own policies. We are not responsible for those third-party practices, and you should review their policies before providing information to them.
10. Security and incident handling
We use reasonable technical, organisational and access-control measures designed to protect information under our control. Measures are selected according to the engagement, deployment and risk. No transmission, system or storage environment can be guaranteed completely secure. We will investigate suspected incidents affecting data under our control and cooperate with the Institute as required by the applicable written engagement and law.
11. Your rights, choices and grievances
For website information, you may contact us to request access, correction, deletion, withdrawal of consent for optional analytics, or to raise a grievance, subject to applicable law. You can reject optional analytics or withdraw your previous acceptance through Cookie settings in the footer; this does not affect necessary security or service operations. For student or participant data held by an Institute, contact the Institute first because it controls the data and deployment. We will assist the Institute where required by the MOU, Work Order or applicable law.
Write to our Privacy Contact and Grievance Officer at info@chitrayantra.com, including enough information to identify the request. We may need to verify identity and authority before acting.
12. Children's data and safety
We do not seek to collect children's personal data directly through this website and do not ask children to submit personal data through public forms. If an Institute provides data relating to a child as part of an authorised engagement, the Institute is responsible for the permissions, notices and supervision required by applicable law and the written engagement.
We do not use children's Institute data for advertising, behavioural marketing or unrelated profiling. A child, parent, guardian, teacher or Institute representative who believes data has been submitted to us through the public website in error may contact our Grievance Officer so that we can review and take appropriate action.
13. Updates to this Policy
We may update this Policy when our services, technology or legal obligations change. The current version and its last-updated date will be published on this page. Material changes to an active Institute engagement will be addressed through the applicable MOU or Work Order where required.