Privacy notice
This notice explains what personal data Mridanga Seva keeps about students, parents, guardians and volunteers, why, who else handles it, and what you can ask of us.
Version 0.3-draft, dated . It covers this website and the Mridanga Seva app. To confirm: legal review before the class opens
In short
- This website sets no cookies, has no analytics and no trackers, and has no forms.
- The app keeps only what the class needs to teach you and keep children safe. We never sell data and never show ads.
- For a student under 18, a parent or guardian gives consent: in writing at the class desk, or by email with a code (an ID is then checked at the first class).
- You can see and download your data in the app (My profile → My data and rights) and ask there to correct or delete it, withdraw your consent or complain; or write to privacy@mridangaseva.com.
- Parents get an email when their child is checked out at the class, if the class has switched these emails on, and a weekly summary only if they asked for it. Either can be stopped at any time.
Who is responsible
The data fiduciary (under the GDPR, the “controller”) is Mridanga Seva, a volunteer team in Hyderabad, India, headed by Regula Sarvesh Chandra. Postal address: Hanuman Tekdi, Abids, Hyderabad 500001, Telangana, India.
Privacy contact and grievance officer: Regula Sarvesh Chandra, head of Mridanga Seva, privacy@mridangaseva.com, phone +91 99893 36301.
This website
This website only shows information. It sets no cookies, uses no analytics or advertising tools, loads nothing from other websites, and has no forms. That is why it shows no cookie banner.
The website is hosted by Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes your IP address and browser details for a short time, under its own privacy policy. We do not receive or keep these logs.
If you write to us by email, we keep your message and address to answer you (see How long we keep data).
What the app keeps
| About | What |
|---|---|
| Students | Name, date of birth, roll number, phone or email, area or PIN code (not the full address), level, a photo only if consent was given, the app language. |
| Joining and About you | Given at sign-up: gender, mobile number, class centre and the instruments you want to learn; your Dīkṣā (initiated) name if you give it. Optional, if you give them: an emergency contact such as a parent or spouse (relation, name, phone), how you heard about the class (a source, or the coordinator whose referral code you typed), education or occupation, and the service areas you are interested in. |
| Parents and guardians of students under 18 | Name, relation to the student, phone number, email address, and the consent record: date, how it was given (a signed form at the desk, or the code emailed to the parent), who checked it, and which kind of ID document was looked at. The ID number itself is never stored. If the parent asked for the weekly email: that yes, as a separate consent record. A record of each email sent to a parent: when, which kind, and whether it went out, never its text. While a child's sign-up waits for the parent: the parent's name, relation, email address and mobile number as the child gave them. |
| Learning | Visits (check-in and check-out times), syllabus items learnt, assessments and answers you send, level changes, practice minutes, and how a practice session went (hard / okay / good) and what was practised, if the student chooses to say it. |
| Follow-up | When a student stops coming, a coordinator may call; the date, the reason given and a short note are kept. |
| Messages | Announcements you have read, your replies, and the notification token of your phone so it can receive notices. |
| Volunteers | Name, email, role, duty hours, and a log of the changes they make to student records. |
| Your requests | What you ask in My data and rights or by email (to see, correct or erase your data, withdraw a consent, name someone to act for you, or complain): the kind of request, its dates, your words and our answer. |
Location: when a coordinator checks a student in, the app checks once whether the coordinator's phone is at the class. Only the result (at the class, away, or not known) and the distance are kept, never the position itself, and nothing is tracked in the background.
While you wait for the desk: after signing up, and before a coordinator registers you, you may already use the practice tools, the mantra and the Beginner lessons in the app: an adult by the date of birth given at sign-up, a child only after the parent's consent. Using them records nothing about you.
Why we use it, and on what basis
- Running the class: registering students, recording visits, progress and practice, assessments, follow-up calls and announcements. Basis: your consent, or for a child the consent of a parent or guardian (DPDP Act section 6; GDPR Article 6(1)(a)).
- Keeping children safe: knowing who is responsible for a child and how to reach them. Basis: the parent's or guardian's consent.
- Telling parents about their child: the email when the child is checked out at the class (only once the class switches these emails on; part of the parent's consent for the class, and it can be stopped at any time), and the weekly email (only if the parent asked for it in writing). Basis: the parent's consent; for the weekly email a separate consent of its own (see What parents receive).
- Matching and emergencies: your gender and centre decide which coordinator looks after you (one of the same gender); an emergency contact is called only if something happens to you at the class. Basis: your consent.
- Planning outreach and service: how people heard about the class, occupations and service interests, used only as totals to plan outreach, class times and service. Optional. Basis: your consent.
- Security and accountability: logs of who changed what, so that misuse can be found and fixed. Basis: our legal duties to protect personal data (DPDP Act section 8; GDPR Article 6(1)(c) and our legitimate interest under Article 6(1)(f)).
We do not use personal data for advertising, profiling or selling, and we do not make decisions about people by automated means.
Children
Under Indian law a child is anyone under 18. A child is registered only with the verifiable consent of a parent or lawful guardian, in one of two ways:
- At the class desk: the parent or guardian fills in and signs a written consent form, and a coordinator checks an ID document.
- At home, by email: the child signs up in the app and gives the name, relation (mother, father or guardian), email address and mobile number of a parent or guardian. Once the child has confirmed their own email address, we send the parent one email with a 6-digit code. On the consent page the parent types the code, declares that they are the child's parent or legal guardian and 18 or over, and gives consent. At the child's first class a coordinator checks the parent's ID document (the child brings it, or the parent comes): the parent's name, and that the parent is 18 or over. Only then is the child registered; only the kind of ID is noted, never its number.
Until the parent consents, the sign-up is used only to ask for that consent: the child cannot fill in "About you", is not registered, and coordinators do not see the sign-up. If the parent does not consent within 30 days, the child's sign-up and the parent's details are erased; the child can sign up again or come to the desk with a parent. A photo of a child is kept only if the parent agreed to it separately; that box is never ticked for them.
We do not track or monitor the behaviour of children and never direct advertising at them.
For a student under 18 the parent or guardian makes the requests listed under Your rights: at the class desk, where we see their ID first, or by email from the address the class has for them. The child can read their own data in the app.
At 18, a student is asked to give their own consent. To confirm: confirm
Who can see it
- A student sees their own record, progress and visits.
- Coordinators see the students' details they need to teach and follow up. To confirm: decision D4-09, whether all coordinators or only a student's mentor and the facilitator see parents' phone numbers and consent records
- The facilitator sees everything in the class and the log of changes.
- Data requests are read only by the facilitator (Guru); reading your own summary is logged.
What parents receive
A parent or guardian of a student under 18 may get three kinds of email from the class. Each is about one child, and none ever contains the child's location or photo, or anything about another child.
- The consent email: once, only when a child signs up at home and gives the parent's address: a 6-digit code and the address of the consent page. Nothing more is sent unless the child asks again.
- The check-out email, once the class switches these emails on: when the child is checked out at the class, the child's name, the centre and the time. You can stop it at any time with the Unsubscribe link in the email or by telling the class desk.
- The weekly email, only if you asked for it on the consent form: once a week, a short summary of your child's week at the class: the days and times they came, their practice at home against the goal, what they newly learnt, a level change, and the next class event. You can stop it at any time with the Unsubscribe link in the email or by telling the class desk.
Services that handle data for us
We use these services to run the app and the website. Each handles data only on our instructions and under its own data protection terms.
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, logins and stored files of the app | Sydney, Australia |
| Expo (650 Industries) | App updates; passes notifications to phones | USA |
| Google Firebase Cloud Messaging | Delivers notifications to Android phones | Worldwide |
| Brevo | Sends sign-up and password-reset emails, and the emails to parents: the consent email with a code, the check-out email and the weekly email | European Union |
| Cloudflare | Hosts this website and the web version of the app | Worldwide network |
| Zoho Mail | The team's email, including info@mridangaseva.com and privacy@mridangaseva.com | To confirm: confirm the Zoho data centre |
| YouTube (Google) | Plays lesson videos inside the app; YouTube may set its own cookies when a video plays | Worldwide |
The app's database is in Australia, and some of the other services may handle data outside India too. Indian law allows this except to countries the Government of India restricts; for people in the European Union or the United Kingdom, such transfers rely on the services' standard contractual clauses or an adequacy decision. To confirm: decision D4-12, the final list of services and transfers
How long we keep data
To confirm: decision D4-07; the periods below are a proposal, not yet agreed
- Students who have left: erased two years after leaving; only the roll number and the dates are kept so that numbers are never reused.
- App logins that were never linked to a student: deleted after 30 days.
- A child's sign-up whose parent did not consent: erased, with the parent's details, after 30 days.
- Logs of changes and of access to sensitive data: at least one year, as the DPDP Rules require, at most two years.
- Notification tokens of phones no longer used: deleted after 90 days.
- Records of emails to parents (no text): 30 days.
- Data requests: the text one year after we answered, the request itself (type and dates) two years; after an erasure only its type, dates and reference.
- Emails to the team: To confirm: how long.
When you withdraw consent or ask for erasure, we stop using your data and erase it, keeping only what the law requires us to keep.
How we protect it
Data travels encrypted (HTTPS). Database rules decide, row by row, who may read or change what. Changes to student records are logged. Backups are encrypted. If a breach happens, we tell the people affected and the Data Protection Board of India without delay, as the law requires.
Your rights
You, or a parent or guardian for a child, can ask us to:
- tell you what data we keep about you, and with whom it was shared;
- correct, complete or update it;
- erase it;
- withdraw your consent, as easily as you gave it (what was done before stays lawful);
- name another person to act for you if you die or cannot act yourself (DPDP Act section 14).
If the GDPR applies to you, you also have the rights to restrict or object to processing and to receive your data in a portable format.
In the app: My profile → My data and rights shows what we keep about you and lets you download it; there you can also ask for a correction or an erasure, withdraw a consent, name someone to act for you, or make a complaint, and see our answer.
Or write to privacy@mridangaseva.com, or speak to a coordinator at the desk. We may ask you to confirm who you are. We answer every request, complaints included, within 30 days.
Withdrawing your consent freezes your record and switches your sign-in off; withdrawing the photo consent only stops photos.
Complaints
Use My data and rights → Make a complaint, or write to the privacy contact. Please come to us first, so we can put things right. If you are not satisfied with our answer, you can complain to the Data Protection Board of India. If you live in the European Union or the United Kingdom, you can also complain to your local data protection authority.
Changes to this notice
When this notice changes in a way that matters, we change its version and date above and tell app users in an announcement. Translations are provided for convenience; To confirm: whether the English text prevails if a translation differs