Privacy Policy
This policy explains what data NetCyberAI collects today (almost nothing — this Phase 0 site has no login and sets no third-party tracking cookies), what a future live school deployment will process, and a parent’s rights over their child’s data under India’s DPDP Act.
Last updated 16 September 2026.
Draft — pending legal review
This is a structurally complete draft, written to align with the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules. It is not a substitute for review by a qualified lawyer before this site or any school deployment goes live, and it will be updated as that review happens.
1. Who we are
NetCyberAI (Gurugram / Palwal, Haryana, India) operates this website and, for schools that engage us, the NetCyberAI school platform. For queries about this policy, contact admin@netcyberai.com.
2. What this website collects today
As of this policy’s last update, this public website is a static marketing site. It does not use third-party analytics or advertising cookies, does not require an account, and does not collect personal data through the pages themselves. If you message us on WhatsApp using a link on this site, WhatsApp processes that conversation under its own privacy terms, and we receive and respond to what you send us.
3. What a school deployment will process (once live)
For a school that engages NetCyberAI for the platform itself, the categories of personal data involved are expected to include: student name, class, roll number, date of birth, attendance, academic marks, and fee records; parent/guardian name, phone number, and relationship to the student; and staff name, role, and class assignments. No such processing exists today — this section describes what will apply once a school is actually onboarded, and this policy will be versioned when that happens.
4. Children’s personal data
Most data processed by the school platform concerns children. In line with the DPDP Act’s specific obligations for children’s data, no student record becomes active without a verifiable consent record tied to a parent or lawful guardian, and a bulk import of student records does not itself constitute consent — it places records in a pending state until consent is separately obtained. We do not carry out behavioural monitoring or tracking of a child beyond what is strictly necessary for the school’s own legitimate educational purpose, and any feature that could constitute such monitoring is scoped to school staff only until a specific legal basis for extending it further is confirmed.
5. Purpose limitation and consent
Each category of communication — daily updates, weekly summaries, recognition messages, fee reminders — is treated as a separately consentable purpose, defaulting to off until a parent or guardian has agreed to it, and withdrawable independently of the others at any time.
6. Your rights as a data principal
Subject to the DPDP Act and its rules, you may request access to, correction of, or erasure of personal data we hold about you or your child, and you may withdraw consent previously given, at any time and as easily as it was given. To exercise any of these rights, contact admin@netcyberai.com. We intend to publish a dedicated Grievance Officer contact once a school deployment is live, as required under the Act.
7. Where data is stored
For a live school deployment, operational data is intended to be stored in a database hosted in India. See Data Ownership & Security for the specifics and current status of that commitment.
8. Retention
We retain personal data only for as long as necessary for the purpose it was collected for, or as required by applicable law. A specific retention schedule for school data will be published once a live deployment exists to define one against.
9. Changes to this policy
We will update this policy as the product and its legal review progress, and will update the “last updated” date above whenever we do.