Privacy · draft
Privacy policy
Draft: legal review pending. This page is not yet in force. It describes what the CMDLearn website and the CMDLearn AI tutor actually do today, written from the code. A lawyer has not reviewed it yet, and the items marked to be confirmed are not decided. CMDLearn is not yet a registered company.
Who we are
CMDLearn builds an AI tutor for children in Classes 1 to 10 in India. The tutor is a test version. Contact: [email protected].
Legal name, registered address and grievance officer: to be confirmed after incorporation.
The website (www.cmdlearn.com)
- The website sets no cookies, shows no advertising and does not track you across other sites. We count
page views with Vercel Web Analytics, which says it works without cookies. Where you came from (for example a link with
?src=) is carried in the page address only, so we can count sign-ups per channel. This is about the website only. The AI tutor uses a little storage in the browser, described below. - The waitlist form sends your email address, who you are (for example parent, teacher, school leader, NGO or government), your state if you give it, the plan you chose, and the page or channel you came from, to our form service, Formspree, which emails them to us. The form sends only after you tick that you are 18 or older; the tick itself is not sent. To be removed, write to [email protected]. How long Formspree keeps waitlist entries: to be confirmed in legal review.
- Email to our @cmdlearn.com addresses is forwarded by Cloudflare Email Routing to our inbox.
- Hosting. The website is hosted by Vercel, which keeps its usual request logs and may serve pages from servers outside India (we saw a United States server). Cloudflare sits in front of the website and passes every visit through its network.
The AI tutor: two ways it runs
The public demo. The demo is open to anyone with the link. It uses no family code and records no parental consent. It is for adults to try; please do not let a child use it alone, and do not type a child's personal details into it.
The family test (pilot). A family we invite gets a family code. Before a child can use the tutor, the parent gives consent, and the tutor asks for that consent first. Our staff record the consent from a signed paper form, and the service keeps only this: which version of this notice, the date, the staff member's initials or first name, and the answer about voice. The service stores no names. The parent's name is only on the paper form. We record that a signed form exists. We do not check who signed it. Where the paper forms are kept and for how long: to be confirmed in legal review. Every earlier consent record stays on the family record until the family withdraws.
What a child's session keeps
A child uses the tutor with a child code the parent chooses (like R-07), which should never be the child's name. We do not ask for a child's name, photo, address, phone number or Aadhaar number. The signed paper form, which is kept outside the service, holds a parent's name; the service's records do not.
What the tutor hides, and what it may miss
The tutor looks for a few kinds of personal detail in what a child types, and in the words it gets from speech, and hides them before the text is stored or sent to the AI. It hides:
- email addresses;
- Indian mobile numbers (ten digits starting with 6, 7, 8 or 9, with or without +91);
- Aadhaar numbers (twelve digits written in groups of four, or twelve digits next to the word Aadhaar or UID);
- PIN codes, only when they come right after the word "pin".
Other things may not be caught: a PAN, passport, school roll or bank number, phone numbers written in an unusual way or in words, and names and addresses. Please remind your child not to type or say them.
Voice is different. When a child speaks and a short voice clip is sent to OpenAI to be turned into text (see below), nothing is hidden first: the clip contains whatever the child says. The hiding applies to typed text and to the text that comes back, not to the audio.
| What | Why | How long |
|---|---|---|
| The child's questions (with the details above hidden) and the tutor's replies, the class, the language, the child code, and any safety flag | So a parent and a small CMDLearn team can review sessions for safety and quality | 90 days, then deleted automatically |
| Practice answers and scores | The weekly report the parent sees | 90 days, then deleted automatically |
| The family record: family code, child codes and classes, the parent's PIN (stored only as a one-way hash), trial and session counts, the parent's weekly answer, and every consent record (notice version, date, the staff member's initials or first name, and the answer about voice; no parent or child names) | Sign-in, the free trial, the weekly question, and proof of consent | Until the family withdraws. After a withdrawal we keep one thing, see below |
| A parent's sign-in on the parent page | To stay signed in | Stops working 30 minutes after its last use (give or take a minute). We keep only a one-way scrambled copy, and that copy can stay stored until the next sign-in clears it |
| A child's open chat or lesson | The conversation or lesson in progress | Kept so a restart does not lose it: a copy of the chat or lesson in progress (with the details above hidden), with the family and child codes, is saved in our database, or in the server's log folder where there is no database. A copy unused for 2 hours is no longer used, and a clean-up that runs about once a minute deletes it. One exception: if the tutor asked the child a gentle safety question and the check-in alert to CMDLearn's incident owner has not been sent yet, the copy is kept past 2 hours until that alert is sent. A deletion request or a withdrawal deletes it at once. After a child's records are deleted we keep, for 7 days, a one-way hash of the family and child codes with the time, so that no copy of that child's chat is stored again. What the chat saved follows the 90 days above |
| Daily counters per child code (voice used today) | Daily limits | The current day only; deleted within 3 days |
| The OpenAI cost ledger: one entry for every OpenAI call (Asha's voice and hearing a child's voice clip), with the kind of call, the model, the cost and a short label such as "live voice hi (52 chars)". It holds no child data and never a child's words. The daily spending limit for the other AI calls (the chat tutor and the lessons, which run on Anthropic) is kept as two numbers per day, the day's estimated cost for chat and for lessons, in our database (or the server's log folder where there is no database), so a restart does not reset it. These totals hold no child data. Video-call minutes are counted separately | Cost control and the monthly spending limit | The OpenAI ledger and the database copy of the daily totals are not deleted yet: how long we keep them is to be confirmed in legal review. In the log folder the daily totals are kept for 40 days |
What the tutor stores in your browser
The tutor, unlike the rest of the website, uses a little storage in the browser. None of it is used for advertising or to follow anyone.
- Language choice (browser local storage): so the tutor opens in the language you picked.
- A random id,
cmdl-dev(browser local storage, live video class only): a made-up code like d4k9x2m1qa, not linked to a name, used to apply the daily voice limit to one browser. - Parent sign-in (browser session storage): keeps a parent signed in on the parent page until the tab is closed or the sign-in ends.
- Staff sign-in (browser session storage): used only by CMDLearn staff on the staff page.
- One cookie,
cmdl_live: set only when someone enters the access code for the live video class. It remembers the code for 12 hours so the page stays open, and the browser does not let page scripts read it.
IP addresses. The server uses a visitor's IP address, in the server's memory only and never written to our own records, to apply rate limits, the daily count of voice and voice-clip requests, and the tries at the live-class access code. It is lost from memory when the service restarts. The host's own request logs are described next.
Where it is stored: the tutor runs on Render in the Singapore region and keeps its data in a Neon Postgres database. Render keeps its usual request logs, which include visitors' IP addresses; how long it keeps them is to be confirmed in legal review. Neon's exact region, and how much recovery history it keeps: to be confirmed in legal review.
Who else processes a child's data
| Service | What it receives | Used for |
|---|---|---|
| Anthropic (Claude) | The child's question with the details above hidden, the class, the language, and the earlier messages of the same chat. For the safety check below: the same hidden-detail text of the last few exchanges. For staff "next steps": a stored transcript, with the same details hidden | Writing the tutor's reply, checking whether a child may be unsafe, and helping staff plan follow-up |
| The browser's own speech service (Google in Chrome, Microsoft in Edge) | The child's voice, when the microphone is used | Turning speech into text on the child's device; CMDLearn receives only the text |
| OpenAI | The tutor's own words, to read them aloud in Asha's voice; and, on a browser that cannot hear speech itself, a short clip of the child's voice to turn into text. Nothing is hidden from the clip first | Asha's voice, and hearing the child. We do not store the clip: it is held in memory for that one request. OpenAI's own keeping rules: to be confirmed in legal review |
| Anam or Tavus, with Daily for the video connection | The child's voice during a live video class with Asha | Showing Asha on video and turning the child's speech into text. Recording and transcripts are switched off with both, but Anam's setting is not a full "no data kept" contract. The video class is behind an access code and is for adult demos, not part of the family test today |
| Telegram (a CMDLearn bot) | A safety alert: the kind of concern, the class, the time, the session number, and the school code and group when they are set. If a child types a personal detail, a "privacy note" alert says which kind it was (for example a phone number or an email), never the words. Never the child's words or a name | Telling CMDLearn's incident owner at once |
| Razorpay (payments) | Nothing today: payments are switched off. When they are on, only our order reference goes to Razorpay, no name, email or phone from the tutor | Taking payment. We keep only the order (plan, amount, status and Razorpay's reference), never card or bank details |
| Cloudflare and Vercel | Every visit to the website passes through them, and the website's page views are counted by Vercel | Delivering the website and email forwarding |
Some of these services process data outside India. Exact locations, and each service's terms on keeping data and on training on it: to be confirmed in legal review.
The child's camera, in the video class, shows only on the child's own screen. It is never recorded or sent anywhere.
Safety
Each message is also read by a second safety check, which looks at the last few exchanges and not only the newest message. If a child writes something that suggests they may be unsafe or very upset, the tutor stops and shows a kind message telling the child to talk to a trusted adult and that they can call 1098 (CHILDLINE). The session is flagged for the supervising adult and a CMDLearn reviewer, and an alert goes to CMDLearn's incident owner as described above. Children in Classes 1 to 5 can start only after an adult ticks a box saying they are nearby; we cannot check that tick.
What we never do
We never sell a child's data, never use it for advertising, and never track a child across other apps or websites. The tutor has no advertising or tracking scripts.
A parent's choices
- See what we hold: write to [email protected] with your family code. Our staff send you a plain summary of everything kept for your family or one child.
- Correct a class: on the parent page, or by writing to us.
- Delete one child's data, or withdraw the whole family: write to us. A withdrawal ends open sessions and sign-ins and deletes the family record, every session record and every practice answer from the live service at once. A record that a request still in progress tries to write afterwards is refused, and the family's records are swept again a few minutes later. We keep one thing: a one-way scrambled copy (a hash) of the withdrawn family code and the time of the withdrawal, with no other detail, so that no backup restore or late write can bring the family back. The database provider keeps a short recovery history that may still hold a withdrawn family for a while: how long is to be confirmed in legal review. Dated backups of family records are built but not running yet; once they run, a withdrawn family is removed from every kept backup at the next run.
- How quickly we reply to each request: to be confirmed in legal review.
Changes
This is a draft. When it comes into force, the date will be shown here, and changes after that will be dated.