Privacy Policy

1 Introduction

Welcome to SMS Tutorial (accessible via smstutorial.in and our companion mobile applications). We provide an integrated modular EdTech Learning Management System (LMS) designed to replicate physical classroom experiences digitally. We respect your privacy and are committed to protecting the personal data of our users—including students, teachers, and administrators.

2 Who We Are

3 Scope of This Privacy Policy

This Privacy Policy applies to all services, web portals, REST API endpoints (`/api/v1/`), mobile views, and Android WebView application interfaces operated under `smstutorial.in`. It covers all individuals who access or use our platform, categorized into three distinct roles: Students, Teachers, and Administrators.

4 Information We Collect & Information You Provide

We collect personal information directly from you when you register an account, enroll in courses, attempt assessments, or communicate through our platform. The specific data collected depends on your role:

6 Information Collected Automatically

When you access our platform, our backend systems automatically record technical log information in our security audit tables (`audit_logs`) and server logs. This includes:

• IP Address: Recorded automatically during user login, registration, and OTP authentication.
• User Agent String: Operating system, browser type, and device framework (e.g., Android WebView header).
• Access Timestamps: Exact times of API requests and authentication events.

7 Educational and Academic Information

As part of our core educational functionality, the platform stores academic records to enable interactive learning:

8 Account and Authentication Information

Accounts are secured using passwords hashed via Bcrypt (12 rounds). We do NOT store passwords in plain text or encrypted form. For two-factor verification and registration validation, 6-digit OTP codes are generated and dispatched via SMS using MessageCentral CPaaS, expiring after 10 minutes. Session authorization uses encrypted database web session cookies (`laravel_session`) and Laravel Sanctum API tokens.

9 How We Use Personal Data & Legal Bases for Processing

We process personal data strictly for legitimate educational and platform administration purposes under the **Digital Personal Data Protection Act, 2023 (DPDP Act)** and applicable Indian IT laws:

• Service Delivery: Managing course enrollments, video streaming, quizzes, and live classrooms.
• Authentication & Security: Verifying user identity via SMS OTPs, protecting against unauthorized access.
• Parent & Student Notifications: Dispatching SMS and email alerts regarding student classroom performance.
• Payment Processing: Facilitating plan subscriptions and generating billing invoices.
• Legal Compliance: Maintaining audit logs and financial records as mandated by Indian statutory laws.

11 Service Providers and Third-Party Processors

We do NOT sell, rent, or trade your personal data. To provide specific technical features, we share relevant data with trusted third-party infrastructure processors who process data on our behalf:

13 Payments and Billing Disclosures

Subscription plans (Basic, Premium, Pro) are processed securely through Razorpay. SMS Tutorial receives transaction receipts containing payment IDs, plan codes, and order totals. We NEVER store credit/debit card numbers, CVVs, net banking credentials, or UPI PINs on our servers. All sensitive payment details are handled directly by Razorpay in compliance with PCI-DSS guidelines.

14 Cookies, Local Storage & Server Logging

We use essential session cookies (`laravel_session` and `XSRF-TOKEN`) required for user login authentication and CSRF security protection. Browser local storage and offline cache storage (`caches.open('offline-videos')`) are utilized strictly to support offline lecture video downloads on user request. We do NOT use third-party advertising cookies or cross-site tracking scripts.

16 Parent & Guardian Alerts

Because SMS Tutorial is an educational platform serving students, teachers/admins may trigger parent performance notifications (`/students/{id}/alert-parents`). These alerts send automated SMS messages (via MessageCentral) and emails notifying parents or registered guardians of classroom attendance or performance concerns.

17 Data Security & Retention Practices

We implement reasonable administrative, technical, and physical security safeguards to protect your personal data, including HTTPS encryption in transit, Bcrypt password hashing, role-based authorization policies, and database parameters binding. However, no Internet-transmitted data or electronic storage is 100% immune from breach, and we cannot guarantee absolute security.

Retention: Personal data is retained for as long as your account remains active or as needed to fulfill educational services. Transactional billing records and security audit logs are retained for statutory periods mandated under applicable Indian laws.

20 Your Privacy Rights & Children's Privacy

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), users have the right to access, review, correct, update, or withdraw consent for processing their personal data.

Minors: Users under the age of 18 access the platform under educational institution oversight or with parent/guardian consent. We do not knowingly collect personal data from minors outside of legitimate educational course requirements.

23 Transfers, Third-Party Links & Policy Updates

Your data may be processed on cloud infrastructure operated by our providers (LiveKit, api.video) in secure data centers. Our platform may contain links to external sites; we are not responsible for the privacy practices of external web entities.

We reserve the right to update this Privacy Policy at any time. Material changes will be indicated by updating the "Last Updated" date at the top of this page.