Privacy Policy
Corporate privacy, governance and data protection framework for the RougeClasses digital learning ecosystem.
Your privacy is important to us.
The user of this Website and associated mobile applications (“User”) agrees to be bound by the terms and conditions of this privacy policy (“Policy”). In the event the terms and conditions of the Policy are not agreeable to the User, the User is requested to refrain from using this Website and our applications.
Rougecodes (CIN: U62099DL2026PTC461771) operates the RougeClasses product and learning management platform (“RougeClasses”, “Company”, “we”, “us” or “our”). We are dedicated to safeguarding the privacy and confidential data of the Users accessing the website https://rougeclasses.rougecodes.com, https://rougeclasses.com, our web platforms, and mobile applications available on Android and iOS.
This Policy is a legally binding document between the User and Rougecodes. The terms of this Policy become effective upon the User’s acceptance of the same (directly or indirectly in electronic form, by clicking on “I accept the Privacy Policy”, by registering an account, or by use of the Website and Services) and will govern the relationship between the User and the Company.
1. Introduction and Scope
RougeClasses is a digital learning and coaching-management platform that enables coaching institutes and educational organisations to manage learning operations and provide digital services to students, parents and educators. This Privacy Policy explains how personal information is collected, used, disclosed, retained and protected when you visit our websites, use our web platform, or access our Android or iOS applications (collectively, the “Services”).
This Policy applies to students, parents and legal guardians, teachers, tutors, institute owners and administrators, authorised institute staff, prospective customers and website visitors. It should be read in conjunction with our Terms of Service, applicable institute agreement, AI & LLM Training Notice and Cookie Policy.
Notice regarding separate consent: Where applicable law requires separate consent for a specific activity (e.g., optional AI model training or non-essential telemetry), that consent will be requested separately. Visiting the website, accepting general terms or using an institute account does not constitute consent to optional processing for which separate consent is mandated.
2. Identity of the Operator and Contact Details
The Services are operated by Rougecodes, a company incorporated under the laws of India, developing and operating the RougeClasses product (“Company”).
3. Key Definitions
Information about an identified or identifiable individual, as defined by applicable law including the DPDP Act 2023.
A student, parent/guardian, teacher, institute representative, administrator or visitor utilizing the Services.
A coaching institute, tuition center, academy or educational organisation subscribing to or administering RougeClasses.
Information relating to a student, including profile, enrolment, attendance, test marks, assessments, learning analytics and reports.
A vetted third party processing information on behalf of RougeClasses or an institute under documented contractual instructions.
Automated computational systems, including machine-learning and language models used for analytics, insights, diagnostic recommendations or product development.
4. Roles of RougeClasses and the Institute
The role of RougeClasses depends on the specific feature and relationship involved:
- Direct Business & Security Operations: RougeClasses determines how it processes account credentials, platform-security metrics, billing, and direct customer relationship data for its own legitimate business operations.
- Institute Educational Records (Data Processor): For student records uploaded or managed by an institute (such as rosters, marks, attendance and batch schedules), the institute determines the educational purpose and means of processing, while RougeClasses acts as a data processor / intermediary providing technical infrastructure under the institute’s instructions.
Students and parents may need to contact their respective institute regarding batch allocation, academic grading, fee concessions, or teacher notes. RougeClasses will assist with technical requests and explain when a request must be directed to the institute administration.
5. Information We Collect
The categories of personal data collected depend on the Services used, institute configuration, user role and permissions granted. We aim to collect information relevant strictly to the stated purpose.
5.1 Account and Identity Information
- Full name, username, profile photograph, email address, and mobile number.
- Date of birth or age where required for course eligibility, child-safety or consent workflows.
- User role (Student, Parent, Teacher, Institute Admin), institute affiliation, class, batch, course, and enrolment status.
- Login credentials in cryptographically protected/hashed form, authentication session tokens, and account-recovery phone/email.
5.2 Academic and Learning Information
- Test questions, answers, online test attempts, marks, percentages, percentile rankings, and historical assessment records.
- Daily attendance, assignment submissions, course progress tracking, learning velocity, and completion milestones.
- Teacher evaluations, feedback remarks, academic notes, and institute-generated performance summaries.
- Diagnostic reports, including RougeClasses’ Dignoasis-style performance insights, weakness indicators, and study recommendations.
5.3 Content, Communications and Classes
- Educational documents, study PDFs, uploaded images, notes, assignments, doubt tickets, and support messages.
- Direct messages between teachers and students, broadcast notifications, and platform community interactions.
- Live-class attendance logs, join/exit timestamps, and class recordings where recording is enabled and clearly disclosed.
5.4 Institute, Subscription and Transaction Information
- Institute legal name, official business address, tax identifiers (GSTIN), administrator contact details, and subscription tiers.
- Invoices, billing contacts, payment receipt confirmations, gateway transaction references, renewal records, and refund requests.
- Administrative information regarding teacher rosters, batch allocations, staff permissions, and student capacity limits.
5.5 Device, Log and Technical Information
- IP address, device hardware model, web browser, operating system, app build version, and network connection type.
- Login timestamps, session duration, crash diagnostics, latency logs, security events, and feature interaction metrics.
- Cookie identifiers, session storage, and mobile SDK tokens as detailed in our Cookie Policy.
5.6 Information Received from Other Parties
We may receive personal data from an educational institute provisioning your account, from a parent/guardian registering on behalf of a minor, or from third-party service providers (such as payment processors, Google authentication, or SMS gateways). The party providing information must possess the required legal authority and consent under applicable regulations.
6. How We Use Information
We process your personal information exclusively for the following lawful and operational purposes:
7. AI, Automated Analysis and Model Development
RougeClasses utilizes smart analytics, diagnostic algorithms and machine-learning technologies to produce personalized academic summaries, performance predictions, and diagnostic reports (such as RougeClasses’ Dignoasis engine).
7.1 Use of Information to Develop RougeClasses Models
RougeClasses may develop, train, fine-tune or evaluate machine-learning and language models for predictive educational diagnostics. Potential data categories include anonymised test responses, scores, study patterns, and platform feedback.
7.2 Separate Authorisation and Student Safeguards
- An institute’s general subscription or standard platform access is not a blanket authorisation to train generative models on identifiable student data.
- Where consent serves as the legal basis, model-training participation is provided as a clear, specific, and unbundled choice.
- For minor students, verifiable parent/guardian consent is mandatory before any model development processing begins.
- Refusing optional model training will never block or impair a student or institute from accessing core coaching and learning services.
- We prioritize strictly aggregated, de-identified or anonymized data sets for all algorithmic evaluations.
7.3 Third-Party AI Providers
Where third-party AI models (e.g. cloud LLM providers) are leveraged for specific features such as automated test parsing or transcription, contractual boundaries strictly prohibit those providers from retaining or training their general foundation models on customer data.
7.4 Consent Withdrawal & Model Limitations
Users may withdraw consent for optional AI analytics at any time via account settings or by emailing contact@rougecodes.com. Withdrawal stops prospective processing within a reasonable timeframe.
8. Children’s Privacy and Parent / Guardian Consent
Special Safeguards for Minors (Under 18 Years)
In compliance with the Digital Personal Data Protection Act, 2023 (DPDP) and child safety norms, RougeClasses enforces rigorous protections for student minors.
- Verifiable Consent: Where applicable law requires verifiable consent from a parent or lawful guardian, relevant processing will not commence until parental consent is verified and recorded.
- Prohibition of Targeted Advertising: Children’s personal data is strictly forbidden from being used for behavioral profiling, targeted advertisements, or third-party marketing monetization.
- Strict Need-to-Know Access: Institute, teacher and parental access is strictly role-based and limited to educational oversight.
- Parental Review: Parents and lawful guardians may contact our privacy officer at contact@rougecodes.com to review, correct, or request deletion of their child’s personal records.
9. Disclosure and Sharing of Information
We do not sell personal data. We disclose information only where necessary to fulfill the Services, where authorized, or where mandated by law:
10. International Processing and Transfers
RougeClasses primary infrastructure is hosted in secure data centers located in India. To the extent that sub-processors or redundant backup systems operate in other jurisdictions, we ensure compliance with statutory transfer regulations, standard contractual clauses, and encryption standards to preserve data integrity and privacy.
11. Retention and Deletion Schedule
We retain personal data only for as long as necessary to provide the Services, fulfill statutory obligations, resolve disputes, and uphold institute contracts:
| Data Category | Approved Retention Schedule |
|---|---|
| Account & Profile Data | Maintained during active account tenure; archived and purged within 90 days post verified account closure. |
| Student Academic Records | Retained in alignment with institute academic tenure and educational record mandates. |
| Assignments & Uploaded PDFs | Retained throughout the active batch term; subject to institute-configured storage cycles. |
| Live Class Recordings | Configured by institute subscription (typically 30–365 days) or until deleted by administrators. |
| Tax & Billing Records | 7 to 8 years as mandated by Indian taxation, GST and statutory accounting laws. |
| Support Communications | Up to 3 years for resolution verification, quality training, and dispute records. |
| Security & Access Logs | 180 days to 1 year for cyber incident investigation and CERT-In compliance. |
| Database Backups | Rolling 30-day encrypted snapshot cycles with automated cryptographically secure overwrite. |
12. Security and Confidentiality
RougeClasses implements comprehensive technical and organisational safeguards commensurate with the sensitivity of educational records:
Mandatory TLS 1.3 / HTTPS for all web and API data transmissions; AES-256 encryption for sensitive storage.
Least-privilege permission models ensuring teachers and staff access only their assigned students.
Continuous code vulnerability scanning, dependency patching, and automated threat mitigation.
Established protocols for immediate containment, forensic review, and regulatory notifications.
13. User and Institute Responsibilities
- Users are responsible for safeguarding login passwords, OTPs, and authentication keys.
- Promptly notify RougeClasses or your coaching institute if unauthorized account access is suspected.
- Institutes must verify that student rosters, parent numbers, and teacher profiles are lawfully obtained.
- Refrain from uploading unneeded sensitive personal information into unstructured comments or public boards.
14. Privacy Rights and Requests (DPDP Act, 2023)
Under the Indian Digital Personal Data Protection Act, 2023 and other applicable frameworks, users have specific statutory rights:
15. Consent Withdrawal and Communication Preferences
Where data processing relies on consent, you may withdraw consent at any time via your account settings or by emailing contact@rougecodes.com. Withdrawal operates prospectively and does not impact prior lawful operations. Essential service notifications (e.g. fee invoices, password resets, security alerts) will continue while your account remains active.
16. Account Deactivation and Deletion
A user may request account deactivation and deletion within our mobile applications (via Profile > Settings > Delete Account) or by emailing official@rougecodes.com. For student accounts managed by an educational institute, the institute may need to confirm academic record transitions before deletion is completed.
18. Third-Party Websites and Services
The Services may link to third-party portals, video platforms, or learning material. Those external services operate under their own independent privacy terms. We advise reviewing their individual policies prior to disclosing personal information.
19. Changes to this Policy
We periodically update this Policy to accommodate feature upgrades, regulatory changes, or operational enhancements. Updates will be indicated with a revised “Last updated” timestamp. For material modifications, registered users and institutes will receive prompt notification via email or platform banners.
20. Grievance Redressal and Contact Details
In compliance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are published below:
Bikesh Kumar
Designated Grievance & Privacy Officer
21. Governing Law and Disputes
This Policy and all matters arising out of or related to your use of the Services shall be governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Any legal proceeding or dispute arising under this Policy shall be subject to the exclusive jurisdiction of the competent courts at New Delhi, India.
Document Profile: RougeClasses Digital Ecosystem v2.0 • Effective: 30-Oct-2026