Privacy
Privacy Policy
Effective 24 September 2026. This policy covers the munarish.com website, the MUNARISH Academy portal, the Academy shop and the Munarish Phonics app.
In short
- We collect what we need to teach your child, run your account, take fees and reply to you. Nothing more.
- We never sell personal data, show advertising, or track children's behaviour.
- Children's accounts are opened by the Academy office at a parent's request. A parent decides whether their child's lessons may be recorded or transcribed.
- You can download your data, correct it, withdraw consent, or ask us to delete your account. How to delete your account.
- Questions or complaints go to our Grievance Officer, Nalina Balasundaram. The contact details are at the end of this page.
1. Who we are
MUNARISH Academy is a tuition centre run as a sole proprietorship by its Proprietor, Nalina Balasundaram, at No. 5/446, 4th Street, Kumaran Nagar, Mannivakkam Extension, Vandalur, Chennai 600048, Tamil Nadu, India. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), MUNARISH Academy is the Data Fiduciary: we decide why and how your personal data is used, and we are responsible for it.
2. What we collect
| Who you are | What we collect |
|---|---|
| Anyone visiting this website | Nothing that identifies you, unless you fill in a form. Our server records the network (IP) address of each request for security, and the choices kept in your own browser (see Cookies). |
| Someone who sends us feedback | What the feedback is about, any rating, your message, and the page you came from. From the website, your name and email address only if you choose to give them so we can reply; from the portal, your account. You can send website feedback anonymously. |
| Someone who sends an enquiry or raises a help-desk ticket | Your name, email and/or phone number, your message, for an admission enquiry your child's name and grade, the time you agreed to this policy, and the IP address and browser the message came from (kept only to deal with abuse of the form). |
| Shop customers | Your name, email or mobile number, what you bought, the order and tax-invoice details, and a record of each payment (amount, date, and the payment reference from Razorpay). We never see or store your card, UPI PIN or bank login. |
| Parents and guardians | Your name, email, phone number, address, how you prefer to be contacted, which children you are linked to, fee invoices and payments, messages you send in the portal, and the consents you give for your child. |
| Pupils | Name, class, roll and admission numbers, date of birth and photo if the office adds them, whether they study online or in person, attendance, homework, exam marks, report cards, certificates, feedback they choose to give, and, only with a parent's consent, lesson recordings and lesson transcripts. |
| Teachers and staff | Your name, contact details, the classes you teach, your attendance, salary details and payslips, and the lessons you run. |
| Everyone who signs in | Your password, stored only as a scrypt hash that nobody can read back. Your two-factor secret if you turn it on, stored encrypted. A record of sign-ins (time, IP address, browser) and of important actions, for security. |
| People who use the Munarish Phonics app | The app keeps its own record, separate from the portal, held by Google Firebase: the email address you sign in with, whether you are enrolled in a Phonics class and which class, the count of free words used, and — if you subscribe — the state of your subscription (what you bought, when it renews or expires, whether it renews automatically) together with the purchase receipt Google gives us. Somebody who uses the free words without signing in has no email address recorded, only the count. |
3. Why we use it
- To teach: running classes and live lessons, attendance, homework, marks and report cards. Our basis: the consent a parent gives when their child joins, and the teaching service you asked us for.
- To run your account: signing you in, keeping it secure, and sending sign-in codes and password emails.
- To take and account for payments: fee invoices, receipts, shop orders and tax invoices. Some of this we are required to keep by tax law.
- To stay in touch: class reminders, fee reminders, homework reminders, announcements and replies to your messages. We send only messages about the Academy and your account, never marketing from anyone else.
- To keep the service safe: spotting misuse, investigating problems and keeping backups.
- For staff: employment, payroll and legal obligations, which the DPDP Act treats as a legitimate use.
Where we rely on your consent, you can withdraw it at any time (section 11). Withdrawing does not affect anything done before, and we will tell you if it means we can no longer provide part of a service.
4. Children
Most of our pupils are under 18. Under the DPDP Act we need the verifiable consent of a parent or lawful guardian to process a child's personal data, and we treat it seriously:
- Pupil accounts are opened by the Academy office, not by the child, after a parent has enrolled them with us in person or in writing. The office links each child to their parent's account.
- A parent decides, separately for each child, whether their lessons may be recorded, replayed, livestreamed or transcribed. They do this on the Lesson consent page in the portal and can change it at any time. A pupil under 18 cannot change these choices.
- We do not track children's behaviour, build profiles of them for advertising, or show them advertising of any kind.
- Teachers see a pupil's name and Academy record. They do not see addresses, phone numbers or fees.
5. Live lessons, recordings and lesson notes
- Video lessons take place in a video room created for each lesson by Jitsi Meet (meet.jit.si). Video and audio pass through Jitsi's servers during the lesson and are not stored by us unless the lesson is recorded.
- Recordings are made only when every pupil in the class has a parent's consent for recording. They can be watched by the class's teachers and the office, and by the class's families only if every family in the class has agreed to replay. They are deleted automatically 180 days after the lesson.
- Lesson notes: when a class has transcription switched on, and every family has agreed to it, the teacher's browser sends the lesson audio to us in 30-second pieces. Each piece is turned into text by Cloudflare's speech-to-text service, and the audio is then thrown away; we keep only the text. Google Cloud's Vertex AI then drafts a summary and homework for each pupil from that text. The teacher reviews the draft, and parents see it only after the teacher approves it. The transcript is deleted as soon as the teacher approves or discards the notes, and in any case 14 days after the lesson.
- Keeping children safe in lessons: while a lesson is transcribed, we check the text for personal contact details — a phone number, an email address, a home address, a payment ID, or a social media or messaging contact — whoever says them, the teacher included. If one appears, the Academy's administrators are told in the portal and by email which lesson it was, who said it and what kind of detail it was. The alert hides the detail itself. Lessons that are not transcribed, and the video room's own chat, are not checked.
6. Payments
Fees and the shop. Online payments on this website and in the portal are handled by Razorpay Software Private Limited. You type your card, UPI or bank details into Razorpay's own payment window; they never reach our servers. Razorpay tells us whether the payment succeeded, its amount and its reference number, and that is all we keep.
The Phonics app. A subscription bought inside the Munarish Phonics app is sold and charged by Google Play, not by us. You pay Google with whatever payment method your Play account uses; we never see it. Google tells us that a purchase is genuine, what was bought, when it renews or expires and whether it has been cancelled or refunded, and we keep that so the app knows whether to open. Cancelling, pausing or asking for a refund is done in Google Play, and we cannot do it for you — but tell us and we will help you find it.
7. Who else handles your data
We do not sell personal data or share it for anyone else's marketing. We use the following service providers (Data Processors), each only for the job described:
| Provider | What they do for us |
|---|---|
| Hostinger | Hosts the server that runs the website, portal and database. |
| Cloudflare | Delivers the website securely and protects it from attacks, including the check on our sign-in and contact forms that tells a person from an automated script. Converts lesson audio to text for lesson notes. |
| Google Cloud (Vertex AI) | Drafts lesson summaries and homework from lesson transcripts. |
| Google (Gmail) | Sends our emails: sign-in codes, receipts and reminders. |
| Google (Firebase) | Runs the Munarish Phonics app and stores its records. We send it the email address, class and enrolment status (active or ended) of pupils in the Phonics programme, so the app opens for them and closes when they leave. Firebase also holds, for each person who uses the app, the account described in section 2: the sign-in address, the free-word count and any subscription. Google Firebase additionally checks that a request really comes from our app and not from a copy of it. |
| Google Play | Sells and charges any subscription bought inside the Phonics app, and tells us whether it is live (section 6). |
| Razorpay | Takes online payments for fees and the shop (section 6). |
| Jitsi Meet (meet.jit.si, operated by 8x8) | Hosts the video rooms for live lessons. |
| Meta (WhatsApp) | Only if you choose to message us on WhatsApp: carries those messages. |
| Backup storage provider | Keeps encrypted copies of our database off the main server. The copies are encrypted before they leave us, so the provider cannot read them. |
We will also disclose personal data where the law requires it, for example to a court, the police or a tax authority acting under the law.
8. Where your data is processed
Our database is kept on our own server. Some of the providers above process data outside India (Cloudflare, Google and Jitsi run services worldwide). The DPDP Act allows this, except to countries the Government of India restricts, and we will stop any such transfer if the Government restricts it.
9. Cookies and your browser
We use no advertising cookies, no analytics and no tracking. The site stores only what it needs to work:
Our sign-in, enquiry, feedback, help and account-deletion forms include a check from Cloudflare called Turnstile, which makes sure the form is being sent by a person and not an automated script. It looks at signals from your browser, such as how the page was loaded, and runs a small test in the background; most of the time you will not have to do anything. It sets no advertising or tracking cookies, and Cloudflare uses what it sees only to make that check.
The Munarish Phonics app has a check of its own, and it too is a security measure rather than tracking: to stop somebody using a copy of the app to run up our bill, Google checks that each request really comes from the genuine app. On a phone that check is made by Google Play. On the web version it uses Google reCAPTCHA, which looks at how the browser behaves to tell a person from a script, and stores something in your browser to do so. It is never used to build a profile of you or your child, and never for advertising.
| Name | What it is for | How long |
|---|---|---|
__Host-mn_session | Keeps you signed in. Without it you would have to sign in on every page. | Until you sign out, after 60 minutes idle or 12 hours, or 14 days if you ticked "remember me" |
__Host-mn_csrf | Stops other websites from sending requests as you (security). | As long as your session |
munarish.cart.v1 (browser storage) | Remembers what is in your shop basket. It holds product numbers and quantities only. | Until you empty your basket or clear your browser |
mn-theme, mn-nav-open (browser storage) | Remember light or dark mode, and which portal menu groups you opened. | Until you clear your browser |
10. How long we keep it
| Information | Kept for |
|---|---|
| Your account and profile | Until you ask us to delete it (section 11), or the office closes it |
| Website enquiries | 12 months after the last activity on them, then deleted automatically |
| Attendance, homework, marks and report cards | While the pupil studies with us and afterwards, so records and certificates can be provided later. When an account is deleted, they stay with the name removed so nobody can tell whose they were. |
| Fee invoices, receipts, shop orders and tax invoices | As long as GST and income-tax law requires, currently at least 72 months after the due date of the annual GST return for that year. This applies even if you delete your account. |
| Lesson recordings | 180 days after the lesson, then deleted automatically |
| Lesson transcripts | Until the teacher approves or discards the notes, and never more than 14 days after the lesson |
| Lesson audio | Not kept. A piece that fails to convert is retried and deleted within 24 hours. |
| One-time sign-in and confirmation codes | 10 minutes |
| Notifications you have read | 180 days |
| Record of emails and texts we sent | 90 days |
| Security and audit log | 7 years, to investigate misuse and answer legal questions |
| Backups | 14 days, each replaced by newer ones |
| Your Munarish Phonics app account (the sign-in address, free-word count and class status held by Firebase) | Until you ask us to delete it, or you stop using the app and we close the account. Leaving a Phonics class closes the app but does not by itself delete the account. |
| Phonics subscription and purchase records | As long as the subscription is live and for 72 months afterwards, because a purchase is a financial record that tax law requires us to keep |
| The Phonics class list we send to the app | Replaced each time it is sent. A pupil who leaves is marked ended rather than removed, so the app knows to close for them. |
11. Your rights
Under the DPDP Act you have the right to:
- Know what we hold, and get a copy. Signed-in users can download all of it at any time from Privacy & your data in the portal. Anyone else, write to us.
- Have it corrected or completed. Edit your profile in the portal, or ask the office.
- Have it deleted. See our Account Deletion Policy. You can ask from the portal, or from that page without signing in.
- Withdraw consent. Parents can change lesson recording and transcription consent on the Lesson consent page, and anyone can write to us.
- Have your complaint heard by our Grievance Officer (below), and, if you are not satisfied, by the Data Protection Board of India.
- Nominate someone to exercise these rights for you if you die or become unable to. Write to us to do so.
We reply to every request within 30 days. A parent exercises these rights on behalf of their child who is under 18.
12. How we protect it
- Everything travels over encrypted connections (HTTPS).
- Passwords are stored as salted scrypt hashes. Addresses and two-factor secrets are encrypted in the database. Off-site backups are encrypted before they leave our server.
- Each person sees only what their role allows: a teacher their own classes, a parent their own children.
- Important actions are written to a log that cannot be edited.
- If a breach of personal data ever happens, we will tell the people affected and the Data Protection Board as the law requires.
13. Photographs
Photographs appear on this website only when the office publishes an album deliberately. Albums inside the portal are never shown publicly. If you would like a photograph of your child removed, contact us and we will take it down.
14. Grievance Officer and contact
Nalina Balasundaram, Proprietor and Grievance Officer
MUNARISH Academy, No. 5/446, 4th Street, Kumaran Nagar, Mannivakkam Extension, Vandalur, Chennai 600048
Email: munarishedu@gmail.com
Phone: +91-7305361509
We will reply within 30 days. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.
15. Changes to this policy
If we change this policy, we will update the date at the top of this page. If the change affects how we use information we already hold, we will tell signed-in users in the portal and, where the law needs it, ask for consent again.