Privacy Policy

Shri SuperShastra Enterprises LLP · Effective 1 February 2026 · Last updated 24 October 2026

1. Introduction

This Privacy Policy explains how Shri SuperShastra Enterprises LLP (“SuperShastra”, “we”, “us”, “our”) collects, uses, shares, stores, and protects information when you use our mobile applications (Android/iOS), websites (when available), and related services (collectively, the “Services”).

Our Services are designed for parents/guardians to create and manage kid profiles and provide children access to curated learning and entertainment content (videos, audio, PDFs, articles, quizzes, games and interactive experiences). Children should not create accounts on their own. The parent/guardian is the account holder and is responsible for supervision.

2. Who We Are (Data Controller / Data Fiduciary)

• Entity: Shri SuperShastra Enterprises LLP
• Email: supershastra@gmail.com
• Address: Prestige Wellington Park, Gangamma Circle, India

3. Scope

This Privacy Policy applies to:

• The consumer apps (Android and iOS)
• The web experience (when launched)
• Our Admin/CMS (“Studio”) portal used to upload/manage content
• Customer support, communications, and notifications
• Experiments/A-B tests and analytics conducted within the Services

4. Information We Collect

4.1 Information You Provide

Account & authentication

• Phone number (for OTP login)
• Email address / Google account identifier (if you use Google sign-in)
• Parent settings (language, preferences, parental PIN setup)

Kid profiles (created by parent/guardian)

• Kid name or nickname
• Kid age band (e.g., 2–4, 5–7, 8–10, 11–13)
• Interests/topics (multi-select)
• Language preference(s)

Support & communications

• Messages you send to us (email/in-app support), feedback, and attachments (if any)

Parental controls

• Parental gate/PIN (stored securely in hashed form; we do not store your PIN in plain text)

4.2 Kid Photo / Avatar & AI Personalization (feature may be optional)

If you enable AI onboarding / kid avatar creation, you may upload a child’s image. We treat kid images as sensitive and apply additional safeguards:

• We may temporarily store the original image encrypted to generate the avatar and handle retries.
• We may retain the original image for a limited period (e.g., up to 7 days) and then delete it, unless required for support, security, or legal compliance.
• We may retain the generated avatar and associated metadata until you delete it, delete the kid profile, or delete the account.

4.3 Automatically Collected Information

When you use the Services, we may collect:

• Device & app info: device model, OS version, app version, language, time zone, network type, identifiers used for security, and diagnostics
• Usage analytics: screens viewed, content impressions, searches, play/pause/seek events, completion %, watch/listen/read time, drop-off points, bookmarks/likes (if enabled), session timestamps
• Performance & reliability: crash logs, error logs, latency, buffering stats, player failures
• Experiment data: which A/B variant you were assigned, exposure events, outcomes (e.g., conversion)

We do not intentionally collect precise GPS location unless we introduce a feature that requires it (in which case we will ask permission and disclose the purpose).

4.4 Payments & Subscription Information

Payments may be processed by platform providers and/or payment processors:

• Android: Google Play Billing (subscriptions/in-app purchases). We receive purchase identifiers (e.g., order ID/product ID/purchase token) and subscription status to grant access.
• iOS: Apple In-App Purchase. We receive transaction identifiers and subscription status to grant access.
• Razorpay (in the app and on the web): Razorpay may process payments for plans bought in the app or on the web. We may receive payment status, order ID, and limited billing details. We do not store full card details.

4.5 Permissions We May Request (Based on Features)

Depending on enabled features, the app may request:

• Camera / Photos / Media: upload kid image for avatar or profile image
• Files / Storage: offline downloads, local caching, saving PDFs
• Notifications: content updates, reminders, important account messages
• Microphone (only if voice search/interactive voice features are introduced)
• Network/Internet: streaming and sync
• Other OS permissions needed for security and playback features (e.g., picture-in-picture if supported)

You can control permissions in device settings. Some features won’t work without relevant permission.

4.6 Third-Party SDKs and Services Used in the App

The app includes the following third-party software and services. Each processes data under its own privacy terms:

• Google Firebase (Analytics, Crashlytics, Performance Monitoring, Remote Config and Cloud Messaging): app usage and screen events, crash and performance reports, feature settings, and push notification delivery. These use device and app identifiers.
• Google Mobile Ads (AdMob): the app includes the AdMob SDK. It is configured for child-directed treatment with the most restrictive content rating (“G”), so it does not serve personalised ads for children. AdMob may still collect limited device and diagnostic information to deliver and measure ads.
• Meta (Facebook) App Events: we use Meta’s SDK to measure the parent journey, such as install, sign-up and subscription steps. Events are recorded only during parent sessions, and automatic event logging and advertising-ID collection are switched off. Kid profile details and viewing activity are not sent to Meta.
• Google Play Install Referrer: on first launch the app reads the campaign source (for example, which link or ad led to the install) and sends it to our servers together with a device identifier, so we can understand which channels bring families to GilluTV.
• Razorpay: payment processing for plans bought in the app or on the web.
• MSG91: delivery and verification of one-time passwords by SMS.
• Google Sign-In: optional sign-in with your Google account.
• OpenAI (AI-assisted search): when you use search, the text typed into the search box is sent from our servers to OpenAI to produce results. Do not enter personal information in search. We limit how many AI searches can be made per day.
• Device security features: if you turn on biometric unlock for the parental gate, the check is done by your device. We do not receive your fingerprint or face data.

5. How We Use Information

We use information to:

1. Provide the Services: authentication, kid profiles, content delivery, streaming, reading, quizzes, games
2. Personalize experiences: recommendations based on age band, interests, language, and engagement
3. Enable purchases & entitlements: verify subscriptions and grant/limit access to paid content
4. Run experiments/A-B tests: pricing/trial configuration, paywall layout, content titles/thumbnails, and measure performance
5. Safety & security: prevent fraud/abuse, protect accounts, enforce parental gate
6. Improve performance: analytics, debugging, crash prevention, buffering reduction
7. Communications: OTP messages, transactional notifications, service announcements, and (if opted-in) marketing messages
8. Legal compliance: tax/accounting, responding to lawful requests, enforcing our Terms

6. Legal Bases / Lawful Purposes

Where applicable, we process data based on:

• Consent (e.g., optional features like avatar creation, marketing notifications)
• Contract/performance of services (to deliver content and manage subscriptions)
• Legitimate interests (security, fraud prevention, service improvement) balanced with your rights
• Legal obligations (tax, compliance, lawful requests)

7. Children’s Privacy & Parental Controls

• The account is intended for a parent/guardian.
• We use a parental gate (PIN) to restrict access to purchases, subscription management, settings, and profile switching.
• We do not currently offer public user-generated content (e.g., public comments). If introduced later, we will implement child-safety controls and moderation.

If you believe a child has provided personal data without guardian consent, contact supershastra@gmail.com and we will investigate and take appropriate action, including deletion where applicable.

8. Sharing & Disclosure

We may share information with:

• Service providers (processors): hosting, storage/CDN, analytics, crash reporting, customer support tooling
• Google (Firebase and AdMob) and Meta: for analytics, crash reporting, push notifications, ads and parent-journey measurement, as described in section 4.6
• OpenAI: search text, to provide AI-assisted search results
• OTP/SMS provider: MSG91 to deliver and verify OTP
• Platform providers: Google/Apple for sign-in and in-app purchases
• Payment processors: Razorpay or others for payment handling
• Legal/regulatory authorities: when required by law or to protect rights/safety
• Professional advisors: auditors, lawyers, accountants as necessary

We do not sell personal data. Where the app shows ads, we use Google AdMob with child-directed treatment and the most restrictive content rating, so ads are not personalised for children. We will update this policy if we add other ad partners.

9. Screen Recording / Content Protection (Best Effort)

We may apply technical measures such as screenshot blocking (where supported), screen recording detection (where supported), and watermarking to reduce unauthorized copying. These measures are best-effort and cannot guarantee prevention on all devices/platforms.

10. Data Storage, Residency & Transfers

We aim to host primary systems in India. Some third-party providers may process data outside India. Where required, we use contractual and technical safeguards to protect transfers.

11. Data Retention

We retain data only as long as necessary:

• Account & kid profiles: until you delete them (plus limited period for compliance/disputes)
• Kid images (avatar feature): original image encrypted and kept briefly (e.g., up to 7 days), avatar kept until deleted
• Analytics: raw events up to 12 months, aggregates up to 24 months (may change with notice)
• Payment records: as required for accounting/tax and fraud prevention

12. Security Measures

We use reasonable safeguards, including:

• Encryption in transit (TLS) and encryption at rest for sensitive data
• Access controls and least privilege
• Audit logs for admin actions and sensitive operations
• Rate limiting and abuse detection for OTP and purchases
• Secure storage of tokens/keys using secrets management

No system is 100% secure. You are responsible for protecting your device and account access.

13. Your Rights & Choices

Depending on law and your location, you may have rights to:

• Access, correct, or update your information
• Delete your account and kid profiles
• Withdraw consent for optional processing
• Request information about processing
• Lodge a complaint with a regulator where applicable

You can use in-app settings (where available) or email supershastra@gmail.com.

How to delete your account and data

To delete your account and all kid profiles, use the account deletion option in the Parent Zone where it is available, or email supershastra@gmail.com from the email address or phone number linked to your account with the subject “Delete my GilluTV account”. We will verify the request and delete or anonymise your personal data within 30 days, except records we must keep for tax, accounting, fraud prevention or legal reasons.

14. Cookies (Web)

When our web experience is available, we may use cookies/local storage for login, preferences, and analytics. You can control cookies through browser settings.

15. Updates to This Policy

We may update this Privacy Policy. If changes are material, we will notify you via the app, website, or other reasonable means. The “Last Updated” date shows the latest version.

16. Grievance / Contact

For privacy questions, requests, or grievances:

• Email: supershastra@gmail.com
• Address: Prestige Wellington Park, Gangamma Circle, India

We aim to acknowledge within 7 days and resolve within 30 days where practicable.

Company: Shri SuperShastra Enterprises LLP

Contact: supershastra@gmail.com

Address: Prestige Wellington Park, Gangamma Circle, India

Effective Date: 01/02/2026

Last Updated: 24/10/2026