Privacy policy
ChessDoer teaches chess to school students on their school’s computers, and to children in Europe whose parents sign them up directly. This page explains what we collect, why, who can see it, how long we keep it, and how you can ask us to see, fix or delete it. We wrote it in plain English. If anything is unclear, ask us.
Who we are
ChessDoer is run by its founder, Honi Arora, from Jaipur, Rajasthan, India. For the Digital Personal Data Protection Act, 2023 (the DPDP Act), ChessDoer is the “data fiduciary”: we decide how your data is used and we are responsible for it.
You can reach us at [email protected]. Our grievance officer is named at the end of this page. Families in the European Union: see also Families in the European Union.
Who this covers
- Students: children who learn on ChessDoer through their school.
- Parents and guardians: who register a child, pay the fee and get updates, in India or in the European Union.
- School staff: teachers and office staff who use the school office pages.
- Visitors: people who read this website or ask us for a demo.
Children and parent consent
Most of our learners are under 18, so the DPDP Act treats them as children. We only use a child’s data with the consent of a parent or lawful guardian.
- When a parent registers or pays, they first prove their phone number (or email address) with a 6-digit code sent on WhatsApp (or by email).
- They then read a short notice and tick “I am the parent or guardian” before paying. We store the time of that tick and the version of the notice they saw.
- If a school adds students from its own list, those children cannot use ChessDoer until a parent has registered and given consent this way. During a free pilot agreed with a school, the school confirms it has the parents’ permission, and we ask each parent for consent when they register.
We do not track children across other websites, show them advertising, or build profiles of them for advertising. The game features in ChessDoer (ranks, streaks, gifts) are only there to help children practise.
What we collect
| About | What | Why |
|---|---|---|
| Students | First and last name, school class, batch, school | To run the class and show the right child their lessons |
| Students | A drawn face (avatar) the child builds from shapes. No photos. Gender, if the parent gives it, is only used to pick the first face | So young children can find themselves on the sign-in screen |
| Students | A 4-digit sign-in PIN | So the child can sign in without email or passwords |
| Students | Learning records: lessons and puzzles done, answers, exam results, games against the computer, time practised, streaks, points, ranks and certificates | To teach at the right level, and to show progress to the school and the parent |
| Parents | Phone number, email address if you choose email, the consent record, your message settings | To verify you, send receipts, reminders, reports and certificates, and keep proof of consent |
| Parents | Payment records: amount, date, status, invoice number and the reference numbers of Razorpay (India) or Stripe (Europe) | To run billing, issue invoices and keep the accounts the law requires |
| Parents | A record of each message we sent you: which message, when, and whether it was delivered. Not the text | To avoid sending the same message twice and to answer questions about it |
| School staff | Name, email, password (stored only as a secure hash), two-step sign-in secret, sign-in history | To keep the school office pages safe |
| Demo requests and feedback | Name, role, school, city, phone and your message; feedback a student or school staff member sends us | To reply to you and improve ChessDoer |
| Everyone | Technical data: sign-in cookies, a shortened (masked) IP address for security limits, and records of important actions | To keep accounts safe and stop misuse |
We never see or store card numbers, bank account numbers, UPI PINs or bank passwords. Payments are handled by licensed payment companies: Razorpay in India and Stripe in Europe.
The chess computer (bot) and game analysis run inside the browser on the lab computer. Games are saved to your child’s record, but are not sent to any other company.
How we use it
We use personal data only to:
- teach each child and save their progress;
- show a school its own students’ progress and whether each fee is paid;
- show parents their own children’s progress, receipts, reports and certificates;
- collect fees, issue receipts and keep accounts;
- send messages on WhatsApp or by email, whichever you chose: the sign-up code, welcome and PIN, payment reminders, receipts, a weekly update and the monthly report (no marketing);
- keep the service safe, fix problems, and improve our lessons using totals that do not identify anyone.
We do not sell personal data. We do not use it for advertising.
Who can see it
- The child’s school sees its own students’ names, batches, progress and fee status (paid or not). It does not see payment details.
- The parent sees only their own children.
- ChessDoer staff, who need it to run the service.
- Companies that work for us (data processors), only to do their job for us:
- Razorpay, for payments and auto-pay in India
- Stripe, for payments by card or SEPA Direct Debit in Europe, and the receipts and payment emails it sends
- Meta (WhatsApp Business Platform), to deliver our WhatsApp messages
- Zoho Mail (its EU data centre), to send our emails and hold the [email protected] mailbox
- Hostinger, which runs our server in India
- Google Drive, which stores our encrypted nightly backups (Google cannot read them)
- Cloudflare, which runs our domain name
- Authorities, only when the law requires it.
Where it is stored
Our database runs on a server in India. Some processors handle data outside India, as the DPDP Act allows: Meta (WhatsApp) and Google (the encrypted backups) may use servers in other countries, Zoho sends our email from its EU data centre, and Stripe handles European payments in the EU and the United States.
Cookies
We only use cookies that are needed to sign in and stay signed in (separate ones for students, staff and parents). We do not use advertising or analytics cookies.
How long we keep it
- While your child uses ChessDoer, we keep their record so they can carry on where they stopped.
- When a child leaves, we keep their record for 30 days in case they come back. After that, our system reminds us every day until we have deleted or anonymised it. A person does this by hand, so that someone checks first that nothing is still being paid or played.
- If you ask us to delete your child’s data, we do it within 30 days of your request.
- What deleting means: the child’s name, class, school, face, PIN, certificates and feedback are deleted. Their lesson and game records stay only without anything that could identify them, so our totals still add up. If no other child is linked to you, your phone number, name and consent record are deleted too, and the record of messages we sent you.
- Payment records and invoices are kept as long as tax and accounting law requires (currently up to 8 years), even after deletion. An invoice kept after deletion no longer shows the child’s name.
- Records of messages we sent (not their text) are deleted after 90 days.
- Unpaid sign-ups are not kept: an unfinished registration expires after 24 hours and is deleted 7 days later.
- Sign-in codes expire in minutes, and parent page links after 7 days.
- Security records of important actions are deleted after one year.
- Demo requests and feedback are deleted after one year.
- Backups: our nightly backups are encrypted and kept for up to 60 days, so deleted data is gone from them within 60 days.
Your rights
Under the DPDP Act, a parent (for a child) or any adult user can:
- ask what data we hold and who we shared it with;
- ask us to correct or complete it;
- ask us to delete it, or withdraw consent;
- make a complaint to our grievance officer;
- name another person to act for you if you die or cannot act.
You can switch updates off at any time on your parent page. To use any other right, message us on WhatsApp or email [email protected] from your registered phone number or email address. If you ask for a copy of your data, we send it as a file a computer can read (JSON). We reply within 7 days and act within 30 days. Withdrawing consent means your child can no longer use ChessDoer, but it does not undo what happened before.
Families in the European Union
If you live in the European Union (EU) and signed your child up with us directly, the EU General Data Protection Regulation (GDPR) also protects your data. This section explains what that adds. Everything else on this page applies to you too.
Who is responsible
Honi Arora (ChessDoer) in Jaipur, Rajasthan, India, is the “controller” of your data: we decide how it is used. Write to [email protected].
Because we are outside the EU, the GDPR (Article 27) asks us to name a representative in the EU whom you or a data protection authority can contact. Our EU representative: [to be appointed. Name and address will be added here.]
Why we may use your data (legal bases)
| What we do | Legal basis under the GDPR |
|---|---|
| Run the lessons, your child’s account and progress, your parent page and sign-in codes | Our contract with you (Article 6(1)(b)) |
| Take payment through Stripe and send receipts and payment emails | Our contract with you (Article 6(1)(b)) |
| Keep invoices and accounting records | A legal obligation (Article 6(1)(c)) |
| Send the weekly update and the monthly report | Your consent (Article 6(1)(a)). Switch them off on your parent page at any time |
| Keep accounts safe: sign-in limits, shortened IP addresses, records of important actions | Our legitimate interest in a secure service (Article 6(1)(f)) |
Children
Children never sign up by themselves. A parent or guardian registers them, confirms they are the parent or guardian, and agrees to this policy; we store when they did and which version of our notice they saw. Where we rely on consent for a child under the age set by your country (for example 14 in Italy), we ask the parent for it, as Article 8 of the GDPR requires.
We collect as little as we can about children: no photos, no email address, no location, no advertising and no profiling. We make no decisions about anyone by computer alone that have legal or similarly important effects.
Your rights
You can ask us, for yourself or for your child:
- access: a copy of the data we hold;
- rectification: to correct or complete it;
- erasure: to delete it (we keep only what the law makes us keep, such as invoices);
- restriction: to stop using it for a while, for example while we check it is correct;
- portability: your data in a file a computer can read (JSON), to keep or give to someone else;
- objection: to stop using it where we rely on our legitimate interests;
- to withdraw consent at any time. This does not affect what we did before.
Write to [email protected] from your registered email address or phone number. We answer within one month at the latest.
You can also complain to the data protection authority where you live or work. In Italy that is the Garante per la protezione dei dati personali (www.garanteprivacy.it). We would like the chance to sort it out first, but you do not have to ask us before you complain.
Data sent outside the EU
Our server is in India. The EU has not decided that India protects personal data as well as EU law does (an “adequacy decision”), so we protect your data with the measures on this page. Where a company that works for us handles EU families’ data outside the EU (for example Stripe in the United States), it does so under the European Commission’s Standard Contractual Clauses or another safeguard the GDPR allows. Ask us at [email protected] for a copy of these safeguards.
How long we keep it
The same as for everyone (see How long we keep it). Stripe keeps its own payment records as the law requires of it.
Keeping data safe
- All connections use HTTPS.
- Sensitive fields are encrypted, and passwords are stored only as secure hashes.
- School staff use two-step sign-in. Sign-in attempts are limited.
- Each school sees only its own students; each parent sees only their own children.
If a data breach happens, we will tell affected people and the Data Protection Board of India as the law requires, and, for EU families, the competent EU data protection authority within 72 hours where the GDPR requires it.
Grievance officer
If you have a concern about your data, contact our grievance officer:
- Honi Arora, Grievance Officer, ChessDoer
- Email: [email protected]
- Address: Jaipur, Rajasthan, India
We reply within 7 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Changes
If we change this policy, we will update the date at the top. If a change affects how we use your child’s data, we will tell parents first, on WhatsApp or by email.