Last updated: 21 May 2026
Cosmos Tutorial ("we", "our", or "us") operates a SaaS platform for tutoring institutes, including a web-based admin portal and a mobile parent application. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and how we protect it.
Role clarification: Institutes that use Cosmos Tutorial are the data controllers — they decide what student and parent data to enter into the platform. Cosmos Tutorial acts as a data processor on their behalf. By using this platform, institutes accept responsibility for obtaining appropriate consent from their students and parents.
By using Cosmos Tutorial as an administrator, teacher, or parent, you agree to this policy.
All data is stored on Supabase, a cloud database platform hosted on AWS (Asia Pacific — Mumbai region where available). Row-level security (RLS) is enforced at the database level, meaning each institute can only access its own data. No cross-institute data access is possible.
All data is encrypted at rest and in transit using TLS/SSL. Push notification tokens and web push subscriptions are stored in our database and used solely for delivering notifications to the correct device. They are never used for advertising or shared for any purpose beyond notification delivery.
File uploads (fee receipts, homework materials, institute logos) are stored in Supabase Storage with access controlled by institute-level permissions.
Every week, Cosmos Tutorial automatically generates a performance summary for each student using Google Gemini AI (a generative AI service provided by Google LLC). To produce each report, the following student data is transmitted to Google's servers:
Google processes this data to generate a written summary in English. The generated report is stored in our database and delivered to the parent via the app and WhatsApp (if enabled). No student surname, contact details, or financial data is sent to Google.
Google's use of data submitted via the Gemini API is governed by Google's API Terms of Service and their AI/ML privacy terms. Google does not use API-submitted data to train their public models.
We do not sell, rent, or share personal data for marketing purposes. Data is shared with the following service providers solely to operate the platform:
All structured data (users, students, attendance, marks, fees) and file uploads are stored on Supabase. Supabase acts as a sub-processor. Data is encrypted at rest and protected by RLS.
Parent device push tokens and notification payloads (title, body) are sent to Expo's push notification service (exp.host) to deliver alerts for attendance, test results, and weekly reports. Expo does not retain notification content.
The admin portal is hosted on Vercel. Vercel may collect basic performance metrics (page load times, Core Web Vitals) via Vercel Speed Insights. No personally identifiable information is collected by Vercel Analytics.
Limited student performance data is sent to Google's Gemini API for weekly report generation. See Section 4 for full details of what is shared.
If an institute enables WhatsApp notifications, parent phone numbers and message content (student name, attendance summary, test scores) are sent to our WhatsApp messaging provider (Interakt, powered by Meta's WhatsApp Business API) to deliver messages. Phone numbers are used only for message delivery and are not stored by Interakt beyond delivery processing.
WhatsApp messages are only sent to phone numbers that the institute has registered as parent contacts. Parents who do not wish to receive WhatsApp messages may ask their institute administrator to remove their phone number from the platform.
We use Sentry to capture application errors and crashes. Error reports may include request metadata, user role, and stack traces to help us diagnose issues. We do not intentionally include student academic data or personal details in error reports. Sentry data is retained for 90 days.
We may disclose data if required by Indian law, a valid court order, or a lawful request from a government authority.
Some institutes connect hardware biometric attendance devices (fingerprint or RFID readers) to Cosmos Tutorial. When enabled, each student is assigned a unique numeric code that is registered on the device. When a student checks in or out, the device sends the student code and timestamp to our platform via a secure webhook.
We do not store fingerprint data or biometric templates. Only the student code (a numeric ID) and the check-in/check-out timestamp are stored in our database. The biometric processing itself happens entirely on the institute's hardware device and is not transmitted to us.
Institutes are responsible for obtaining appropriate consent from students and parents before deploying biometric attendance devices.
The platform delivers notifications through three channels:
All notifications sent are logged in our database with the recipient identifier, message preview, channel, delivery status, and timestamp. These logs are retained for 90 days and are used for troubleshooting delivery failures and audit purposes only.
We retain different types of data for different periods based on their purpose:
| Data Type | Retention Period |
|---|---|
| Student academic records (marks, attendance) | While institute subscription is active; deleted 30 days after account termination |
| Fee payment records | Retained for the duration of the institute subscription (for accounting purposes) |
| AI-generated weekly reports | Retained while the student record is active; deleted with the student record |
| Parent & teacher accounts | Soft-deleted on request; hard-deleted after 30-day grace period |
| Notification delivery logs | 90 days |
| Security & rate-limit logs | 30 days |
| Sentry error reports | 90 days (Sentry's default) |
| Uploaded files (receipts, materials) | Retained while the associated record is active; deleted with the record |
When an account is deleted, data enters a 30-day soft-delete grace period during which it is hidden but not removed. After 30 days, all associated data (students, attendance, marks, fees, notifications) is permanently and irreversibly deleted. Institutes may request immediate hard deletion by contacting us.
Our primary database is hosted in the Asia Pacific region (Mumbai). However, some of our service providers operate internationally:
By using Cosmos Tutorial, you acknowledge that data may be processed outside India for the purposes described above. We ensure each provider maintains industry-standard security and encryption protections.
Our platform serves educational institutes that manage student records, which frequently include minors. We do not directly collect data from children. All student data is entered by authorised institute administrators or teachers on behalf of the institute. Parents and guardians access only their own child's records through the parent app.
Institutes are responsible for ensuring they have obtained appropriate consent from parents or guardians before entering student data into the platform, particularly for students under 18.
Fingerprint and biometric data is never transmitted to or stored by Cosmos Tutorial. See Section 6.
You have the right to:
To exercise any of these rights, email us at support@cosmostutorial.com with the subject line "Data Request". We will respond within 30 days. For complex requests we will notify you of any extension.
Note: For student data, requests must be made by the institute administrator or the parent/guardian. We cannot action individual student data requests directly — the institute, as data controller, must initiate them.
The admin web portal uses browser session cookies (managed by Supabase Auth) to maintain your login state. These cookies contain an encrypted session token and expire when you log out or when the session expires. No persistent tracking cookies are used.
The parent mobile app stores the selected student preference locally on the device using encrypted device storage (Expo SecureStore / AsyncStorage). This data never leaves the device.
We do not use third-party advertising cookies, cross-site tracking pixels, or any form of behavioural advertising technology.
In the event of a data breach that may compromise personal data, we will:
To report a suspected security vulnerability, contact us immediately at support@cosmostutorial.com.
Institutes using Cosmos Tutorial are data controllers under applicable privacy law. By using the platform, institutes agree to:
We may update this Privacy Policy from time to time as our features change or legal requirements evolve. Updates will be posted at this URL with a revised "Last updated" date. For significant changes, we will notify institute administrators via email or an in-app notice at least 7 days in advance. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.
For privacy-related questions, data requests, or to report a security concern: