Privacy Policy
How BrightXR collects, uses, shares, keeps and deletes personal data across the BrightXR Learning Platform app and brightxr.in.
1. Who we are
BrightXR is operated by BRIGHTXR PRIVATE LIMITED, a company incorporated in India with its office in Mohali, Punjab ("BrightXR", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here.
This policy covers:
- the BrightXR Learning Platform app for Android;
- our website brightxr.in, including the student and parent dashboards;
- the BrightXR Training Program, campus assessments and event certificates we run.
The app and the website share one account system. An account created on one works on the other.
2. Information we collect
Account information (students and parents)
A student account is always created together with a linked parent or guardian account. At registration we collect:
- Student: name, email address, password, school name, school board and class (Class 1 to 12).
- Parent or guardian: name, email address and, optionally, mobile number.
Each account is given a BXR ID (for example BXR-2026-001), which can be used to sign in. Parent accounts store which student accounts they are linked to.
Authentication information
Sign-in is handled by Firebase Authentication (Google). It stores your email address, a securely hashed form of your password, a unique user ID and sign-in timestamps. We do not offer sign-in with Google, Facebook or other social accounts. When you sign in on the website we set a secure session cookie (see Cookies and local storage).
Learning and profile information
While you use the app and dashboards, the following is stored with your account:
- lessons completed, learning progress by subject and chapter, and the last lesson or scene you opened;
- quiz and assessment attempts and their results, and a rank score;
- learning streak, time spent learning each day and month, last active time and whether you are online;
- a profile picture, if you add one;
- support tickets you send from the app;
- subscription plan, status and expiry date.
Device and technical information
When the app or website connects to our servers and to Firebase, those systems receive standard technical information such as your IP address, device or browser type, operating system and app or browser version. This is used to deliver the service, keep it secure and investigate errors. Our website host keeps request logs containing this information for a limited period.
Website analytics
Our website uses Google Analytics 4 to understand how visitors use it: pages viewed, how you arrived, approximate location derived from your IP address, device and browser type, and session duration. Google Analytics uses cookies to do this. We use this data in aggregate to improve the website.
Payments
Payments are processed by Razorpay. You enter card, UPI or bank details on Razorpay's checkout, not on our systems, and we never receive them. We receive and store the plan or program purchased, the amount, currency, payment status, dates, any promo code used, and Razorpay payment and order IDs. For Training Program payments we also store the billing email address and GST breakdown.
Training Program applicants and participants
If you apply to the BrightXR Training Program we collect your name, email, phone number, college, course, year of study, city, chosen track and the motivation you write. We record the IP address and browser information at the time you submit, as a record of your consent. If you are accepted we also keep your attendance and payment status for the program.
Campus assessments and certificates
- Campus recruitment tests: name, email, roll number, date of birth, your answers, score, start and submit times, browser information and test-integrity events such as switching tabs.
- Event certificates: your name, institution, event and certificate number. Each certificate has a QR code linking to a verification page that shows these details to anyone who has the link.
Messages you send us
When you use our contact form we receive your name, email, optional phone number and organisation, and your message. These are delivered to our inbox by email and are not stored in our database.
3. Firebase services we use
Our backend runs on Google Firebase. We use:
- Firebase Authentication for accounts and sign-in;
- Cloud Firestore to store account, learning, subscription, training and payment records;
- Cloud Storage for Firebase to store uploaded files such as images and training materials;
- Cloud Functions for Firebase to create new student and parent accounts (run in Google's Mumbai region).
Access to Firestore is controlled by security rules. Students can read their own records and linked parents can read their child's records. Payment, subscription and administrative data can only be written by our servers.
4. How we use information
- to create and secure your account and let you sign in on the app and website;
- to deliver lessons, track progress, streaks and assessments, and show them on your dashboard;
- to let linked parents follow their child's progress;
- to process payments, activate subscriptions and keep financial records;
- to run the Training Program, campus assessments and certificates;
- to send service emails such as login details, receipts, program updates and replies to your messages;
- to understand website usage and improve our services;
- to prevent abuse, investigate errors and meet legal obligations.
7. How long we keep information
- Account, profile and learning data: for as long as your account exists, until you delete it or ask us to.
- Payment records: for the period required by Indian tax and accounting laws, including after account deletion.
- Training Program applications and records: until you ask us to delete them, so we can run the program and handle future cohorts.
- Campus test attempts and certificates: until you ask us to delete them, so results and certificates can be verified.
- Emails you send us: in our inbox until we no longer need them to help you.
- Website analytics: for the retention period set in our Google Analytics account.
- Server request logs: kept by our hosting provider for a limited period.
- Account deletion requests: after a request is closed we keep only its dates, outcome, BXR ID and a masked email address, as proof it was handled.
8. Deleting your account and data
You can ask us to delete your BrightXR account and its data at any time, without signing in, at brightxr.in/delete-account.
- Enter your account email or BXR ID. We email a confirmation link to the account's registered address.
- Open the link, review the account, and confirm.
- We complete the deletion within 7 days of your confirmation and email you when it is done.
Deletion removes your sign-in account, profile, learning progress and activity, assessment attempts, subscription status, parent and student links, Training Program records and support tickets. Payment records are kept as described in section 7. Parents can choose to include linked student accounts in the same request.
To delete data that is not tied to an account, such as a campus test attempt, a certificate or a contact form message, email info@brightxr.in.
9. Security
We protect your data with measures including:
- HTTPS encryption for all traffic to our website and backend;
- passwords stored only as secure hashes by Firebase Authentication;
- Firestore security rules that limit who can read and write each record;
- HttpOnly, SameSite=Strict session cookies and cross-site request checks on the website;
- rate limits on website sign-in and form endpoints;
- admin tools restricted to authorised BrightXR staff.
When a student account is created, the student's and parent's login details are sent to their email addresses. That email asks parents to change their temporary password after first sign-in, and we recommend students change theirs too. No system is perfectly secure; if you think your account has been misused, contact us straight away.
10. Children and student data
The BrightXR Learning Platform is built for school students from Class 1 to Class 12, so many of our users are under 18. We handle their data with this in mind:
- registration requires a parent or guardian's name and email, and creates a linked parent account at the same time;
- the parent receives their own login and can see the student's profile and learning progress;
- we collect only what is needed to provide the learning service, as listed in section 2;
- we do not sell student data or use it for advertising;
- a parent or guardian can delete their child's account through our deletion page or by emailing us.
If you believe a child has registered without a parent or guardian's knowledge, contact us and we will take appropriate action, including deleting the account.
11. Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- access a summary of the personal data we process about you and how we process it;
- correct inaccurate or incomplete data and update it;
- erase your data, subject to legal retention requirements (see section 8);
- withdraw consent at any time, as easily as you gave it;
- nominate another person to exercise these rights if you die or become incapacitated;
- raise a grievance with our Grievance Officer, and then with the Data Protection Board of India.
To use any of these rights, email info@brightxr.in from the address on your account, or use the account deletion page for erasure. We may need to verify your identity first. We respond within the timelines set by applicable law.
12. Contact and Grievance Officer
Grievance Officer: Nirmal Singh, Founder & CEO
Company: BRIGHTXR PRIVATE LIMITED
Email: info@brightxr.in
Address: Mohali, Punjab, India
We aim to acknowledge grievances within 24 hours and resolve them within 30 days. You can also reach us through our Contact page.
13. Changes to this policy
We will update this policy when our data practices change. The effective date at the top shows when it last changed. For significant changes we will also tell account holders by email before they take effect.