1. Overview & Our Commitment
SheraTutor ("we", "our", or "us") is committed to protecting the privacy and personal data of students, parents, and guardians across Bangladesh. This policy explains how we collect, store, process, and protect your information in accordance with the Bangladesh Personal Data Protection Act (PDPA) 2026.
2. Minor Privacy & Verifiable Guardian Consent
Most HSC and SSC students in Bangladesh are under 18 years of age. Under the PDPA 2026, collecting contact data from minors requires explicit, verifiable consent from a parent or legal guardian.
- Waitlist and early-access forms require explicit parental/guardian consent acknowledgment before contact details are recorded.
- Guardians can sign up directly on behalf of students.
- We never sell, lease, or monetize student or guardian data.
3. Information We Collect
During waitlist registration and account creation, we collect only strictly necessary data:
- Contact Information: Full name, email address, and optional Bangladeshi mobile number.
- Academic Context: Target examination (HSC/SSC), education board, and exam year.
- Verification Records: Email verification status, timestamped guardian consent record, and consent notice version.
- Exam Scripts (Active Platform): Handwritten khata photographs uploaded specifically for diagnostic AI grading.
4. How We Use Your Data
- To notify you about priority early-access availability and platform launches.
- To verify your waitlist status and prevent automated spam submissions.
- To provide rubric-aligned educational evaluations tailored to your education board.
- To continually enhance the accuracy of OCR and grading models using de-identified data.
5. Third-Party Processors & Infrastructure
We work with trusted enterprise service providers that maintain strict security standards:
- Supabase: Encrypted database and authentication hosting (Row Level Security enforced).
- Zoho (ZeptoMail / Mail): Transactional email delivery for double opt-in verification.
- Vercel: Secure global web hosting and performance analytics.
6. Your Rights under PDPA 2026
You and your legal guardian possess full rights over your personal data:
- Right of Access: Request a copy of all stored personal records.
- Right to Rectification: Update or correct inaccurate details.
- Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your waitlist or user profile.
- Right to Withdraw Consent: Revoke guardian consent at any time.
To exercise any of these rights, please contact our Data Protection Officer at support@sheratutor.tech.