PRIVACY & DATA RESPONSIBILITY // POLICY OVERVIEW

verified_user DATA MINIMISATION · NO TARGETED ADVERTISING

Privacy Policy

How CodexLabs AI Private Limited and our flagship learning platform QuestSetu describes how we handle personal data for students, parents, educators, and institutions with a focus on minimisation, safety, and transparency.

Effective Date 14 September 2026

Jurisdiction Republic of India

Official Channel codexlabsaipvtltd@gmail.com

Registered Hub Ahmedabad, Gujarat

navigation Quick Section Directory

01. Corporate Scope 02. Child & Learner Privacy 03. Telemetry Collected 04. AI Inference Boundaries 05. Data Storage & Security 06. DPDP User Rights 07. Grievance Redressal

01 // LEGAL IDENTITY & PLATFORM ECOSYSTEM

Corporate Scope & Brand Architecture

This Privacy Policy applies uniformly across all digital web estates, proprietary algorithms, client dashboards, mobile interfaces, and enterprise backend environments maintained by CodexLabs AI Private Limited (based in Ahmedabad, Gujarat, India).

Parent Entity corporate_fare

CodexLabs AI

Applied artificial intelligence company building safe, useful products for learning and human capability. Domain: codexlabsai.in.

Flagship Platform school

QuestSetu

AI-powered education platform designed for learners, educators, schools, and parents. Domain: questsetu.com.

When this policy mentions "we", "us", "our", or "CodexLabs AI", it refers to CodexLabs AI Private Limited as the organization responsible for the personal data described in this policy.

02 // CHILD & LEARNER PRIVACY

Protection of Children & Student Data verified

shield_with_heart

Non-Negotiable Student Safety Charter

We recognize that children require heightened digital safeguards. QuestSetu is designed with privacy-by-default principles, age-appropriate experiences, and guardian or institutional controls where required.

block

Zero Commercial Profiling

We do not sell learner personal data or use it for targeted advertising. Product analytics, when used, should be limited to service improvement and safety.

family_restroom

Guardian & Institutional Controls

Access for younger users should be established through an appropriate guardian or authorized educational institution (in loco parentis) and the account or consent flow offered for the relevant product.

mic_off

Voice Data Handling

If voice features are used, the product notice will explain what is processed, why it is needed, and the applicable retention choices.

Commitment: heightened safeguards for children

We aim to avoid processing that could harm a child and do not use child data for targeted advertising or commercial profiling.

03 // DATA MINIMIZATION

Categories of Information We Collect

Depending on the product and account type, we may collect only the information reasonably needed to provide, secure, support, and improve the service.

badge Identity & Institutional

• Account contact details supplied by a parent, educator, or institution.
• School, grade, class, or role information where an institution provides it.
• A learner display name or identifier appropriate to the account context.

psychology Learning Telemetry

• Learning activity, progress, responses, and feature usage.
• Reading, quiz, and assessment interactions where those features are used.
• Content a user chooses to submit to interactive learning tools.

terminal Device & Diagnostics

• Application version, device type, operating system, and basic diagnostics.
• Performance and reliability information used to operate the service.
• Crash or error information used to diagnose issues.

do_not_disturb_on

Explicit Exclusions — What We Never Collect

We do not ask learners to provide Aadhaar numbers or precise GPS location as part of ordinary learning use. Any materially different data use will be explained in the relevant product notice.

04 // NEURAL PIPELINES & SAFETY

AI Inference & Pedagogical Guardrails

QuestSetu may use generative AI and retrieval systems to support learning. We use layered product controls between user input and model output:

Inference Privacy Lifecycle Pipeline

1. Model Training Immunity

We do not use learner content to train general-purpose public models unless a clear notice and appropriate consent or authorization says otherwise. External processors, if used, are evaluated for their data-handling terms.

2. Curricular Alignment Guardrails

Educational context, retrieval, moderation, and age-appropriate controls are used to reduce irrelevant or unsafe responses. AI output may still be imperfect and should be reviewed appropriately.

05 // INFRASTRUCTURE & SECURITY

Data Storage & Security Architecture

Data Storage & Security

We select hosting and service providers based on security, reliability, data-handling terms, and deployment requirements. More specific residency or institutional commitments, where applicable, will be documented for that deployment.

hub Deployment Controls REGION SELECTED BY DEPLOYMENT

MANAGED ENCRYPTION Encryption at Rest

We use technical and organizational safeguards appropriate to the sensitivity of the data we process.

SECURE TRANSPORT Encryption in Transit

We use secure transport protocols to protect information transmitted between devices and our services.

RBAC & Least Privilege Access Perimeter

Access to production information is limited to authorized personnel and reviewed according to operational need.

06 // CIVIL LIBERTIES & ACCORD

Data Principal Rights Under the DPDP Act 2023

As a Data Principal (or parent/legal guardian representing a minor), the Digital Personal Data Protection Act grants you explicit, enforceable rights regarding how your personal information is maintained:

[R.01] Right to Access Information

Ask what personal data is associated with an account and request access where applicable.

Request Export →

[R.02] Right to Correction & Rectification

Correct outdated, erroneous, or incomplete demographic and curriculum information held on QuestSetu.

Correct Data →

[R.03] Right to Erasure ('Right to be Forgotten')

Ask us to delete eligible personal data when an account or institutional use ends, subject to legal or operational retention requirements.

Purge Records →

[R.04] Right of Grievance Redressal

Raise a privacy concern with us and request review through the channels available under applicable law.

View Escalation →

07 // STATUTORY APPOINTMENT

Privacy Contact & Regulatory Redressal

For privacy questions, access or correction requests, and complaints, contact CodexLabs AI using the official channel below:

gavel

Privacy Contact CodexLabs AI Private Limited

mail Email: codexlabsaipvtltd@gmail.com

location_on Location: Ahmedabad, Gujarat, India

domain Web Estates: codexlabsai.in · questsetu.com

Response Process

REVIEW & RESPONSE

We aim to acknowledge privacy requests promptly. Resolution time varies with the request, identity verification, and applicable legal requirements. Reasonable review Applicable timelines.

Escalation Authority: Data Protection Board of India (DPBI)

You may also have the right to approach the relevant authority or use other remedies available under applicable law.

assignment_turned_in Institutional School Districts & Universities

Need a bespoke Data Processing Agreement (DPA)?

Institutions can contact us to discuss privacy questions, data-handling expectations, and available documentation for a proposed deployment.

Contact Legal Desk send Explore QuestSetu open_in_new

CodexLabs AI · PRIVACY POLICY

codexlabsai.in / questsetu.com / Privacy Policy