Privacy Policy

We follow a strict policy of data minimisation. We only collect the minimal personal data required to administer the examination and maintain academic integrity.

A. Contact details provided by the Parent/Guardian (for communication and verification)

• Primary Email Address: used as the account’s sign-in ID and verification hub. It cannot be edited once registered.
• Alternate Email Address: all communication about the exam is sent to both the primary and the alternate email address.
• Primary Mobile Number: used for essential exam notifications (SMS and WhatsApp) and urgent administrative alerts.
• Alternate Mobile Number (optional): kept on record so we can reach the family if the primary number cannot be reached.
• Parent/Guardian’s Name: to record who gave consent on the candidate’s behalf.

B. Information about the Candidate/Child (for exam eligibility and security)

• Candidate’s Name: for generating admit cards (hall tickets), verifying identity and printing score certificates.
• Date of Birth: collected to verify the age eligibility criteria for the Olympiad’s class tiers.
• Gender: used only for anonymised cohort reporting — never for eligibility, ranking or any decision about the candidate.
• Class, section and school: to seat the candidate for the correct class paper, rank them within their cohort, and share results with their school.
• Exam answers, scores, rank and certificates: to evaluate the exam and issue results.

C. Identity verification and proctoring

• School ID Proof / Other ID (upload): used strictly to authenticate the participant’s identity before the exam begins.
• Registration Face Scan: the webcam captures one baseline image, from which a secure identity vector (a set of numbers, computed in the browser) is generated. The exam’s proctoring system uses this vector to confirm that the person sitting the exam is the person who registered. The baseline photo is also printed on the candidate’s score certificate.
• Live AI Proctoring: during the exam, the candidate’s webcam stream is analysed by an automated Artificial Intelligence (AI) system running in the candidate’s own browser, to detect unfair practices (for example unauthorised external assistance, looking away from the screen, or a second person in the frame). The video is not recorded or uploaded. Only when a rule is broken is a single snapshot of that moment saved with the flag, for human review.

D. Payment and security records

• Payment status and Razorpay reference numbers, to confirm the registration fee. Card, UPI and bank details are entered only on Razorpay’s own page; we never see or store them.
• Sign-in records (time, method, IP address and device/browser type, including failed attempts), to keep accounts secure and to meet our legal duty to keep security logs (CERT-In).

All data collected by the Bharat Innovation Olympiad is hosted on Amazon Web Services (AWS) servers in the AWS Asia Pacific (Hyderabad) Region, within India.

• Encryption: all data is encrypted in transit using TLS — TLS 1.3, with TLS 1.2 only for older browsers; nothing older is accepted. Data is encrypted at rest with keys managed through AWS Key Management Service (AWS KMS): ID documents, face-scan photos and proctoring snapshots are kept in private storage buckets encrypted with our own customer-managed keys, and the database is encrypted with an AWS KMS key.
• Strict Access Control: ID documents, face scans and proctoring snapshots can be opened only by authorised Olympiad reviewers through the password-protected admin portal, using short-lived signed links. Access to the underlying servers is limited on the principle of least privilege through AWS Identity and Access Management (AWS IAM).
• Service providers: messages are delivered through Amazon SES (email), WATI (WhatsApp) and SMSJust (SMS), and payments are processed by Razorpay. Each receives only what it needs to do that job.
• No Profiling or Targeted Advertising: in compliance with Section 9 of the DPDP Act, we never track, monitor, or build behavioural profiles of children for marketing purposes. This site has no third-party analytics or advertising trackers.
• No promotional or marketing material will ever be directed toward candidates.

We do not keep high-risk biometric or identity data permanently. It is deleted once its purpose is fulfilled.

• ID Proofs, Face-Scan Data and Proctoring Records: all uploaded ID documents, the registration face scan (the baseline image and identity vector), proctoring snapshots and automated AI proctoring flags are permanently and irreversibly deleted from our AWS storage within 30 days after the official examination results are published.
• The Dispute Window Exception: this retention window exists solely to allow parents to challenge an exam disqualification or file an evaluation dispute. Once this window closes, the evidence files are deleted.
• Retained Data: we retain only text-based records — such as the primary email, the candidate’s name, the exam score and the certificate number — so that you can download duplicate certificates in the future and so that a printed certificate can always be verified.
• Also retained, because the law requires it: payment records, for the period tax and accounting law requires; sign-in records and security logs, for 180 days (CERT-In), then deleted.

Under the DPDP Act, as the verified parent or guardian of the candidate, you hold complete control over the data. You have the right to:

• Access and Summary: on the Profile page, “Download my data” gives you a copy of the personal data of your child held by our system.
• Correction and Updating: to correct a mobile number, email or any profile detail, raise a Support ticket under “Privacy & your data → Correct my data”.
• Erasure and Withdrawal of Consent: you may request deletion at any time — Profile → “Request deletion”, or Support → “Privacy & your data”. Please note that withdrawing consent before the Olympiad is complete results in the immediate forfeiture of exam eligibility, as continuous identity verification is a technical prerequisite for the test.
• Nomination: you may nominate a person to exercise these rights if you die or become unable to — write to hello@lemonideas.in.

In accordance with Indian privacy regulations, this Privacy Policy functions independently from our website’s Terms & Conditions. Accepting our general terms does not imply bundled consent for tracking.

Consent to data processing is given only through explicit, individual, unticked consent checkboxes on the portal’s registration and identification forms. The parent/guardian’s authorisation for the ID-proof upload and for the registration face scan is each recorded separately, as a “Verifiable Parent consent”, with the time it was given and the exact wording agreed to.

If you have any questions, concerns or requests regarding your child’s data privacy, or if you wish to exercise your legal rights under the DPDP Act, you may directly contact our designated Grievance Officer:

• Name of Grievance Officer: Ashwin Korde
• Designation: Sr Program Coordinator, Data Protection & Grievance Officer
• Email Address: hello@lemonideas.in
• Postal Address: Lemon Ideas, Sai Shree Apartment, Mate Square, Nagpur – 22

We are committed to acknowledging your grievance within 48 hours and resolving all valid requests within the statutory timelines mandated by the Data Protection Board of India. If you are not satisfied with the resolution, you may complain to the Data Protection Board of India.

This policy is available in English; on request we will provide it in any language listed in the Eighth Schedule to the Constitution.