ReScholar

Privacy Policy

Last updated: 13 October 2026 · Effective: 13 October 2026

Important: This policy follows India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025). Under the Rules' phased rollout, the core obligations, covering notice, consent, children's data, data-principal rights and breach reporting, become fully enforceable from 13 May 2027; ReScholar applies these standards now rather than waiting. As a formal legal document, it should still be reviewed by a qualified Indian data-protection lawyer before it is relied upon.

This Privacy Policy explains how AruMyra Deep Tech (“ReScholar”, “we”, “us”, or “our”), which operates the website and services at rescholar.net (the “Platform”), collects, uses, stores, shares, and protects your personal data, and the rights you have over it. By creating an account or using the Platform, you confirm you have read and understood this policy.

For the purposes of the DPDP Act, ReScholar is the Data Fiduciary that determines the purpose and means of processing your personal data, and you (the user) are the Data Principal.

Contents 1. What data we collect 2. Why we process it, and our legal basis 3. Consent and how to withdraw it 4. Who we share data with (processors & third parties) 5. Where your data is stored and cross-border transfer 6. How long we keep your data 7. Your rights as a Data Principal 8. Children's data 9. How we protect your data 10. Data breach notification 11. Cookies and local storage 12. Grievance Officer & how to contact us 13. Changes to this policy

1. What data we collect

We collect only the data we need to run the Platform. This falls into the following categories:

Category	Examples
Account data	Your name, email address, password (if you use email sign-in) or the identifier from your Google sign-in, your chosen profile handle, biography, avatar, and links you add.
Identity verification	Your ORCID iD, if you choose to verify your researcher identity.
Content you create	The documents, papers, books, drafts, comments, ratings and other content you write, upload, or publish, and any cover images or figures you add.
Payment data	When you buy a plan or credits, our payment processor (Razorpay) handles your card/UPI details. We do not see or store your full card number. We store a record of the transaction (amount, currency, payment ID, date) and your invoice.
Usage & technical data	Your approximate country (from your network, to show the correct currency), the works you view or buy, likes, follows, reading list, and basic logs needed for security and to prevent abuse.
Preferences	Your chosen theme, notification settings, and any custom instructions you save for the AI assistant.

We do not intentionally collect sensitive personal data such as your religion, caste, health, or biometric information, and we ask you not to put such information into your profile or public content unless you choose to.

2. Why we process it, and our legal basis

We process your personal data only for the following specific purposes, each with a lawful basis under the DPDP Act:

Purpose	Legal basis
To create and operate your account	Consent / performance of our service to you
To let you write, compare, publish and sell your work, and to assign a permanent citable ID with a proof-of-priority record	Consent / performance of our service
To process payments, issue invoices, and pay author royalties	Performance of our service; compliance with tax/accounting law
To provide AI-assisted writing, review and narration features	Consent
To verify your identity via ORCID (optional)	Consent
To send you service emails (receipts, verification, notifications you opted into)	Consent / performance of our service
To keep the Platform secure, prevent fraud and abuse, and enforce our Terms	Legitimate use permitted under the Act
To meet legal obligations (e.g. retaining financial records)	Compliance with law

We will not use your personal data for any new purpose without first telling you and, where required, obtaining your consent.

Where we rely on consent, we ask for it through a clear, affirmative action (for example, ticking an unticked box when you sign up). Our consent requests are specific, informed, and never bundled with unrelated purposes, and we do not use pre-ticked boxes or deceptive design.

Before or at the time we ask for consent, we give you a plain-language notice (as required by Rule 3 of the DPDP Rules) that stands on its own and states: the personal data we will collect, the specific purpose for each use, how you can withdraw your consent, how you can exercise your rights, and how you can complain to the Data Protection Board of India. This notice is available in English and we will make it available in other languages listed in the Eighth Schedule to the Indian Constitution where required.

You can withdraw your consent at any time, as easily as you gave it, for example by changing your settings, turning off a feature, or deleting your account. Withdrawing consent will stop the related future processing but does not affect processing that already lawfully happened, and some features may stop working as a result. Where you withdraw consent and we have no other lawful basis to keep the data, we will erase it, and we will ask our processors to do the same.

We do not sell your personal data. We share it only with service providers (“Data Processors”) who help us run the Platform, strictly for the purposes above and under contractual safeguards:

Provider	What it does
Google Firebase (Google LLC)	Secure user authentication (sign-in) and our database and hosting infrastructure.
Google Cloud / Vertex AI (Gemini)	Powers the AI writing, review and assistance features. Content you send to the AI is processed to generate a response.
Razorpay	Processes payments and subscriptions securely. They handle your card/UPI data under their own privacy policy and PCI-DSS compliance.
Resend	Sends transactional emails such as receipts and verification links.
ORCID	Only if you choose to verify, we read your public ORCID record to confirm a verification code you place there.
OpenTimestamps / Bitcoin network	Only a cryptographic hash (a one-way fingerprint) of your published work is anchored for proof-of-priority. Your actual content is never sent, the hash cannot be reversed into your text.

We may also disclose personal data where we are legally required to (for example, a lawful order from a court or authority).

5. Where your data is stored and cross-border transfer

Our infrastructure is hosted on Google Cloud. We primarily use the Mumbai, India (asia-south1) region. Some of our service providers (such as Google and Razorpay) may process limited data on servers outside India. Where personal data is transferred outside India, it is done in accordance with the DPDP Act and any restrictions notified by the Central Government. By using the Platform you consent to such transfers for the purposes described above.

6. How long we keep your data

We keep your personal data only as long as needed for the purpose it was collected, or as required by law:

Account & profile data, for as long as your account is active. If you delete your account, we erase it (see Section 7).
Published works, because publication creates a permanent citable record with a proof-of-priority timestamp, published works and their version history remain on the public record unless you make them private or delete your account. Deleting your account removes your private works and personal records.
Payment & invoice records, retained for the period required by Indian tax and accounting law, after which they are deleted. When you delete your account, these records are anonymised (personal identifiers removed) rather than deleted, to the extent we are legally required to keep them.
Security & traffic logs, retained for at least one year, as required by the DPDP Rules, then deleted, unless a longer period is needed to investigate or respond to an incident or is required by law.

When the purpose for holding your data is served and no legal obligation requires us to keep it, we erase it. The DPDP Rules require certain very large platforms (broadly, those with at least two crore registered users in India) to erase a user's data after three years of inactivity; ReScholar is below that threshold, but we voluntarily follow the same principle, and if we ever approach it we will give you at least 48 hours' notice before any such erasure.

7. Your rights as a Data Principal

Under the DPDP Act, you have the following rights, which you can exercise free of charge:

Right to access, obtain a summary of the personal data we hold about you and how we process it. You can download your data at any time from Profile → Edit profile → Privacy & your data → Download my data.
Right to correction & updating, correct or update inaccurate or incomplete data, directly in your profile settings.
Right to erasure, delete your account and personal data at any time from Profile → Edit profile → Privacy & your data → Delete my account. We action erasure requests promptly, and in any case within the timeframe required by law.
Right to grievance redressal, raise a complaint with our Grievance Officer (Section 12). We aim to resolve grievances as quickly as possible, and in any event within the maximum period allowed by the DPDP Rules, which is 90 days.
Right of nomination, nominate another person to exercise your rights on your behalf in the event of your death or incapacity. To nominate, contact our Grievance Officer.
Right to withdraw consent, at any time, as described in Section 3.

If you are not satisfied with how we handle your request, you may complain to the Data Protection Board of India.

8. Children's data

ReScholar is intended for users aged 18 and over, and our Terms require you to confirm you are 18+ when you create an account. A “child” under the DPDP Act is a person under 18.

We do not knowingly process a child's personal data without the verifiable consent of a parent or lawful guardian, and we never carry out tracking, behavioural monitoring, profiling, or targeted advertising directed at children. If, in future, we offer any feature to under-18 users, we will first obtain verifiable parental consent, confirming that the parent is an identifiable adult using details we already hold or a Government-authorised service such as DigiLocker, as contemplated by the DPDP Rules. If we learn that we have collected a child's data without the required consent, we will stop processing it and delete it.

9. How we protect your data

We apply the reasonable security safeguards required by Rule 6 of the DPDP Rules, including:

Encryption and access control, data is protected in transit (HTTPS) and access is restricted, so only you or an authorised administrator (where strictly necessary) can reach your private data;
A secure server boundary, all database access is routed through our server; the browser never touches the database directly, and sign-in is handled by Google Firebase;
Payment isolation, card and UPI data are handled only by our PCI-DSS-compliant payment processor, never by us;
Logging and monitoring, we keep security and access logs (retained for at least one year) to detect, investigate and respond to incidents, with backups to enable recovery;
Input sanitisation, rate limiting and abuse prevention, to guard against injection and automated attacks;
Processor safeguards, our service providers are bound by contract to apply appropriate security measures, and we remain responsible for your data.

No system is perfectly secure, but we work continuously to protect your data and to detect and respond to any incident.

10. Data breach notification

If a personal data breach occurs, we follow the notification process in Rule 7 of the DPDP Rules:

Affected users, we notify you without delay, through your account or your registered contact details, in plain language, describing the nature and extent of the breach, its likely consequences for you, the measures we are taking, what you can do to protect yourself, and how to contact us.
Data Protection Board of India, we give the Board an initial intimation without delay, followed by a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows), covering the facts and circumstances, mitigation steps, and the notifications made to affected users.
CERT-In, where the incident is also a reportable cyber-security incident, we report it to CERT-In within 6 hours, as required under the Information Technology Act, 2000 and the CERT-In Directions, 2022.

11. Cookies and local storage

ReScholar uses your browser's local storage and similar technologies for essential functions only: to keep you signed in, remember your theme and preferences, and keep your current workspace so you don't lose work. We do not use third-party advertising or cross-site tracking cookies. You can clear this storage at any time through your browser settings, though some features will reset.

12. Grievance Officer & how to contact us

In accordance with the DPDP Act, we have designated a Grievance Officer to address your questions, concerns, and requests about your personal data:

Grievance Officer	Vridhyuman Vinson Vaelrick
Email	grievance@rescholar.net
Postal address	G Block, Preet Vihar, New Delhi, India
Response time	We acknowledge complaints promptly and work to resolve them as quickly as possible, within the maximum of 90 days set by the DPDP Rules.

For general privacy questions you can also email privacy@rescholar.net.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Platform after a change takes effect means you accept the updated policy.