Privacy Policy

This policy explains how BuoyantWave Learning Technologies LLP (“we”, “us”) handles personal data in Bodhaka Lumen, our learning management service, and on this website. Questions: support@bodhakalumen.com.

1. Who is responsible

Bodhaka Lumen is used by organisations such as schools, universities and companies (our “customers”). Each customer decides who uses its workspace and what data goes into it, and is responsible for that data as the data fiduciary (controller). We process that data on the customer’s behalf and on its instructions, as its data processor. For data collected on this website and for our own customer accounts, we are responsible.

2. What data we collect

• Account data: name, email address, sign-in name, role, organisation unit, and the password or single sign-on identity used to sign in.
• Learning data: enrolments, progress, lesson activity, answers, grades, attendance, certificates, skills and mastery estimates, and messages within courses.
• Profile and consent data: details the customer chooses to record, such as date of birth, guardian links, preferences and consent answers.
• Payment data: payment status and references from the customer’s payment provider. We do not receive or store card numbers.
• Technical data: sign-in times, IP address, device and browser details, and an audit trail of changes, used for security and support.
• Website data: when you visit this website, our hosting provider and analytics tool record pages viewed and basic device information, and the contact details you send us.

3. Data from connected services

A customer’s administrator can connect other services to their workspace. We only request the permissions each integration needs, listed in the integration guides, and we use the data only to provide that feature to that customer.

Service	Data we receive	How it is used
Zoom	Meeting ID, join link, start time, host email; after a class, each participant’s name, email, join and leave times.	Creating, moving and cancelling live classes; recording attendance.
Microsoft Teams	Meeting ID, join link, times; the signed in account’s name and email; attendance report entries (name, email, times).	Creating live classes; recording attendance; showing which account is connected.
Google Meet (Google Calendar)	Calendar event ID, Meet link, event times and guests on the classes we create.	Creating, moving and cancelling live classes on the teacher’s calendar.
Google Workspace sign-in and directory	Name, email address and Google account ID; for directory import, users and groups (names, email addresses, group membership).	Signing people in; creating and updating accounts and groups.
Stripe, Razorpay, PayPal	Payment and subscription IDs, amount, currency, status, refund status. We never receive or store full card numbers.	Granting course access when payment is confirmed; refunds; billing records.
WhatsApp through Twilio	The learner’s WhatsApp number, message ID, delivery and read status, and replies.	Sending course messages people agreed to receive and following their delivery.
Turnitin	The submitted file and the similarity score and report link.	Checking originality of submitted work for the teacher.
Qualtrics, SurveyMonkey	Survey responses linked to the learner and course.	Bringing survey answers into the learner’s record.

Credentials for connected services (keys, secrets and tokens) are encrypted with the customer’s own workspace key and are never shown again after they are saved.

4. Google user data

Bodhaka Lumen’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above (sign-in, directory import and creating live classes on Google Calendar).
• We do not sell Google user data, and we do not use or transfer it for advertising, including retargeting or personalised advertising.
• We do not use Google user data to train generalised artificial intelligence or machine learning models.
• We do not allow humans to read Google user data unless the user has agreed, it is needed for security purposes such as investigating abuse, it is needed to comply with law, or the data has been aggregated and anonymised for internal operations.
• We transfer Google user data to others only as needed to provide the feature, for security, to comply with law, or as part of a merger or acquisition with notice to users.

5. How we use data

• To provide the service the customer has asked for: running courses, assessments, live classes, analytics and communication.
• To keep the service secure, prevent misuse and keep an audit trail.
• To provide support and respond to requests.
• To meet legal obligations, such as keeping financial records.

Where a customer switches on artificial intelligence features, course content and learner questions are sent to the AI provider the customer has chosen, only to produce the answer requested. Every AI call is logged in the customer’s workspace.

6. We do not sell data

We do not sell, rent or trade personal data, and we do not use it for advertising.

7. Who we share data with

• Service providers that run the service for us: Amazon Web Services, which hosts every workspace, and Hostinger, which hosts this website and our email. They act on our instructions.
• Services the customer connects: data goes to them only because the customer’s administrator set up that integration.
• Authorities: where the law requires it.

8. Where data is stored

Customer workspaces are hosted on Amazon Web Services in the United States (N. Virginia region). Each workspace has its own separate database and its own encryption key. Data is encrypted in transit and at rest. Where data leaves India, we do so as permitted under the Digital Personal Data Protection Act, 2023.

9. Retention and deletion

• Customer data is kept for as long as the customer’s subscription is active, or until the customer or its administrator deletes it.
• When a subscription ends, the customer’s workspace, its database and its encryption key are deleted within 30 days, unless the customer asks for an export first. Deleting the key makes any remaining copy unreadable. Backups are kept for up to 14 days and are then overwritten.
• Removing an integration deletes its stored credentials straight away.
• Records the law requires us to keep, such as invoices, are kept for the period the law requires.

10. Your rights

You can ask to see, correct, export or delete your personal data, withdraw consent, or nominate someone to act for you. If you use Bodhaka Lumen through your school or employer, please ask them first, because they control your workspace; we will help them respond. You can also write to us at support@bodhakalumen.com.

11. How to disconnect and revoke access

• An administrator removes an integration in Bodhaka Lumen under Integrations, My integrations. Its stored credentials are deleted and it stops working at once.
• A teacher can disconnect their own meeting account from Live Sessions, Your meeting account.
• You can also revoke access at the service itself, for example at myaccount.google.com/permissions for Google, in the Azure portal or at myapps.microsoft.com for Microsoft, or in the Zoom App Marketplace for Zoom.
• Each integration guide gives the exact steps.

12. Children’s data and parental consent

Bodhaka Lumen may be used by schools for learners under 18. We do not collect data directly from children for our own purposes, and we do not track children’s behaviour or show them targeted advertising. The customer is responsible for obtaining verifiable consent from a parent or lawful guardian before a child’s data is processed. Bodhaka Lumen supports this: who counts as a minor follows the customer’s regional settings, and a minor’s consents and optional preferences are answered by their parent or guardian, not by the child. A parent or guardian can ask the school, or us, to see or delete a child’s data.

13. Cookies

Bodhaka Lumen uses only the cookies and browser storage needed to keep you signed in and remember your settings. This website uses analytics cookies to understand how it is used.

14. Security

We use separate databases and encryption keys per customer, encryption in transit and at rest, access controls, monitoring and an audit trail. To report a security issue, see Support.

15. Grievance Officer (India)

In line with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, you can contact our Grievance Officer about the handling of your personal data:

We will acknowledge your grievance within 48 hours and resolve it within one month. If you are not satisfied, you may approach the Data Protection Board of India.

16. Changes

We will post any change to this policy here with a new effective date, and tell customers of significant changes in advance.