Privacy policy

Who we are

SOYL Academy is provided by SOYL AI Private Limited (“SOYL”, “we”, “us”). For anything about privacy, including requests and complaints, write to outreach@soyl.cloud. Our grievance officer is Ryan Gomez.

Schools and tutors choose to use SOYL Academy for their pupils. A school or tutor decides which pupils use it and what work they are set, and records or requests the parents’ permission. SOYL runs the service for them and handles the data as this policy describes. A school may also have its own privacy notice for parents.

What we collect, and why

We collect only what the service needs. Each table says what we keep and what it is for.

From everyone: when you use the website or app, our servers handle your internet (IP) address and browser or app details to answer the request. We use the IP address briefly, in memory, to limit repeated sign-in attempts; we do not store it with your account. See Logs and error monitoring.

We do not collect pupils’ email addresses or phone numbers, photos of pupils, precise location, contacts, advertising identifiers or anything from the camera. The microphone is used only when a teacher chooses to speak their notes (see AI processing); pupils’ microphones are never used. The Android app asks only for internet access.

Parents’ permission comes first

A pupil’s data is used only with the permission of a parent or lawful guardian, and a pupil cannot use SOYL Academy until that permission is recorded. Permission is recorded in one of two ways:

• The parent confirms with a secure link. The school or tutor enters the parent’s email address; we email the parent a personal link (valid for 7 days). The parent reads what we keep, proves the email is theirs with a 6-digit code (valid for 10 minutes) and chooses yes or no. Tutors must always use this method. Schools may.
• The school records the parent’s permission. Many schools collect permission on their own forms. A school administrator then records in SOYL Academy that the parent gave permission, naming the guardian and where the evidence is kept (for example “Signed form on file, 2026–27”). In this case the school, not SOYL, collects and holds the parent’s decision.

There are two separate permissions:

• Using SOYL Academy (required): without it the pupil cannot get a sign-in code or be given work, and our database refuses the sign-in even if something else goes wrong.
• AI features (optional): AI hints and AI summaries. Without it, the pupil gets the teacher’s own hints and nothing is sent to the AI about their work.

A parent who confirmed by link can withdraw at any time with the link in the confirmation email. Otherwise ask the school or tutor, or write to outreach@soyl.cloud. Withdrawing permission to use SOYL Academy also withdraws AI permission and signs the pupil out of every device at once, and the Android app removes any of their work saved on the phone.

AI processing

Some features use AI models from Microsoft’s Azure OpenAI service, through Azure AI Foundry. Our AI resource is in India, but the models are deployed globally, so a request may be processed in a Microsoft data centre outside India. What is sent:

• Drafting assignments (teachers): the teacher’s notes, the text of uploaded files and, for photos or scanned pages, the images, with the grade, subject and learning outcome. Teachers must not put pupils’ personal details in their materials. If a teacher speaks their notes instead of typing, the recording is sent to the AI to be turned into text and is then deleted; we never store it, and only the text the teacher keeps is saved.
• AI hints (pupils, only with AI permission and only when the teacher turned AI hints on): each time a pupil asks for the next hint on a question, the grade, the question and its choices, the answer reference for that question (the correct choice or value, or the teacher’s marking guidance for a written answer), up to the pupil’s last 6 attempts at that question, the help already shown on it (up to 6 earlier hints) and the teacher’s own hint for that step. Pupils do not type messages to the AI: asking is a button. The answer reference is there so the hint can point at the pupil’s mistake; the pupil never receives it, and every hint is checked automatically before it is shown so that it does not give the answer away. The reply also says, privately, whether the pupil’s answers suggest they may be unsafe or in distress (see “Wellbeing check-ins” above); Microsoft’s content filter can do the same when it blocks a request.
• AI summaries (teachers, only with AI permission): the questions, the expected answers or marking guidance, and the pupil’s answers, attempts and hints, each under a random reference number.
• Visuals and search (teachers): the teacher’s description of a diagram or search words.

No names, email addresses or other identifying details of pupils or parents are sent to the AI. Pupils’ answers can contain whatever a pupil chooses to write, and are sent as written. Every request is made with storage turned off (store=false), which asks Microsoft not to keep the response for later retrieval. Microsoft states that it does not use this data to train its models; under Microsoft’s standard terms it may keep requests for a limited time to detect abuse.

AI only suggests. Teachers review and approve every AI-drafted assignment before pupils see it, AI hints are checked so they do not give away answers, and AI never decides a pupil’s mark.

Who sees the data, and who helps us run the service

• At the school or tutor: teachers see the pupils in the classes they teach; school administrators see their school’s pupils and records. Wellbeing check-ins are seen only by the teachers of the pupil’s class and the school’s administrators. Schools never see another school’s data.
• Parents: a parent whose email the school or tutor recorded can see their own child’s assignments, hand-in status and dates, and the teacher’s feedback. Never other pupils, answers or marks.
• SOYL staff: only to run, support and secure the service. Our administration console shows school details, staff names and emails and totals, never pupils’ names or work.
• Pupils see only their own work. There is no way for pupils to see each other’s work or to message anyone.

We use these service providers, who process data only on our instructions:

• Microsoft Azure: hosting, the database, file storage and malware scanning of uploads (Microsoft Defender for Storage); staff sign-in (Microsoft Entra External ID, which emails staff their sign-in codes); email to parents and staff invitation emails (Azure Communication Services); AI (Azure OpenAI via Azure AI Foundry); and error monitoring and logs (Azure Application Insights and Log Analytics).
• PhET Interactive Simulations (University of Colorado Boulder): when a teacher includes a PhET simulation, the pupil’s browser or app loads it from phet.colorado.edu, so PhET receives the usual technical details of that request (such as the IP address). We send PhET no personal data. PhET’s own privacy policy applies to its website.
• Read-aloud uses the speech engine already on the pupil’s phone or in their browser. We prefer voices that work on the device; on some devices the speech engine may use the internet.

We do not sell personal data, show advertising, or use advertising or analytics trackers. We share data with others only as described here, or when the law requires it (for example a valid order from a court or authority).

Where the data is kept

• The database, uploaded files and logs are kept on Microsoft Azure in the Central India region.
• Backups of the database are kept for 14 days, with a copy in Azure’s paired region in India.
• Email to parents is sent through Azure Communication Services with its stored data located in India. Emails travel to your own email provider.
• AI requests may be processed outside India (see AI processing).

Cookies and storage on your device

We use only cookies and storage that the service needs to work. There are no advertising or analytics cookies.

The parent permission page sets no cookies. The Android app keeps a pupil’s work in an encrypted store on the phone, with the key in the phone’s secure key storage, and wipes it when the pupil signs out or permission is withdrawn. The app has no advertising, analytics or crash-reporting software from other companies, and phone backups of its data are turned off.

Logs and error monitoring

• Our servers log each request’s route, result, timing and a request number. Logs never contain answers, teachers’ notes, AI prompts or replies, sign-in codes or links.
• We use Azure Application Insights to find and fix errors. It records technical details of requests and errors (such as the page or route, the error type and timings), not the content of anyone’s work, and not names or email addresses. When something breaks in the website or app, it can send us a short error report with personal details removed.
• Logs are kept for up to 180 days. Azure’s own infrastructure logs (for example file storage access) can include IP addresses.

How long we keep data

When a pupil’s data is erased, we delete their work, devices, guardians and parent sign-ins. We keep only what we must to show that the law was followed: the consent history with the guardian’s details removed, a record that the erasure happened, and audit entries that contain ids only. Erased data disappears from backups as they expire (within 14 days).

Your rights, and how to use them

Under the DPDP Act you (or a parent or guardian on behalf of a child) can:

• Get a summary or a copy of the personal data held and how it is used (a school can download a copy of everything SOYL Academy holds about a pupil: their work, activity events, help steps and any help they reported, permission and email records, and their parents’ sign-ins. Wellbeing check-ins are left out unless the school decides to include them after a safeguarding review);
• Correct or update it (for example a misspelt name or a new email address);
• Have it erased when it is no longer needed or permission is withdrawn;
• Withdraw permission at any time, as easily as it was given;
• Nominate someone to use these rights for you if you die or cannot act yourself;
• Complain to us, and then to the Data Protection Board of India if you are not satisfied with our answer.

The quickest way is usually to ask your child’s school or tutor: they can export, correct and erase data in SOYL Academy straight away. You can also write to outreach@soyl.cloud. We will check that the request comes from you (for example by replying to the email address on record) and answer as soon as we can, within the time the law requires.

Keeping children safe

• No public profiles, no chat or messages between users, and no way for pupils to see each other’s work.
• Pupils sign in with a one-time code from their teacher: no email address, phone number or password.
• Teachers approve all content before pupils see it, including anything AI drafted.
• No advertising, no in-app purchases for pupils, and no links to social media.
• Signing out of a shared computer or phone removes the pupil’s saved work from it.
• If something a pupil writes suggests they may be unsafe or in distress, their teachers see their words privately (a wellbeing check-in); if it is about harming themselves, the pupil is also shown where to get help. These automatic checks will miss things: they support, and never replace, the school’s own safeguarding.

Security

Data is encrypted in transit, and at rest on our servers and in the Android app. Work saved in a web browser is not encrypted, so it is deleted when the pupil signs out. Each school’s data is separated inside the database itself, not only by the app. Sign-in codes, device credentials, parent links and sessions are stored only as one-way hashes. School staff join only by invitation from their school. If a personal data breach happens, we will tell the affected schools, tutors and parents and the Data Protection Board as the law requires.

Changes to this policy

The version and effective date are at the top of this page. If we make an important change, we will tell schools and tutors before it takes effect and, where the law requires, ask parents for permission again.

Contact and complaints

SOYL AI Private Limited. Email: outreach@soyl.cloud. Grievance officer: Ryan Gomez.

See also our terms of use.