Privacy policy

How Goatted Guru handles personal data: what we collect, why, who else sees it, how long we keep it, and your rights. Last updated 8 October 2026.

This policy explains how Ebita Ai Private Limited ("Ebita", "we", "us"), a company registered in India, handles personal data in Goatted Guru, at goatted.guru. It is written to be read. When the product changes, this page changes with it and the date above changes too.

The short version. Goatted Guru is built for children, so a child joins only with a parent’s consent, and the parent can see, export and delete what we hold about the child. We never sell personal data and we show no advertisements. Card details go straight to PayU and never reach us. To ask about anything here, write to it@ebita.ai.

Consent comes first. A child joins only after a parent or guardian has agreed.
Never sold, no adverts. We do not sell personal data, and children are shown no advertising.
Parents see everything. Classes, answers, games and teach-backs, in the parent’s own view.
Yours to take or delete. Ask for a copy, a correction or deletion at any time.

What we collect, and why

Your account: your name or nickname, a username, a password (kept only as a salted hash), your role (student, parent, tutor or school), and an email address or phone number if you give one. We need these to sign you in and keep your account yours.
A parent and child: which parent account is linked to which child, and the record of what the parent consented to and when.
Learning activity: the classes a student joins, when they join, leave and return, the quiz questions and games they answer and whether the answers are right, how long they study alone and how far they got, and their test scores. We record these so tutors and parents can see attendance, attention and progress, and to improve our lessons.
Voice and video: in a live class, the tutor’s camera and microphone, and a student’s microphone when they ask a question or teach a lesson back. A class is recorded only where a parent has allowed recordings.
Courses you make: what you type or upload to make your own course, and the course that comes out of it.
Payments: the plan or credits you bought, the amount, the date and the payment reference PayU gives us. We do not receive or store your card number, UPI PIN or bank password.
Tutors: what you tell us when you apply to teach, and the bank or UPI details you give us for payouts.
Messages you send us, and any files you attach, so that we can help you.
Security records: sign-ins and important changes to an account, to protect it and investigate misuse.

Visitors without an account. Playing a course preview on this website needs no account and we do not ask who you are. Your browser remembers on your own device how much of each preview you have used.

What we never do

We never sell personal data, and never share it for advertising.
We never show advertisements to children.
We never use a child’s data to build a profile for marketing.

Children

A child’s learning activity is recorded only after a parent or guardian has agreed, and each kind of use (learning activity, class recordings, messages, anonymised research) is agreed to separately.
A parent can see what the child does on Goatted Guru, can export it, can delete it, and can withdraw consent at any time. Withdrawing stops recording immediately.
If a parent allows it, anonymised results (no names, phone numbers or exact identities) may be used to study which teaching methods work.

Who else sees it

Inside Goatted Guru, a student’s activity is seen by the student, their own tutor, their linked parent accounts and Goatted Guru’s administrators.

We use a small number of service providers to run Goatted Guru. Each receives only what it needs to do its job:

Hosting: runs our servers and database, and so stores everything in the service.
Live video: carries the audio and video of live classes.
Voice: turns the text of a lesson into the voice that reads it aloud. It receives the lesson’s text, nothing about you.
Speech recognition: voice follow and teach-back use the speech recognition built into your browser, which may send what the microphone hears to the browser’s maker.
AI model providers: when you make your own course or ask a question in class, what you typed or said is sent to an AI model to write the answer. We do not send them your account details.
PayU: takes payment. Your payment details go to PayU directly, under PayU’s own privacy policy.
Fonts: the app loads some typefaces from Google Fonts, which sees the request your browser makes for them.

The names of our current providers are available on request from it@ebita.ai.

The law. We disclose personal data to a public authority only when the law requires it.

Business changes. If Ebita is reorganised, merged or sold, personal data would pass to the new owner only under the same commitments as this policy.

How it is protected

Goatted Guru is served over HTTPS only.
Passwords are never stored, only a salted hash of them.
Live class audio and video travel encrypted.
Answers to quizzes and games are checked on our server and are not sent to the browser beforehand.
What each person can see is decided on our server from their sign-in and their role: a student sees their own data, a parent their own child’s, a tutor their own students’.

How long we keep it

Attendance and quiz results: while the account is active, then 12 months.
Attention and presence records: 12 months from the class, or until a parent deletes them.
Guest entries (a name only): 90 days.
Class recordings: 90 days, unless the tutor and the parent keep them.
Consent records: as long as the data they cover exists.
Payment records and invoices: for as long as tax law requires us to keep them.
Backups: deleted data can remain in our backups until those backups are removed.

What we keep in your browser

Goatted Guru keeps you signed in with a token stored in your own browser, and remembers a few preferences there (such as the reading speed and voice you chose, and how much of a course preview you have used). We do not use advertising or third-party tracking cookies. PayU’s checkout, when you open it, is PayU’s own window and may set its own cookies under PayU’s policy.

Your rights

You, or a parent for a child, can:

See what we hold about you and how it is used.
Correct or complete it.
Have it erased. We will delete the account and the personal data we hold, except what the law requires us to keep (for example, our invoices to you).
Withdraw consent where we relied on it, as easily as it was given. Withdrawing does not undo what was done before.
Nominate someone to exercise these rights for you if you die or become unable to.
Complain: to us first (below), and if you are not satisfied, to the Data Protection Board of India.

To exercise any of these, write to it@ebita.ai. We will confirm who you are before acting, and reply within 30 days.

If something goes wrong

If personal data we hold is exposed without authorisation, we will tell the people affected without undue delay, say what happened and what they can do, and notify the Data Protection Board of India and any other authority as the law requires.

Grievances

If you have a concern about how we handle personal data, write to our Grievance Officer at it@ebita.ai with "Grievance" in the subject. We will acknowledge your message within 48 hours and resolve it within 30 days.

Reporting a security problem

If you believe you have found a weakness, write to it@ebita.ai with "Security" in the subject. Please do not test against other people’s data or disrupt the service; we will work with you on anything you report in good faith.

Changes to this policy

When we change this policy we publish the new version here with a new date. If a change affects how we use your data in a way that matters, we tell you before it takes effect and, where the law requires, ask for your agreement again.