Privacy Policy | Suraasa

Applies to: The Suraasa app, websites, and all Suraasa products and services for individual users

Last updated: 30th July, 2026

Effective date: 1st September, 2026

1. Who we are and what this Policy covers

This Privacy Policy ("Policy") explains how Suraasa collects, uses, shares, retains and protects personal data when you use the Suraasa app, our websites (including suraasa.com and related domains), and our products and services for individual users (together, the "Platform").

In this Policy, "Suraasa," "we," "us," and "our" mean Les Transformations Learning Private Limited, a company incorporated in India (CIN U74999HR2015PTC056448) with its registered office at Noida, India, which provides the Suraasa app and is the controller of your personal data, together with its affiliates that help operate and deliver the Platform.

This Policy applies to all Suraasa products and services offered to individual users, including the Teach with Suraasa app, our professional development courses and qualifications, assessments (such as CPAT), our AI tools for teachers, the Suraasa jobs marketplace, community features, and related websites and services, under any brand (including Suraasa and Suraasa Sure).

One global policy. This is a single, global Policy that applies to every user of the Suraasa app, wherever you are located. The same data-use rules apply to all users. Where the law of your country gives you additional or stronger rights, those rights are preserved and we honour them (Section 14).

Our role — Suraasa is the data controller. For the Suraasa app and its features used by individual users, Suraasa is the data controller (and, under India's DPDP Act, the Data Fiduciary): we determine the purposes and means of processing your personal data, and we are accountable for that processing under applicable law. (This is different from our institutional/B2B services, where a school or employer may be the controller and Suraasa acts as a processor on its instructions — see Section 4.)

Ownership of data. You keep the rights you have in your personal data under applicable data-protection law (Section 14); personal data is not "owned" by anyone in a way that removes those rights, and we hold and process it as controller. All other data and content is owned as set out in our Terms of Use — in particular, where you use the app and features (including our AI tools) free of charge, Suraasa owns the content and the outputs generated, other than your personal data, and licenses those outputs back to you so you can use what you create. De-Identified Data and Aggregated Data are owned by Suraasa (Section 9).

2. The personal data we collect

We collect the following categories of personal data, depending on which parts of the Platform you use:

(a) Account and profile data — name, email address, phone number, password, profile photo, country, preferred language, job title/role, subjects taught, employer or institution, and your account and licence/subscription status.

(b) Professional and jobs-marketplace data — your qualifications, experience, CV/résumé, video profile, interview and placement information, and other details you choose to add to showcase yourself to schools and employers.

(c) Learning and assessment data — course enrolments, attendance, progress and completions, assignments and submissions, quiz/exam/survey responses, instructor and mentor feedback, certificates, and your responses to and reports from assessments such as CPAT.

(d) AI tool data — the inputs you provide to our AI tools (for example, grade, subject, topic, or text you enter) and the outputs the tools generate for you (for example, lesson plans, assignments, rubrics, quizzes, handouts, and summaries).

(e) Audio-derived content (where a feature uses audio). Where a feature lets you record a class or session, the audio is processed transiently by a third-party AI provider and is not stored by Suraasa (see Section 8). We receive and retain only the resulting transcript and outputs, from which personally identifiable information has been redacted — we do not receive the raw audio and do not create voiceprints.

(f) Identity-verification data — where verification is required (for example, for certain qualifications), your name, address, date of birth, a webcam headshot, and a photo ID document (the ID document is deleted after successful verification), handled via a third-party verification provider; and, if you apply for financial aid, the information you provide for that purpose.

(g) Payment and transaction data — products purchased, order history, and billing details. Card and bank details are collected and processed by our third-party payment processors or by the app stores (Apple/Google), not by Suraasa.

(h) Community and communications data — content you post in community/forum features (which may be public), messages and chats, support and sales interactions, survey and feedback responses, and your communication preferences.

(i) Usage, device and technical data — IP address, device and browser type, operating system, device identifiers, app version, pages and features used, time spent, clickstream, referring/exit pages, approximate location derived from IP, timestamps, diagnostics, crash data, and cookies and similar technologies (Section 10).

(j) Data from third parties — data from third-party sign-in/identity providers you choose to use (for example, Google or LinkedIn profile data), from payment processors, from partners and resellers, and from a school, employer, or other organisation that provisions your access (Section 4).

We do not seek to collect special categories of data except as strictly necessary for a feature and with any consent required by law.

3. How we collect personal data

We collect personal data:

(a) directly from you (when you register, purchase, use features, build your profile, contact us, or participate in the community);
(b) automatically through your use of the Platform (usage, device and cookie data); and
(c) from third parties (sign-in/identity providers, payment processors, partners, and organisations that provision your access).

4. If you access Suraasa through your school, employer, or another organisation

Some Suraasa features are made available to schools, institutions, governments, and companies under an institution or company licence (for example, when a school enrols its teachers, or an employer sponsors your access).

If you access or use any Suraasa feature through such an institution or company licence:

the agreement between Suraasa and your organisation (the "Institutional Agreement," which may include a master services agreement and a data processing agreement) also applies to you and governs that use, and supplements or supersedes this Policy to the extent of any conflict for that use;
your organisation (or its administrator) may control and administer your account — including provisioning it, accessing account and usage information, configuring settings, restricting features, and suspending, deactivating, or deleting the account and associated data — in accordance with the Institutional Agreement;
for personal data we process on your organisation's behalf and on its instructions, your organisation (not you) is the controller, and you should direct privacy questions and rights requests to your organisation; and
this Policy continues to apply to your individual use of the Suraasa app outside the scope of the Institutional Agreement (for example, a personal account or personal purchases).

If you are unsure whether your access is provided through an organisation, contact your administrator or [email protected].

5. Student and other third-party data you choose to provide

The Suraasa app is for educators and other adult professionals. If, in using the Platform, you choose to input or record information about students or other individuals (for example, by recording a class, or entering student information into an AI tool), you are responsible for providing all notices and obtaining all consents required by law and by your institution's policies before doing so, and for using the Platform in compliance with applicable law. Where you do this under an institution licence, the Institutional Agreement (Section 4) governs that data. We process such information only to provide the relevant feature to you (or your institution), do not use it to build student profiles, and apply the protections in Sections 8 and 12.

6. How we use your personal data

Our commitment. At the heart of everything we do is a simple commitment: we use the information we collect to provide the Platform, improve your experience, and build better products and services for you. Teaching is demanding, and our purpose is to make the time you spend with Suraasa more useful, more personal, and more rewarding. In practice this means we study how educators use the Platform so we can make it faster, clearer, and easier to use; we tailor content, recommendations, coaching, learning pathways, and job matches to your goals and context; we identify where features fall short and fix and refine them; and we design, test, and launch new tools and offerings that respond to the real needs of the educators we serve. We also use information to keep the Platform reliable, secure, and trustworthy, to provide responsive support, and to understand at an aggregate level what is working so improvements benefit the whole community. Wherever we can achieve these goals using information that does not identify you — such as aggregated insights and de-identified data — we do so.

The specific purposes for which we process personal data are to:

provide, operate, and maintain the Platform, your account, and the features you use;
personalise your experience — content, recommendations, learning pathways, coaching, and job matches;
process transactions, manage subscriptions, qualifications, and licences, and provide receipts;
generate the reports, assessments (e.g., CPAT reports), AI outputs, and certificates you request;
communicate with you, including service, security, transactional, and administrative messages;
provide support and respond to your questions, feedback, and requests;
analyse usage and conduct research, statistical analysis, and benchmarking to understand and improve the Platform;
maintain and improve the Platform, debug and fix problems, and ensure quality, reliability, and security;
develop new products, features, services, and offerings (including using De-Identified Data and Aggregated Data as described in Section 9);
send marketing about our products and services, and measure and improve our campaigns, where you have consented or as otherwise permitted by law (you can opt out at any time — Section 7);
keep the Platform safe — detect, prevent, and address fraud, abuse, security incidents, and violations of our terms;
comply with law and establish, exercise, or defend legal claims; and
carry out corporate transactions (such as a merger, acquisition, financing, or sale of assets) and related due diligence.

Legal bases. Where the law requires us to identify a legal basis (for example, under India's Digital Personal Data Protection Act, 2023, or the EU/UK GDPR), we rely on one or more of: performance of our contract with you (to provide the Platform and your account); your consent (for marketing, non-essential cookies, and certain optional features); our legitimate interests (to operate, secure, analyse, improve, and develop the Platform and grow our business, balanced against your rights); and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time (Section 14).

Automated decisions. Where a feature makes an assessment about you using automated processing (for example, an assessment score or recommendation), it is intended to support — not replace — human judgement. Where applicable law gives you the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, you may request human review by contacting [email protected].

7. Marketing communications

With your consent where required, we may send you communications about our products, courses, offers, events, and content, and show you relevant advertising. You can opt out of marketing at any time using the unsubscribe link in our emails or your account preferences. We will still send you non-promotional service, security, and transactional messages. We do not direct marketing or advertising at children.

8. Artificial intelligence

Some Suraasa features use artificial intelligence — for example, to generate lesson plans, assignments, rubrics, quizzes, handouts, and summaries, to transcribe and analyse audio you choose to record, and to provide recommendations.

We do not train third-party foundation AI models on your content. We do not permit our third-party AI providers to use your inputs or outputs to train their own or any generalised AI models.
Zero-retention processing. Where a feature sends your content (including any audio) to a third-party AI provider, we engage that provider under a contract that requires zero data retention — the provider stores neither the input nor the output and uses the data only to return a result. Audio is not stored by Suraasa; we receive only a transcript and outputs from which personally identifiable information has been redacted, and we do not create voiceprints.
PII redaction. Where audio or text is processed, personally identifiable information of third parties (such as students) is redacted as part of generating the transcript and outputs.
Please don't input sensitive data. You should not enter personal, sensitive, or confidential information about identifiable individuals into AI features beyond what the feature requires.
Improving our own Platform. We may use information about how AI features are used, and De-Identified Data and Aggregated Data (Section 9), to operate, evaluate, and improve our own Platform and develop new features.
AI outputs may be imperfect. AI outputs can contain errors and should be reviewed by you before you rely on or share them, especially before classroom use.

A current list of our AI sub-processors and evidence of these commitments is available to institutional customers on reasonable request.

9. De-Identified and Aggregated Data

"De-Identified Data" means data from which all direct and indirect identifiers have been removed and which has been aggregated or generalised such that no individual, customer, institution, child, or student is reasonably identifiable (taking into account other information reasonably available and the risk of re-identification). "Aggregated Data" means data summarised across users so that no individual is identifiable.

De-Identified Data and Aggregated Data are not personal data and are not subject to this Policy. Suraasa owns all De-Identified Data and Aggregated Data, and to the maximum extent permitted by law may use, retain, reproduce, analyse, disclose, and commercialise it for any lawful purpose and without time limit, including to operate, improve, benchmark, research, develop, train, and market our current and future products, services, models, and offerings. We commit not to attempt to re-identify De-Identified Data, and we require our service providers to make the same commitment.

10. Cookies and similar technologies

We and our partners use cookies, SDKs, pixels, local storage, and similar technologies to operate the Platform, remember your preferences, analyse usage, personalise content and advertising, and improve our Services. You can manage non-essential cookies through our cookie controls or your browser/device settings; where required, we obtain consent for non-essential cookies. Some features may not work properly without certain cookies.

We share personal data with:

(a) service providers and sub-processors that process data on our behalf under contracts requiring confidentiality and security (hosting, storage, analytics, communications, payments, identity verification, support, and AI/transcription providers);
(b) instructors, mentors, and content providers delivering a course or assessment you take;
(c) schools and employers you apply to or engage with through the jobs marketplace;
(d) your organisation's administrators, where your access is provisioned by an organisation (Section 4);
(e) our affiliates, for the purposes in this Policy;
(f) partners and resellers, for provisioning, support, and co-marketing;
(g) professional advisers and authorities (auditors, lawyers, insurers, regulators, and law-enforcement or government bodies) where required by law or to protect rights, safety, and the integrity of the Platform;
(h) parties to a corporate transaction (acquirers, investors, and their advisers), subject to confidentiality; and
(i) others with your direction or consent.

We do not sell the personal data of children, and we do not sell personal data in the conventional sense. Where "sale" or "sharing" is defined broadly under certain laws (such as some U.S. state laws), you may exercise the choices described in Section 14. De-Identified Data and Aggregated Data are not subject to these sharing restrictions because they identify no individual.

12. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or for as long as another applicable law specifically requires — for example, for the life of your account and your relationship with us; as needed to provide the Services, resolve disputes, and enforce our agreements; and as required for legal, tax, accounting, regulatory, and audit obligations. Identity-verification ID documents are deleted after successful verification.

When personal data is no longer needed and no legal retention obligation applies — including upon valid withdrawal of consent or closure of your account — we erase or de-identify it within a reasonable period (residual copies may persist briefly in secure backups). De-Identified Data and Aggregated Data may be retained and used indefinitely. Suraasa does not store raw classroom/session audio at all (it is processed transiently by a zero-retention provider).

13. Security

We take reasonable, industry-standard administrative, technical, and physical measures designed to protect personal data, including access controls, encryption in transit and at rest where appropriate, secure transmission, logging, and contractual security obligations on our service providers. However, no method of transmission or storage is ever completely secure, and we cannot guarantee absolute security. To the maximum extent permitted by law, we are not responsible for unauthorised access to, loss of, or disclosure of data caused by events or actors beyond our reasonable control — such as criminal cyber-attacks, the acts of third parties, or your own failure to keep your credentials and devices secure; our liability for security incidents is addressed in Section 13 of the Terms of Use. Please keep your account credentials confidential and notify us at [email protected] of any suspected unauthorised use. (Where a breach of your personal data occurs, we will act in accordance with our obligations under applicable data-protection law, including any notification duties.)

14. Your rights and choices

Depending on the laws of your country (for example, India's DPDP Act, the EU/UK GDPR, the UAE PDPL, or U.S. state privacy laws), you may have some or all of the following rights, which we honour:

access the personal data we hold about you and information about how we process it;
correct, complete, or update inaccurate or incomplete data;
delete / erase your data;
port your data to another provider;
restrict or object to certain processing, including objecting to direct marketing and to processing based on legitimate interests;
withdraw consent at any time, as easily as you gave it (this does not affect processing already carried out);
opt out of the "sale" or "sharing" of personal data and of certain targeted advertising/profiling, where applicable;
not be subject to a decision based solely on automated processing with legal or similarly significant effects (you may request human review); and
nominate another person to exercise your rights on your death or incapacity (where local law provides this), and complain to your data-protection or consumer authority.

You can exercise many of these directly in your account settings, and otherwise by contacting [email protected] or our Grievance Officer (Section 19). You can manage marketing, AI, and cookie preferences as described in Sections 7, 8, and 10. We will respond within the timelines required by applicable law, may need to verify your identity, and will not discriminate against you for exercising your rights. Nothing in this Policy removes any mandatory right you have under the law of your country of residence. Where your access is provisioned by an organisation (Section 4), please direct rights requests to that organisation.

15. International data transfers

Suraasa is headquartered in India and operates globally. Your personal data may be transferred to, and processed and stored in, India and other countries where we or our service providers operate, including countries whose data-protection laws differ from those where you live. Where we transfer personal data across borders, we use the appropriate safeguards required by applicable law (for example, Standard Contractual Clauses and the UK Addendum/IDTA for transfers from the EEA/UK). For users outside India, this means your data may be transferred to and processed in India. To request details of the safeguards we use, contact [email protected].

16. Children

The Suraasa app is intended for adult education professionals and is not directed to children. We do not knowingly collect personal data directly from children. Where a teacher or institution uses Suraasa in connection with students, the teacher/institution is responsible for any required notices and consents (Sections 4 and 5), and any student education-record data is governed by the separate Institutional/Schools Agreement. Where we knowingly process a child's personal data and the law requires it (for example, under India's DPDP Act), we obtain verifiable parental or guardian consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

17. Third-party links and services

The Platform may link to or integrate with third-party websites and services we do not control. This Policy does not apply to them; please review their own privacy notices.

18. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will provide notice as required by law — for example, by posting the updated Policy with a new "Last updated" date and, where appropriate, notifying you by email or in-app. No change to processing that requires your consent takes effect for you until you give that consent. Your continued use of the Platform after an update takes effect constitutes acknowledgement of the updated Policy, except where consent is required.

19. How to contact us; Grievance Officer

For any questions, requests, or concerns about this Policy or your personal data, contact us at [email protected].

Grievance Officer / Data Protection Contact: Sudhin Biswas, Les Transformations Learning Private Limited, Noida, India. We will acknowledge and respond to grievances within the period required by applicable law. If you are in India, after exhausting our grievance mechanism you may complain to the Data Protection Board of India. If you are elsewhere, you may also have the right to complain to your local data-protection or consumer authority.