Privacy policy

Version 2026-10-3 · Effective 2026-10-13 · Draft: lawyer review pending

Who we are

CRATOR is supplied by {{BUSINESS_NAME}}, owned by {{OWNER_NAME}}, at {{POSTAL_ADDRESS}}. Our website is https://crator.eleway.in. Contact {{SUPPORT_EMAIL}} or {{PHONE_WHATSAPP}}. This draft notice covers the planned licensed CRATOR release, its licensing service and this website. App licensing, daily statistics and acceptance recording must be completed and checked before that release is published. It also explains the separate, optional connection to Google.

Your sheets and results stay with you

Scanned sheets, student names, answers, marks, results and templates stay on the customer's PC during normal sheet processing. These features do not upload their contents to CRATOR's servers. Reading bubbles, offline handwriting, review, evaluation and creating reports take place locally. The current app does not upload local logs or run records. The planned statistics collector will use separate counters rather than read those files.

When you choose Google's AI reader, images cut from the selected handwriting areas go directly from your PC to Google using your own API key, the credential Google uses to authorise requests. The separate contact-reading command also sends the template's contact area to Google. These images may contain student information, including names or phone numbers. They do not pass through CRATOR's servers. Exporting or sharing results yourself is also your decision. A folder you place in a cloud-synchronised location is subject to that provider's rules.

What leaves the PC, when and why

The licence key itself is sent over an encrypted HTTPS connection. The planned app first converts the computer's built-in identity code, system-disk identifier, Windows installation identifier where available, and motherboard identifier into hashes. Raw serial numbers are not part of its intended requests. An installation ID is a random code for this copy of CRATOR. These codes can be linked to a customer's licence, so they are not anonymous. The app's collection and transmission must be checked before release.

The app records the Terms and Privacy versions, acceptance time, installation ID and institution name when you start the free demo or activate a key. The server links this record to the licence and PC to show which agreement was accepted.

Daily usage statistics

Daily usage statistics are compulsory for the demo and cannot be switched off. The demo's activation screen will state this before activation. The statistics contain no student data. They use only a random installation ID, not a licence key or hardware identifier. The server can link that ID to your licence, so it is not anonymous. If your school does not want these statistics, contact us at {{SUPPORT_EMAIL}} or {{PHONE_WHATSAPP}} to ask for a short trial without the demo. A lawyer must review whether compulsory demo statistics allow valid consent before launch.

The server accepts only the listed report fields. The planned app will fill them with counts and technical labels, without sheet content. The groups are:

The server rejects unknown report fields and checks the length and format of text. These checks cannot recognise all personal information inside an allowed field. The planned app must supply only the stated technical information; that collection is still awaiting implementation and review. The current app does not upload logs or crash reports.

What we never request through CRATOR

The planned app will exclude scanned images, student names, phone numbers written on sheets, recognised handwriting, answers, marks, result rows, raw hardware serials, file or folder paths, template names or contents, PC names and Windows user names from licensing requests and usage reports. This exclusion must be checked in the app before release. Optional Google reading sends the selected image areas and reading details to Google directly, as described above.

Please do not put student information, keys or API credentials in a support email. The app and offline activation page are for adults representing institutions. We do not ask for sample student sheets or remote access under this notice. If you voluntarily send personal data in correspondence, tell the grievance officer so we can restrict access and arrange deletion. That is outside the app's normal data flow; a future support service involving student data would need a separate agreement and notice.

Website traffic, cookies and browser storage

Our pages set no cookies and show no advertising. Our fonts are served from this site. The only outside script is Cloudflare Web Analytics, which we use to count page visits; Cloudflare says it uses no cookies or local storage and does not fingerprint visitors. Cloudflare, which hosts the site, may set a strictly necessary security cookie only if one of its security checks (for example a challenge page) runs. The website saves your chosen dark or light theme in local storage when available. This is only a display preference; the pages also work when storage is unavailable. The offline activation page uses JavaScript. Our form code keeps details only in memory while the page is open and does not save them in browser storage. It asks the browser not to save form entries. Your browser or password manager may still retain information under your own settings. The browser may cache public website files and retain ordinary history or downloads.

Cloudflare receives IP addresses and request information to deliver and secure the website and API. Our licensing service uses the connecting IP address briefly to limit abuse, then stores only a one-way hash made with a private secret in an abuse counter. The counter expires within two days of its latest use and expired counters are removed by daily cleanup. It does not add the raw IP address to its abuse counters or usage reports. The hash may still identify repeated requests. Cloudflare and GitHub may process network data under their own policies; we cannot promise that hosting providers never see or retain IP addresses.

The offline link carries activation data in the URL fragment, which is not sent in the initial page request. The page removes it from the visible address/history entry after reading, shows only the key's last five characters, and sends the activation data only after your button press. The original link or QR code is sensitive: do not share it publicly. The downloaded CRATOR.licence contains the signed permission and belongs on the intended PC.

Purposes, legal grounds and our roles in India

The school or institution decides why and how student data is used on its own PC. It is the Data Fiduciary, meaning the organisation responsible for those decisions, for that student data under the Digital Personal Data Protection Act, 2023, when the relevant provisions apply. Supplying locally running software does not give us that student data: CRATOR does not process it on its servers. The institution must arrange its lawful basis, parent notices and consent where required, appropriate access, retention and backups.

For customer contacts, licence records, terms acceptances and linked technical information, {{BUSINESS_NAME}} determines the purposes and is the Data Fiduciary, responsible for deciding how that information is used, when those provisions apply. Cloudflare is the planned provider of our hosting and database services. An administrative copy in Google Sheets, if enabled, will hold licence, customer and usage exports with restricted staff access. The export excludes stored licence keys and template-protection keys. Staff must keep student information and keys out of its notes and correspondence. Disclosures to authorities take place only where legally required. We do not sell this information or use it for targeted advertising.

The DPDP Act and Rules 2025 have phased commencement. The principal customer-facing processing duties are scheduled about May 2027, following the November 2025 notifications; we will check the applicable commencement notifications before launch and update this notice if needed. Until then, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply where relevant. We do not claim that ordinary contact details are automatically sensitive personal data under those Rules.

We will provide the required separate, clear notice and consent controls as the DPDP duties take effect. This policy does not itself turn browsing, silence or a pre-ticked box into consent. We do not rely on a general European-style “legitimate interests” basis under DPDP.

Children

Normal sheet processing does not send children's sheet data to CRATOR's servers. The planned statistics collector must preserve that boundary before release. Free-demo activation is for school staff and adult representatives. Do not enter a child's contact details in the school name or send their work to support. The institution remains responsible for applicable children's-data duties, including verifiable parental consent where required. Before optional AI is used on a child's handwriting, the institution must decide whether that transfer is lawful and permitted by Google's terms. If a child's data is sent to us in correspondence, contact {{GRIEVANCE_EMAIL}} for removal.

Optional Google AI: a separate decision

We recommend a billing-enabled paid Google API key for any handwriting that contains student data. Google's unpaid services may use submitted content to develop products and permit human review; their terms instruct users not to submit personal, confidential or sensitive information to unpaid services. A paid key is not a promise of zero retention: Google still processes data for service security and legal purposes and may process it outside India. Review Google's Gemini API terms and the applicable data-processing terms before choosing the feature.

You control the key and pay Google directly. CRATOR's licensing servers do not receive your Google key or crops. Staff must review AI output before using it. Leave the AI reader unused to keep handwriting reading local.

Storage, international transfers and retention

The website and licensing service are built for Cloudflare hosting and database services; deployment is still pending. Cloudflare's distributed infrastructure may process data outside India. We do not promise an India-only database location. A restricted administrative copy in Google Sheets, if enabled, is also subject to Google's international processing. Google AI and GitHub update traffic are separate external connections. We will respect applicable Indian transfer restrictions as they take effect and use appropriate provider contracts and access controls.

The proposed customer/enquiry periods require an owner-operated deletion process before sale; they are not automatic database expiry today. We will explain any lawful retention exception when responding to an erasure request. The hosting provider controls its backup and operating-record deletion schedules; this draft does not promise an unverified backup deletion time. Local files on your PC follow your own retention choices.

When the relevant DPDP duties start, Rules 6 and 8 include one-year retention duties for security/processing records. We must check how those duties apply to the two-day abuse-counter cleanup before they start, and publish any changed period. The two-day period above describes the current rate-limit database, not a promise to override future law.

Security

Production connections use HTTPS. The server digitally signs licence permissions to let the app detect changes or forgery. Signature checking and hashing of PC identifiers in the launch app are still pending. The server looks up keys using a hash made with a private secret and encrypts recoverable key copies. Abuse counters also use hashes made with that secret. In production, the administrative service requires Cloudflare Access sign-in and checks proof of that sign-in; deployment and access settings must be checked before launch. Reports have a fixed list of fields, size limits and format checks.

We limit disclosures and access to the stated purposes and keep records of administrative actions. No security measure guarantees complete protection. Protect the PC account, USB licence files, backups, keys and exported reports. This is not a claim that all local result files are encrypted. When legally required, we will notify affected people and the relevant authority of a personal-data breach. Once the relevant DPDP duty applies, we must notify the Data Protection Board without delay and submit a detailed report within 72 hours, unless a lawful extension applies.

Your choices and rights

In the planned launch app, paid users can turn usage statistics off in Settings → Privacy and data. This does not turn off activation, licence release, a silent licence refresh when online, demo accounting or chosen update checks. Paid licences do not need periodic renewal. Demo statistics are compulsory, with notice before activation; ask us for a short trial without the demo if your school does not want them. The planned launch app's “See exactly what CRATOR sends” viewer will show the queued daily report. Do not confuse statistics with optional AI: choose the offline reader separately.

Write to {{GRIEVANCE_EMAIL}} to ask what customer/licensing information we hold, correct it, request deletion, withdraw consent or raise a complaint. Include your institution and a contact address; use only the last five key characters initially. We will verify your authority with proportionate information, not student scans. If withdrawing required licensing consent makes the service impossible, we will explain the consequence and any remaining lawful retention. Local student data must be requested from the school; we cannot retrieve it from your PC.

Once the relevant DPDP provisions apply, sections 11–14 let you ask about the information held about you, correct or delete it, raise a complaint, and nominate someone to exercise your rights if you die or become unable to act. You may complain to the Data Protection Board after using the required grievance route. These are statutory rights when in force; we accept correction and deletion requests now under applicable law and this notice. We will explain any refusal and your available remedy.

Grievance officer and response times

The SPDI Rules 2011, rule 5(9), require grievances to be addressed within one month of receipt. We acknowledge complaints within 48 hours and resolve them within one month; the acknowledgement and resolution timings also meet the Consumer Protection (E-Commerce) Rules 2020 when applicable. These are calendar periods, not working-day extensions. The DPDP Rules require a published grievance period no longer than 90 days once applicable; our stated one-month period is shorter. Ordinary support replies are targeted within one to two working days during {{SUPPORT_HOURS}}.

Changes and contact

We publish the version and effective date with this notice. Material new processing will receive a clear notice and fresh consent where required before it begins. We will not silently expand statistics to include sheet content. For questions use {{SUPPORT_EMAIL}}; for rights or complaints use {{GRIEVANCE_EMAIL}}. Our postal address is {{POSTAL_ADDRESS}}.