Privacy Policy

1. Who this policy covers

This policy explains how SheetBerry collects, uses, and protects personal data. The account holder on SheetBerry is always an adult parent or guardian — children do not create accounts, sign in, or submit any personal information directly to us. Worksheets themselves are anonymous, stateless content with no identifying information about the child collected or required.

Because of this, India's Digital Personal Data Protection Act, 2023 provisions on verifiable parental consent for processing a child's data (Section 9) are not triggered in the way they would be for a service where children themselves register — the parent is the data subject for every account and billing record we hold. We'll revisit this statement if our service ever changes to collect data directly from or about a child.

2. What we collect

• From Google Sign-In: your name, email address, and profile picture.
• Phone number: collected at checkout, required by our payment processor (PayU) for UPI Autopay.
• Subscription & payment records: which plan you bought, billing cycle, amounts, and payment status. We do not collect or store your card number, UPI PIN, or bank credentials — those are entered directly on PayU's payment page and never pass through our servers.
• Usage data: which worksheets you view, for the purpose of showing you the right content and enforcing subscription entitlements.

3. Why we collect it

To create and manage your account, process payments and recurring subscription charges, determine which worksheets you're entitled to view, communicate with you about your subscription (including the RBI-mandated pre-debit notifications for recurring UPI charges), and respond to support requests.

4. Who we share it with

We share the minimum necessary data with PayU, our payment processor, to process your payments and recurring mandate. We do not sell your personal data to third parties or use it for targeted advertising.

5. How we store and protect it

Account and subscription data is stored in Cloudflare D1, a managed database service, behind authentication that uses signed, httpOnly session cookies. We follow reasonable security practices consistent with India's IT Act and SPDI Rules. No method of storage or transmission is 100% secure, but we take reasonable steps to protect your data.

6. Cookies

We use a single session cookie to keep you signed in. It contains only your identity (not your subscription status, which is always re-checked against our database on each request) and is not used for advertising or cross-site tracking.

7. Your rights

You can review the email/account associated with your subscription from your Account page. To request access to, correction of, or deletion of your personal data, contact us via our Contact page. We'll respond within a reasonable time, consistent with the grievance-redressal timelines described there.

8. Data retention

We retain account and subscription records for as long as your account is active, and for a reasonable period afterward as needed for legal, tax, and dispute-resolution purposes (such as records of past payments).

9. Changes to this policy

We'll update this policy as needed, including as India's Digital Personal Data Protection Act, 2023 rules come into effect (substantive provisions are scheduled to apply by 13 May 2027). We'll update the "Last updated" date above when we do.

10. Contact

Questions about this policy? See our Contact & Grievance Officer page.