Privacy Policy

Effective: May 5, 2026 Last updated: May 5, 2026 Status: DRAFT — pending legal review

WhatIfMind is operated by Level Innovations Private Limited, an Indian company with its registered office in Hyderabad, Telangana. This document describes what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have over it. We have written this policy to be read, not skipped. If anything in it is unclear, write to us at hello@whatifmind.com.

1. Who this policy applies to

This policy applies to:

• Parents and guardians who interact with our website at whatifmind.com, book a demo, or enrol a child in the WhatIfMind program.
• Children aged 6 to 15 enrolled in the program. Children's data is processed only with verifiable parental consent and is subject to the additional protections described in Section 7.

References in this policy to "you" mean the parent or guardian. References to "we", "us", and "our" mean Level Innovations Private Limited operating under the WhatIfMind brand.

2. What we collect

From parents and guardians

When you book a demo or enrol your child, we ask you to provide:

• Your full name
• Your email address
• Your phone number, including any WhatsApp number
• Your time zone
• Your child's name
• Your child's age
• How you heard about WhatIfMind (optional)

When you enrol in a paid program, we additionally collect payment information through Razorpay, our payment processor. We do not store your full card or banking details on our systems; Razorpay handles this and is itself regulated under Indian payment-system law.

From children, during sessions

When your child attends a live session on Zoom, the session captures:

• Their voice (microphone audio)
• Their video (camera, where turned on)
• Anything they type in the session chat
• Their participation pattern (whether they spoke, what they responded to)

These are inherent to the nature of a live online session and are not optional within the program itself.

Session recordings

We record live sessions for internal quality and audit purposes only.

• Recordings are stored on the Zoom cloud, within Zoom's infrastructure and subject to Zoom's own security practices.
• Recordings are retained for 90 days from the session date, after which they are deleted in the ordinary course.
• Access to recordings is restricted to authorised internal staff at Level Innovations on a need-to-know basis. Recordings are never shared with anyone outside our internal team — not with other parents, not with children other than those in the recorded cohort, and not in any public forum.
• Recordings are never used for marketing, advertising, social media, or any external communication. We commit to this in this policy and we will not change it without obtaining new consent from every affected parent.
• We obtain your specific consent for session recording at the time of booking, separately from your acceptance of this policy or our Terms of Service. You may withdraw consent for recording at any time by writing to us; on withdrawal, your child cannot continue to participate in live sessions, since recording is integral to our quality-assurance processes.

Information we do not currently collect

We do not currently use:

• Cookies for advertising or behavioural targeting
• Analytics services such as Google Analytics, Mixpanel, or similar
• Pixel tracking such as the Meta Pixel
• Any third-party tools that profile or track children for marketing purposes

If we add analytics or measurement tools in the future, we will update this policy and notify enrolled parents by email before they go live. We will not introduce advertising or behavioural-targeting tools without first obtaining new explicit consent.

3. Why we collect it

We process the personal information described above for the following purposes:

• To provide the program. Scheduling, conducting, and reviewing live sessions; assigning your child to an age-appropriate cohort; and giving trainers the context they need to teach well.
• To communicate with you. The weekly parent note after each session, transactional emails (booking confirmations, reminders, payment receipts), and program announcements.
• To process payments, through Razorpay.
• To improve the program. Internal review of session recordings helps us train new trainers, evaluate teaching quality, and refine our content.
• To respond to questions and address complaints. Including, in the rare event of a dispute, reviewing session recordings to understand what occurred.
• To comply with our legal obligations under Indian law, including the Digital Personal Data Protection Act 2023 and applicable taxation, accounting, and consumer-protection laws.

We do not process your personal information for any purpose materially different from those above without first informing you and, where required, obtaining fresh consent.

4. Lawful basis for processing

Under the Digital Personal Data Protection Act 2023 (DPDP Act), we rely on the following lawful bases for processing personal information:

• Your consent, freely given at the time of booking and enrolment, for the collection and processing of personal information described in this policy.
• Performance of contract — the contract formed between you and Level Innovations when you enrol your child in the program. Some processing is necessary to deliver the service you have paid for.
• Legal obligation — for tax, accounting, and regulatory record-keeping requirements.

You may withdraw your consent at any time by writing to hello@whatifmind.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal but may affect our ability to continue providing the service.

5. Who we share it with

We share personal information with the third-party service providers listed below, each of whom is contractually obligated to protect the information they receive and to use it only for the purposes for which we share it:

• Cal.com (booking platform). Receives the parent and child information you provide on the booking form. Cal.com is a US- and EU-based service.
• Zoom (live session platform and recording storage). Receives session video, audio, chat, and participant identifiers. Zoom is a US-based service.
• Razorpay (payment processing). Receives payment information for the purposes of processing transactions. Razorpay is an Indian company regulated by the Reserve Bank of India.
• Vercel (website hosting). Receives standard server log information when you visit whatifmind.com.
• Hostinger (email infrastructure). Receives the contents of emails sent to and from @whatifmind.com addresses.

We do not sell, rent, or trade your personal information. We do not share it with advertisers or data brokers. We do not share it with any party other than those listed above and any successors-in-interest in the event of a corporate restructuring (in which case affected parents will be notified).

We may disclose personal information when required by law, court order, or lawful regulatory request, and in such cases will inform you unless legally prohibited from doing so.

6. Where it is stored

Most of our service providers store data on servers located outside India, including in the United States and the European Union. By using our service, you acknowledge that your personal information may be transferred to and processed in jurisdictions outside India, where data-protection laws may differ from those of India.

We take reasonable steps to ensure that international transfers occur only to providers that maintain adequate protection of personal information, consistent with the standards required by the DPDP Act.

7. Children's data — additional protections

Children under 18 are entitled to additional protections under the DPDP Act and under our own internal practices. The following apply specifically to children's data:

• We process children's data only with the verifiable consent of a parent or legal guardian.
• We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children. Ever.
• We do not profile children for any purpose other than internal cohort assignment by age band.
• We do not share children's likenesses (voice, video, image) externally for any reason — not with other parents, not in marketing material, not on social media. The only people who can see or hear a child during a session are the trainer, the co-facilitator (where applicable), and other children in the same cohort.
• Session recordings are accessible only to internal Level Innovations staff and are deleted after 90 days.
• A parent may at any time request deletion of all of their child's data by writing to hello@whatifmind.com.
• We do not knowingly collect personal information from children directly without parental involvement. If a child contacts us directly, we will not respond substantively until a parent has been brought into the communication.

8. Your rights

Under the DPDP Act, as a data principal you have the following rights with respect to personal information about you and your child:

• The right to access a summary of the personal information we hold about you and your child, the purposes for which it is being processed, and the categories of third parties with whom it has been shared.
• The right to correction of inaccurate or incomplete information.
• The right to erasure of your personal information, subject to limited legal exceptions (such as records we are required to retain for tax purposes).
• The right to withdraw consent at any time, including consent for session recording. Withdrawal of consent for essential processing may affect our ability to continue providing the service.
• The right to grievance redressal — you may raise complaints with us directly; if unresolved, you may approach the Data Protection Board of India.
• The right to nominate another individual to exercise your rights on your behalf in the event of incapacity or death.

To exercise any of these rights, write to hello@whatifmind.com with the details of your request. We will respond within thirty days.

9. Data security

We use commercially reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. These include access controls, encryption in transit, and contractual safeguards with our service providers.

No system is perfectly secure. In the event of a personal data breach that is likely to materially affect your interests, we will notify you and the Data Protection Board of India in accordance with the requirements of the DPDP Act.

10. Retention

We retain personal information for the following periods:

• Active enrolment information: for the duration of enrolment, and up to 24 months after enrolment ends, for accounting and dispute-resolution purposes.
• Session recordings: 90 days from the session date.
• Payment records: as required by Indian taxation law (currently, eight years from the end of the relevant financial year).
• Demo bookings that did not convert to enrolment: 12 months from the booking date.
• Email and WhatsApp communications: 24 months from the date of the communication, unless required for ongoing service or legal reasons.

11. Grievance officer

If you have a concern about how we handle personal information that is not resolved through ordinary support channels, you may contact our designated grievance officer:

• Name: [TO BE FILLED — usually the founder or a designated individual]
• Email: privacy@whatifmind.com (or hello@whatifmind.com if no separate alias is yet active)
• Postal address: [TO BE FILLED — registered office address of Level Innovations Private Limited]

You may also approach the Data Protection Board of India, established under the DPDP Act, if your concern remains unresolved.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify enrolled parents by email at least 14 days before the changes take effect, and we will update the "Effective" date at the top of this document. Continued use of the service after the effective date of an update constitutes acceptance of the updated policy.

13. Contact

For any question about this policy or about your personal information:

Level Innovations Private Limited [Registered office address — TO BE FILLED] hello@whatifmind.com