Data Protection · DPDP Act 2023
Security & Privacy of Data at Not a Bot Game Lab
At a glance
- We collect only a student’s name and class/section — plus, if the school provides them, a roll number and the school name. Nothing more.
- We use it for one purpose: to run learning games and show teachers how their students are doing.
- We do not collect birth dates, phone numbers, email, home addresses, ID numbers, or biometric identity data, and we never record or store photos or video.
- We never sell student data, show ads to children, or profile them.
- Students never log in or type any personal information — a child simply taps their name from their class list.
Who we are, and our role
Not a Bot Game Lab is operated by Byond Real, a registered partnership firm at 67 Raja Garden, 2nd Floor, New Delhi – 110015 (GSTIN 07ABCFB7812Q1Z2).
Under the DPDP Act, your school is the Data Fiduciary — it decides to use Game Lab and holds the relationship with parents. We act as the school’s Data Processor: we process student data only on the school’s instructions, under a written agreement with the school.
What we collect
| Data | Purpose |
|---|---|
| Student name | Identify the child in their teacher’s performance report |
| Class / section | Group students; scope reports to the right teacher |
| Roll number (optional, if provided) | Match to the school’s own records |
| School name | Organise data by school |
| Gameplay performance (score, pass/fail, time taken, which game & level, date) | Show teachers how students are progressing |
| Device & technical data | Keep games working and fast: a device-ID cookie, plus technical reports such as load times and errors. |
That is the complete list.
What we deliberately do not collect
About the camera. Several of our games use the device camera for movement-based play — turning your arms like clock hands, or nodding to answer — so children interact from a distance instead of tapping. It senses movement on the device only: no facial recognition, and no image or video is recorded, stored, or sent.
About cookies. Teachers stay signed in with a session cookie, and a device-ID cookie keeps a device’s game scores together. No advertising cookies or tracking pixels.
How data gets in
Schools, sections, teachers, and the student roster are created and managed by school staff and our team directly in the Game Lab web application, which stores them in the Game Lab database. Children never register themselves and never enter personal details — in a game, a child taps their name from their class’s list.
How we use it
Only to (1) run the learning games and (2) give each teacher a performance report for their own class. We may show section- or class-level averages to the school. We do not build behavioural profiles of children, target advertising, or make automated decisions about any child.
Consent
In almost all cases, using Game Lab is covered by your school’s existing parental consent for digital learning tools — no separate, per-vendor approval is needed. Under the DPDP Act the school (as Data Fiduciary) holds that parental consent, and we process student data under our agreement with the school. Parents do not need to approve Byond Real separately by name.
For schools: if you’d like, we can provide a short Data Processing Addendum and a ready-to-use line you can add to your existing consent notice. Email team@notabot.ai.
Where your data is stored, and how it’s secured
- Encrypted in transit (HTTPS/TLS) everywhere.
- Stored in a managed PostgreSQL database on Amazon Web Services (AWS), currently in AWS’s United States (N. Virginia) region, over CA-pinned encrypted connections.
- Access is controlled: teachers sign in with email and password and see only their own sections (secure, revocable session cookies); students have no data access; one Not a Bot admin account exists for support.
- We do not log request contents (which would contain names), by design.
Who else touches the data (sub-processors)
| Service | Why | Student data? |
|---|---|---|
| Amazon Web Services (US) | Hosts the database | Yes — this is the store |
| Deno Deploy | Runs the application | Processes requests |
| Sentry (US) | Error monitoring | No student names sent |
We do not share student data with advertisers, data brokers, analytics networks, AI/LLM services, or payment providers.
Cross-border storage
Student data is currently stored on AWS servers in the United States. The DPDP Act permits transfer to countries not specifically restricted by the Government of India, and the data is encrypted and access-controlled throughout. Schools that require India-based storage can contact us to discuss.
Retention & deletion
We keep student data only while providing Game Lab to your school. We delete or anonymise it (a) on request from the school, and (b) when our engagement ends. To request deletion or ask a data question, email team@notabot.ai — we action requests within 30 days.
Rights & grievances (DPDP Act)
Parents/guardians may request access to, correction of, or deletion of their child’s data through their school (the Data Fiduciary), which can reach us at team@notabot.ai. Our data-protection contact for schools and stakeholders is team@notabot.ai.
A note on children’s data
We treat all Game Lab data as children’s data and hold it to a higher bar: minimal collection, no behavioural advertising, no profiling, no sale. Performance tracking exists for one reason — to help the child learn and inform their teacher.