Root LabRoot Lab

Privacy Policy & Cookie Notice

Effective Date: 24 March 2026 | Website: https://root-labs.net/

Part 1 — Privacy Policy

1. Who We Are

Root Labs ("we", "us", or "our") is a technology and educational platform operated from India. We are committed to protecting and respecting your privacy in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Data Fiduciary Contact:

2. What Personal Data We Collect

a) Contact Form

When you use our contact form, we collect:

  • Your name
  • Your email address
  • The content of your message

b) User Accounts & Comments

When you register or comment on the platform, we collect:

  • Username and display name
  • Email address
  • Password (stored in encrypted/hashed form — never in plain text)
  • Profile information you choose to provide
  • Your posted comments and interactions
  • Account activity logs (login times, IP addresses for security)

c) Technical Data

We may automatically collect:

  • IP address
  • Browser type and version
  • Operating system
  • Referring URLs and pages visited

d) Student Age & Parental Consent Data

When a student creates an account, we collect:

  • Date of birth — used solely to determine the appropriate level of parental involvement required by law
  • Parent or guardian email address — collected only when required by the student's country's digital age of consent, and used only to request the guardian's approval before the account becomes active

See Section 10 below for full details on how this data is handled.

3. How We Use Your Data

We use your personal data only for the following purposes:

  • To respond to your enquiries submitted via the contact form
  • To create and manage your user account
  • To enable you to post comments and interact with the platform
  • To improve the security and functionality of the website
  • To comply with legal obligations

We do not use your data for automated decision-making or profiling. We do not sell your data to third parties.

4. Legal Basis for Processing

Under the DPDP Act, we process your personal data on the following grounds:

  • Consent — clear, informed, and specific consent you give for a stated purpose (for example, creating an account, optional communications, or non-essential cookies). You may withdraw your consent at any time.
  • Certain legitimate uses — limited processing permitted by the Act, such as where you voluntarily provide your data for a specified purpose, and to maintain the security and functionality of the platform.
  • Provision of services — to deliver the account and platform services you have signed up for.
  • Legal obligation — where required by applicable Indian law.

5. Data Retention

We retain your personal data only for as long as necessary:

  • Contact form enquiries: up to 12 months, unless an ongoing relationship develops
  • User account data: for the duration of your account, plus up to 12 months after deletion
  • Comment content: retained for the life of the platform, unless you request removal
  • Security and access logs: up to 90 days

6. Data Sharing

We do not sell or rent your personal data. We may share data with trusted third-party service providers (acting as our Data Processors) solely to operate this website (e.g., hosting providers, email delivery services). All such providers are contractually required to handle your data in compliance with the DPDP Act and only on our instructions.

We may also disclose data if required by law or to protect the rights and safety of Root Labs or its users.

7. Your Rights Under the DPDP Act

As a Data Principal (the individual whose data we process), you have the following rights:

  • Right to access information — to obtain a summary of the personal data we process and the processing activities undertaken
  • Right to correction and erasure — to correct, complete, update, or erase your personal data
  • Right to withdraw consent — at any time where consent was the basis for processing (as easily as it was given)
  • Right to grievance redressal — to a readily available means of registering a grievance with us
  • Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity

To exercise any of these rights or raise a grievance, please contact us at: rootlabs@root-labs.net

If your grievance is not resolved, you have the right to lodge a complaint with the Data Protection Board of India, the supervisory authority established under the DPDP Act.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Passwords are stored using industry-standard hashing. Access to user data is restricted to authorised personnel only.

9. International Transfers

We aim to process and store your data within India. Under the DPDP Act, personal data may be transferred to or processed in countries outside India, except any territory specifically restricted by the Central Government. Where a third-party service provider operates outside India, we require appropriate contractual and technical safeguards before any transfer occurs.

10. Children's Privacy & Parental Consent

Root Labs is an educational platform designed for students of all ages. We take the privacy of young learners seriously and comply with India's Digital Personal Data Protection Act, 2023, which requires verifiable parental consent before processing the personal data of children under 18, and with equivalent digital-age-of-consent rules in other countries.

Date of Birth

When a student registers for an account, we ask for their date of birth. This is used solely to determine the level of parental involvement required by the laws of their country (often called the "digital age of consent"). We do not use date of birth for marketing, profiling, or any other purpose.

Parent or Guardian Email Address

If a student is under their country's digital age of consent (for example, under 18 in India), we also collect a parent or guardian email address. This is used for one purpose only: to send the guardian a consent request before the student's account is activated.

  • The student's account remains locked until the parent or guardian approves it.
  • The guardian email is not used for marketing, newsletters, or any communication unrelated to account approval.
  • Once consent is granted (or refused), the guardian email is retained only as a record of consent, in line with our data retention policy.

No Advertising or Data Selling

Age and parental consent data is never sold, shared with advertisers, or used for profiling. It exists solely to ensure age-appropriate access to the platform and to meet our legal obligations to protect younger users.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. We encourage you to review this policy periodically.

For questions about this Privacy Policy or Cookie Notice, contact us at: rootlabs@root-labs.net

© 2026 Root Labs. All rights reserved.