Privacy Policy

1. Introduction

Mefoli ("Memory for Life") is a platform operated in India that enables schools, teachers, and parents to turn student artwork into keepsake products while raising funds for schools. This Privacy Policy explains how we collect, use, store, and protect personal information, including information related to children.

By using our platform, you agree to the practices described in this policy. If you do not agree, please do not use Mefoli.

2. Information We Collect

2.1 Account Information

• Parents: Full name, email address, phone number, shipping address, and payment information.
• Teachers: Full name, email address, school affiliation, and classroom details.
• School Administrators: Full name, email address, school name, address, and administrative details.
• Vendors: Business name, contact details, business address, PAN/GSTIN, and bank account information for payouts.

2.2 Children's Information

We collect limited information about students solely for the purpose of associating artwork with the correct child and enabling parents to order products. This includes:

• Student's first name and last initial (or full name if provided by the school or parent)
• Classroom and grade level
• Photographs or scans of the student's artwork
• School affiliation

We do notcollect children's email addresses, phone numbers, or social media accounts. Children do not create accounts or interact with the platform directly. All children's data is managed by teachers, school administrators, or parents.

2.3 Artwork Data

Teachers and school administrators upload images of student artwork. These images are stored securely and used to create product previews and fulfill orders.

2.4 Payment Information

Payments are processed through Razorpay. We do not store credit or debit card numbers on our servers. Razorpay's handling of your payment information is governed by their privacy policy.

2.5 Automatically Collected Information

• IP address, browser type, device type, and operating system
• Pages visited, time spent, and navigation patterns
• Cookies and similar tracking technologies (see Section 7)

3. How We Use Your Information

We use the information we collect to:

• Create and manage user accounts
• Enable teachers to upload artwork and associate it with students
• Allow parents to view their child's artwork gallery
• Process product orders and manage delivery
• Calculate and distribute fundraising commissions to schools
• Process vendor payouts
• Send transactional emails (order confirmations, shipping updates, account notifications)
• Improve and maintain the platform
• Comply with legal obligations

4. Children's Data Protection

Mefoli takes the protection of children's information seriously. We implement the following safeguards:

• Consent:Student data is uploaded by authorized school staff (teachers and school administrators) under the school's authority. Parents provide additional consent when creating an account and linking to their child's artwork.
• Minimal collection: We only collect the minimum information necessary to operate the service.
• No direct child accounts: Students do not create accounts or interact with the platform directly.
• No advertising:Children's data is never used for advertising or marketing purposes.
• No sharing:Children's information is never sold or shared with third parties for their own purposes.
• Artwork visibility:Artwork images are only visible to authorized users (the student's parent or guardian, teachers, and school administrators).
• Deletion:Parents and school administrators can request deletion of a child's data at any time (see Section 9).

5. Artwork Usage

Student artwork uploaded to Mefoli is used for the following purposes:

• Displaying the artwork in the parent's private gallery
• Generating product previews (e.g., mugs, t-shirts, canvas prints)
• Fulfilling product orders placed by parents or authorized family members

Artwork is not used for advertising, sold to third parties, or displayed publicly without explicit consent. For details on artwork licensing, please see our Terms of Service.

6. Data Sharing and Third-Party Services

We share personal information only as necessary to operate the platform:

• Razorpay: Payment processing. Razorpay receives payment details necessary to complete transactions.
• Amazon Web Services (AWS): Cloud infrastructure and storage. Artwork images and platform data are stored on AWS servers.
• Vendors:When a parent places an order, vendors receive the artwork image and shipping address necessary to fulfill the order. Vendors do not receive children's names or other personal details beyond what is needed for order fulfillment.
• Schools: Schools receive aggregated fundraising reports. They do not receive parent payment details.

We do not sell, rent, or trade personal information to third parties for marketing or advertising purposes.

7. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled.
• Functional cookies: Used to remember preferences such as language and display settings.
• Analytics cookies: Used to understand how users interact with the platform so we can improve the experience. These are anonymized where possible.

We do not use cookies for behavioral advertising or retargeting. You can manage cookie preferences through your browser settings.

8. Data Retention

• Account data: Retained as long as the account is active. Deleted within 90 days of account deletion request.
• Artwork images: Retained as long as the associated student is enrolled in an active program, or as long as the parent account is active. Parents can request deletion at any time.
• Order records: Retained for 7 years as required by Indian tax and accounting regulations.
• Payment data: Retained by Razorpay per their data retention policy. We retain only order references and transaction IDs.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you or your child.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to erasure:Request deletion of your personal data and your child's data, subject to legal retention requirements.
• Right to withdraw consent: Withdraw your consent for data processing at any time. This may affect your ability to use the platform.
• Right to grievance redressal: File a complaint with our Grievance Officer or with the Data Protection Board of India.

To exercise any of these rights, contact us at privacy@mefoli.com. We will respond within 30 days.

10. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure authentication with hashed passwords
• Role-based access control ensuring users can only access data relevant to their role
• Regular security reviews and updates
• Access logging and monitoring for sensitive operations

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. If you become aware of any security incident, please contact us immediately.

11. Compliance with the Digital Personal Data Protection Act, 2023

Mefoli operates as a Data Fiduciary under the DPDP Act, 2023. We are committed to:

• Collecting personal data only for lawful purposes with valid consent
• Processing children's data only with verifiable parental or guardian consent, or under the authority of the educational institution
• Providing clear notice about the purpose and scope of data collection
• Enabling Data Principals (users) to exercise their rights under the Act
• Implementing reasonable security safeguards as required by the Act
• Reporting any personal data breach to the Data Protection Board of India and affected users as required by law

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email and update the "Last updated" date at the top of this page. Your continued use of the platform after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: