Legal
Last updated: 26 March 2026
DeDuckt (“DeDuckt”, “we”, “our”, or “us”) operates the DeDuckt learning platform at deduckt.in. This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding that data. We are committed to protecting your privacy in compliance with India’s Digital Personal Data Protection Act 2023 (DPDP Act), and where applicable, the EU/UK General Data Protection Regulation (GDPR / UK GDPR).
By using DeDuckt, you agree to the collection and use of information as described in this policy.
When you register, we collect your email address and a display name via Clerk, our authentication provider. We do not store your password — Clerk handles credential management.
We collect information about how you use DeDuckt: which books you upload, which lessons you generate, your starting-mix format preference, and which features you interact with. This is used to improve the product and personalise your experience.
We use Convex file storage for uploaded documents. Storage and processing practices may involve our infrastructure providers; see the Third-Party Services section for the providers currently used.
Payments are processed by Razorpay. We do not store credit card numbers or payment credentials on our servers. Razorpay returns an order ID and payment status, which we store to manage your plan.
We automatically collect standard log data including your IP address, browser type, device type, and pages visited. This is used for security monitoring and debugging.
Your data is used to authenticate you, generate AI-powered lessons from your uploaded material, track your subscription and usage limits, and store your learning progress.
Aggregated, anonymised usage data helps us understand which features are most useful and where students encounter difficulty. We never share individual-level data with third parties for analytics.
We may send transactional emails (account confirmations, payment receipts, lesson completion notices). We do not send marketing emails without your explicit opt-in.
We use log data to detect abuse, enforce rate limits, and protect the integrity of our platform.
Clerk manages user accounts and authentication. By creating an account, you agree to Clerk's privacy policy. Clerk may store your email address and authentication tokens on servers in the EU and USA.
Razorpay processes all subscription and one-time payments. Razorpay is PCI DSS Level 1 compliant. Your payment data is governed by Razorpay's privacy policy.
Convex states that its infrastructure uses encryption at rest and in transit. The specific controls applicable to this deployment may depend on the configured services and providers.
When a lesson is generated, relevant excerpts may be sent to OpenAI for processing under the provider's API terms and current data-use policy. See OpenAI's current policy for details.
Visual illustrations are generated using OpenAI's image API. Relevant content excerpts are sent to OpenAI solely to produce images for your lesson. OpenAI's data handling is governed by their privacy policy.
DeDuckt is hosted on Vercel. Standard request logs may be retained by Vercel for a limited period for operational purposes.
We retain your data for as long as your account is active. Uploaded PDFs are retained for the life of your account to allow lesson regeneration.
When you delete your account, we delete your personal data, uploaded files, and generated lessons within 30 days. Some anonymised usage data may be retained for analytical purposes.
We are required to retain records of financial transactions for up to 7 years for tax and compliance purposes.
You may request a copy of all personal data we hold about you at any time by emailing privacy@deduckt.in.
You can update your display name and email address directly in your account settings.
You may delete your account and all associated data from your account settings page. Alternatively, contact us at privacy@deduckt.in.
We aim to respond within the timeframe required by applicable law.
If you are located in India, you have rights under the Digital Personal Data Protection Act 2023, including the right to access your data, correct inaccuracies, and request erasure. You may also nominate a person to exercise these rights on your behalf. To exercise any of these rights, contact us at privacy@deduckt.in.
If you are located in the European Union or United Kingdom, you have additional rights under GDPR / UK GDPR, including the right to data portability, the right to object to processing, and the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK).
We use cookies to maintain your login session. These are strictly necessary and cannot be disabled without breaking the service.
We store your starting-mix format preference and UI settings in local storage. This data never leaves your device.
We use PostHog analytics when enabled by your consent settings. These tools may use browser storage or similar technologies; we do not use advertising cookies.
We use security measures provided by our infrastructure and service providers to protect data in transit and at rest. The exact controls may vary by provider and deployment.
We use provider security controls and restrict production-data access to authorised personnel where operationally necessary. We do not sell or rent your data.
If a breach notification is legally required, we will follow the timelines and procedures required by the applicable law.
For privacy-related questions or data requests, contact privacy@deduckt.in. We will handle requests under applicable law.
We may update this Privacy Policy from time to time. Material changes will be communicated by email and by a notice on this page at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.