Citrio Privacy Policy

Effective Date: 26 October 2026
Last Updated: 26 October 2026
Website: https://citrio.in/
Service Name: Citrio
Business Status: Not yet registered as a separate legal entity
Location: India
Privacy and Support Contact: help@citrio.in

1. Introduction

Welcome to Citrio (“Citrio,” “we,” “our,” or “us”). Citrio is an online learning platform designed to help children learn, practise, complete homework, explore educational lessons, and work towards learning goals through interactive features and artificial intelligence (“AI”).

This Privacy Policy explains how Citrio may collect, use, store, process, and share personal information when parents, guardians, and students visit our website or use our services.

We aim to handle personal information responsibly, limit its use to relevant purposes, and provide additional safeguards for children’s information.

By using Citrio, you acknowledge that you have read this Privacy Policy. Where consent is legally required, use of the service will be subject to obtaining the appropriate consent through the applicable process. Merely visiting the website does not replace any consent that may be required by law.

2. Who We Are

Citrio is the name of the online learning service available at https://citrio.in/. The business has not yet been registered as a separate legal entity.

Contact details

• Website: https://citrio.in/
• Privacy enquiries: help@citrio.in
• Customer support: help@citrio.in
• Location: India

A separate privacy or grievance officer has not been designated at the time this policy is issued. Privacy requests and concerns may be sent to the email address above.

3. Who This Policy Applies To

This policy applies to:

• Parents and legal guardians who create or manage accounts.
• Children who use learning features through a parent-managed account.
• Visitors who browse the Citrio website.
• Users who interact with homework assistance, AI-generated lessons, quizzes, progress tracking, coins, goals, or rewards, where those features are available.

Citrio is initially intended for users in India, including children aged approximately 8–12 and their parents or guardians.

Children should use Citrio under appropriate parental or guardian supervision. A child should not create an account independently where parental involvement or consent is required.

4. Information We May Collect

The information collected depends on which features are available and how you use Citrio.

4.1 Parent or Guardian Information

This may include:

• Name or account display name.
• Email address and mobile number.
• Login credentials or authentication information.
• Parent account and subscription details.
• Coin wallet balance and transaction history.
• Payment status and transaction references, where payments are enabled.
• Account preferences, support requests, and communications with Citrio.

We do not need to collect payment card details directly if payments are processed through an external payment provider. The provider and the information it processes will depend on the payment service selected when payments are introduced.

4.2 Child or Student Information

Depending on the features used, this may include:

• First name, nickname, or student display name.
• Age, class, grade, or educational level, if requested.
• Subjects, chapters, and learning preferences.
• Homework questions, answers, uploaded material, and quiz responses.
• Learning progress, scores, stars, goals, and achievements.
• Coins earned or spent and reward-related activity.
• Information necessary to provide and manage the student profile.

Parents or guardians should avoid entering unnecessary personal information about children, such as home addresses, personal contact details, government identification numbers, or unrelated sensitive information.

4.3 Homework Images and Uploaded Content

If you upload a photograph, screenshot, document, or other material for homework assistance, the uploaded content may contain personal information, handwriting, school details, names, or other information visible in the image.

We may process such content to:

• Read and interpret the homework question.
• Generate explanations, hints, or suggested answers.
• Provide learning assistance.
• Create educational exercises where the relevant feature is available.
• Maintain relevant learning history, where required for the service.

Parents and guardians should review uploaded images and avoid including information that is not needed to answer the educational question.

4.4 Technical and Usage Information

When you use Citrio, certain technical information may be processed to operate and protect the service. Depending on the configuration of the website and its service providers, this may include:

• IP address and basic device or browser information.
• Login sessions and authentication events.
• Security, error, and diagnostic logs.
• Requests made to the website and essential service activity.

Citrio intends to use essential cookies or similar technologies initially. Analytics and advertising cookies are not part of the intended initial configuration. If this changes, the policy and applicable consent arrangements will be updated as necessary.

5. How We Use Information

Citrio may use personal information for the following purposes:

• Creating and managing parent and student accounts.
• Authenticating users and protecting account access.
• Providing homework assistance and educational content.
• Generating AI-assisted explanations, lessons, quizzes, and practice questions.
• Tracking learning activity, scores, stars, goals, and progress.
• Managing subscriptions, coin balances, and transactions when those features are available.
• Administering reward information and fulfilling eligible physical rewards.
• Responding to support requests and privacy enquiries.
• Maintaining platform security, troubleshooting errors, and preventing misuse.
• Meeting applicable legal obligations and responding to valid legal requests.

We will seek to collect and use information that is relevant to these purposes rather than collecting unnecessary information.

Citrio will not use children’s personal information for purposes that are incompatible with the purpose explained to the parent or guardian or otherwise permitted by applicable law.

6. Children’s Privacy and Parental Consent

Protecting children’s privacy is particularly important to Citrio.

Citrio is intended to support learning through parent-managed accounts. Before processing a child’s personal information where verifiable parental or guardian consent is legally required, the relevant consent process must be implemented and completed.

Depending on applicable legal requirements, this may involve:

• Obtaining consent from a parent or lawful guardian.
• Taking appropriate steps to verify the parent’s or guardian’s authority.
• Providing a clear explanation of the information collected and the purposes for which it is used.
• Enabling parents or guardians to request access to, correction of, or deletion of eligible information.
• Applying suitable security and access controls to child profiles and learning records.

A login code or one-time password (OTP) may help authenticate a person, but it does not automatically establish verifiable parental consent or prove that the person is a child’s lawful guardian.

Citrio will not intentionally use children’s information for targeted advertising. Any future feature involving advertising, profiling, behavioural monitoring, or additional uses of children’s information must be assessed against applicable child-protection and privacy requirements before implementation.

Parents and guardians are encouraged to supervise children’s use of the platform and contact us if they believe a child’s information has been submitted without appropriate permission.

7. AI-Powered Learning and OpenAI

Citrio uses OpenAI as its AI provider for intended AI-powered learning features.

When a user requests AI assistance, information necessary to fulfil that request may be sent to OpenAI for processing. Depending on the feature, this may include:

• Homework questions and text extracted from uploaded material.
• Images or other content submitted for analysis.
• The relevant question, subject, or learning context.
• Instructions needed to generate an explanation, lesson, or quiz.

AI responses can be inaccurate, incomplete, or unsuitable for a particular learning context. AI-generated content is intended to support learning and should not be treated as infallible. Parents and guardians should supervise children’s use of AI features as appropriate.

Information sent to OpenAI may be processed under OpenAI’s applicable service terms, privacy documentation, and data-processing arrangements. The actual treatment of submitted information depends on the specific OpenAI service and account configuration used by Citrio.

Citrio does not represent that AI inputs are never retained, that they are never reviewed, or that they are automatically excluded from all forms of provider processing. Those matters must be verified against the applicable OpenAI configuration and contractual terms before launch.

Citrio will not knowingly send unnecessary personal information to an AI provider. Where feasible, unnecessary identifying information should be removed from content before it is submitted for AI processing.

For more information, users can review OpenAI’s privacy information at https://openai.com/policies/privacy-policy/.

8. Hosting, Storage, and Service Providers

Citrio uses or intends to use Supabase and Lovable as part of its hosting, application, database, or related technical infrastructure.

These providers may process information needed to operate the platform, depending on the actual technical configuration and services enabled. Such information may include account data, learning records, uploaded content, authentication information, and technical logs.

Citrio may also use service providers for purposes such as:

• Authentication and account security.
• AI processing.
• Payment processing, when a payment provider is selected.
• OTP or SMS delivery, when an external provider is selected.
• Website infrastructure, maintenance, and troubleshooting.

Service providers should receive only the information reasonably necessary for their assigned functions and should be subject to appropriate contractual, security, and confidentiality requirements where applicable.

Citrio has not yet selected its production payment provider or final OTP/SMS provider. A development or sandbox OTP service may be used during testing. The production provider and its relevant privacy terms will be identified or made available when that service is selected and enabled.

The actual providers, services, locations, and data flows may change as the platform develops. This policy will be updated when a material change requires an update.

9. Payments, Subscriptions, and Coins

Citrio may offer paid subscriptions, coin purchases, or other paid features when these functions are available.

In connection with such features, Citrio may process information such as:

• Selected subscription or purchase.
• Order and transaction reference.
• Payment status and amount.
• Coin credits, deductions, and balance.
• Refunds, reversals, or transaction-related support requests.

The payment provider has not yet been selected. When payments are enabled, the selected provider may collect and process payment information under its own applicable terms and privacy policy.

Citrio should not treat a payment as successful solely because a user’s browser reports success. Payment status and coin credits must be confirmed through a reliable payment-verification process before the relevant purchase is fulfilled.

This policy does not promise that any particular payment method is currently available. Availability will be communicated through the website or checkout flow.

10. Coins, Learning Progress, and Rewards

Citrio may maintain records of coins, stars, goals, quizzes, progress, and reward eligibility to support its educational features.

If physical rewards are offered, Citrio intends to fulfil eligible rewards directly. If fulfilment requires delivery, additional information such as the recipient’s name and delivery address may be requested from the parent or guardian.

Delivery information should be collected only when needed to fulfil the reward and should be retained only as long as reasonably necessary for fulfilment, customer support, recordkeeping, or applicable legal obligations.

Reward eligibility, availability, delivery arrangements, and any applicable conditions will be explained through the relevant feature. A reward shown on the platform should not be interpreted as guaranteed unless the displayed terms confirm that it is available and the eligibility requirements have been met.

Citrio will not disclose a child’s personal details publicly as part of a reward or leaderboard feature without an appropriate basis and any consent required by law.

11. When We Share Information

Citrio does not intend to sell personal information to third parties.

Information may be shared in limited circumstances, including:

• Service providers: With providers such as OpenAI, Supabase, and Lovable to support the service functions described in this policy.
• Payments: With the selected payment provider when paid features are enabled.
• OTP and communications: With the relevant service provider when authentication messages are sent.
• Reward fulfilment: With delivery or fulfilment providers if needed to deliver a reward, if such providers are used.
• Legal obligations: Where disclosure is required by applicable law, a valid legal process, or a lawful request from a competent authority.
• Security and rights: Where reasonably necessary to investigate abuse, protect users, enforce applicable terms, or address security incidents.

We will seek to limit the information shared to what is reasonably necessary for the relevant purpose.

If Citrio undergoes a business restructuring, transfer, or similar transaction in the future, any transfer of personal information will be handled subject to applicable law and appropriate safeguards.

12. International Processing and Data Transfers

Although Citrio initially targets users in India, some technology or AI providers may process information in other countries, depending on their infrastructure and service configuration.

Where personal information is transferred or made accessible outside India, Citrio will assess and address any applicable legal requirements, contractual obligations, and appropriate safeguards.

The precise locations in which all information is stored or processed have not been confirmed in this policy. Users should not interpret this policy as a guarantee that all data remains exclusively within India.

13. Data Retention and Deletion

Citrio intends to retain learning records while the relevant account remains active, subject to the purposes for which the information is needed and applicable legal requirements.

Information may include account details, learning history, quiz results, progress, coins, transaction records, and support correspondence.

Parents or guardians may request deletion of eligible account and child-related information by emailing help@citrio.in from the registered parent email address, where possible. We may need to verify the requester’s identity or authority before acting on a request involving a child’s information.

When a valid deletion request is received, Citrio will assess the request and delete or anonymise eligible information within a reasonable period, subject to applicable law and any legitimate requirement to retain certain records.

Some information may need to be retained for purposes such as:

• Compliance with legal or regulatory obligations.
• Accounting, tax, or transaction recordkeeping.
• Resolving disputes or handling claims.
• Preventing fraud, abuse, or security incidents.
• Maintaining necessary records of consent, deletion requests, or other compliance actions.

Backups, technical logs, and copies held by service providers may not be removed immediately and may remain for a limited period according to the applicable technical configuration and retention practices.

Citrio does not currently specify a fixed number of days for deletion from all systems. Retention periods and deletion workflows should be documented and configured as part of the platform’s operational controls.

14. Cookies and Similar Technologies

Citrio intends to use essential cookies or similar technologies initially where necessary to provide core website functionality, maintain secure sessions, and support authentication.

Essential technologies may be used for purposes such as:

• Keeping users signed in.
• Protecting account sessions.
• Supporting security and service functionality.
• Remembering necessary settings.

Analytics and advertising cookies are not intended to be enabled in the initial configuration.

The actual cookies and technologies used will depend on the final website implementation and third-party integrations. If non-essential cookies or analytics tools are introduced, Citrio will review the applicable notice and consent requirements and update this policy where appropriate.

Users may also be able to control cookies through their browser settings, although disabling essential cookies may prevent some features from functioning correctly.

15. Marketing and Communications

Citrio intends to send essential service-related communications initially. These may include account verification messages, security alerts, important service notices, transaction updates, and responses to support requests.

Citrio does not intend to send promotional marketing messages as part of the initial configuration.

If promotional communications are introduced in the future, Citrio will review the applicable consent and opt-out requirements before sending them. Essential service messages may still be sent when reasonably necessary to operate the account or provide the requested service.

16. Security

Citrio recognises the importance of protecting children’s and parents’ information. Appropriate security measures should be implemented to protect information against unauthorised access, disclosure, alteration, loss, or misuse.

Depending on the system and feature, these measures should include:

• Secure authentication and account-session management.
• Access controls that restrict information to authorised users.
• Database permissions and row-level security where appropriate.
• Secure handling of uploaded images and documents.
• Protection of API keys and other secrets.
• Restricted administrative access and suitable audit logging.
• Secure handling of payments and authentication messages.
• Procedures for responding to suspected security incidents.

No online service can guarantee absolute security. The effectiveness of these controls depends on their actual implementation, configuration, monitoring, and maintenance.

If a personal data breach occurs, Citrio will assess the incident and take the actions required under applicable law, including any required notifications to affected individuals or authorities.

17. Your Privacy Requests and Rights

Subject to applicable law, parents, guardians, and other eligible users may contact Citrio to request assistance with:

• Accessing information associated with an account.
• Correcting inaccurate account or profile information.
• Requesting deletion of eligible information.
• Raising concerns about how personal information is used.
• Withdrawing consent where applicable and requesting that relevant processing stop, subject to legal or operational limitations.
• Asking questions about third-party processing or this Privacy Policy.

Requests should be sent to help@citrio.in.

For requests concerning a child’s information, Citrio may ask for reasonable verification to confirm the requester’s identity and authority. We will handle requests in accordance with applicable law and explain where a request cannot be fully completed, where legally permitted.

A self-service account deletion feature has not been confirmed as available. Until such a feature is implemented, parents or guardians may submit deletion requests by email.

18. Third-Party Websites and Services

Citrio may provide links to third-party websites or services. Those services operate under their own privacy policies, terms, and practices.

Citrio is not responsible for the privacy practices of external websites that it does not operate. Users should review the relevant third-party policies before providing personal information to those services.

19. Changes to This Privacy Policy

Citrio may update this Privacy Policy to reflect changes in the platform, its providers, its features, or applicable law.

The latest version will be published at https://citrio.in/ and will display its effective date or last-updated date.

Where required by applicable law, Citrio will provide notice of material changes and obtain any additional consent that may be necessary before applying those changes to existing users.

20. Contact Us

For privacy questions, data requests, account deletion requests, or other concerns about this Privacy Policy, please contact:

Citrio — Privacy and Support

Website: https://citrio.in/
Email: help@citrio.in
Location: India

Please include enough information for us to understand your request, but do not send passwords, OTPs, payment card details, or unnecessary sensitive information by email.

Citrio — Learn. Practise. Grow.

This Privacy Policy describes Citrio’s intended approach to handling personal information. It must be read alongside the platform’s actual technical configuration, applicable provider terms, and applicable law. Where a feature or control is not yet implemented, Citrio should implement it before relying on it as an existing privacy safeguard.