Pluto · India

Privacy Policy

Last updated 28 July 2026

Pluto is operated by Dhi Mantra LLP ("Dhi Mantra", "we", "us"). This policy explains what personal data we collect through the Pluto app (the "Service"), why we collect it, and the choices you have. It is written to meet the requirements of India's Digital Personal Data Protection Act, 2023 (DPDP Act), which specifically governs how we may process a child's (anyone under 18) personal data.

1. Who this applies to

Pluto is a financial-literacy app for learners aged 12–18. The account belongs to a parent or guardian's phone number or email, with the child's profile held underneath it — the parent is the data principal who provides verifiable consent on the child's behalf, as required by the DPDP Act. We do not knowingly allow a child to create or control an account directly.

2. What we collect

• Account details: the parent's phone number or email used to sign in, and the child's first name and age range.
• Learning activity: lesson progress, quiz answers, assessment scores, streaks, badges, and certificates earned.
• In-app simulation data: balances and activity inside the practice Vault feature — this is simulated, not real money or a real bank account.
• Payment records: when a parent purchases a module or subscription, our payment processor (Cashfree for web purchases, or Google Play Billing for in-app purchases) handles card/UPI details directly — we never see or store the full card number. We keep a record of the order (amount, date, item purchased) for accounting and support purposes.
• Device/usage data: basic technical data (device type, app version, crash logs) to keep the Service working.

We do not collect more than what a feature actually needs, and we do not sell personal data to third parties.

3. Why we collect it

• To create and run the account and track the child's learning progress.
• To award Sparks, badges, and certificates.
• To process purchases and send order confirmations to the parent.
• To send OTP/verification codes for sign-in and account actions.
• To improve the Service and fix bugs.
• To meet legal and accounting obligations.

4. Children's data

We collect only what the learning experience needs (first name, age range, learning activity) — no location tracking, no behavioural advertising, and no sharing of a child's data for marketing purposes. There are no in-app ads. A parent can review, correct, or request deletion of their child's data at any time (see Section 7).

5. How we store and protect your data

Data is stored with Supabase (our database and authentication provider) using industry-standard encryption in transit and at rest, with row-level security so a family can only access its own data. Payment card details are never stored on our servers — they are handled entirely by Cashfree or Google Play, both PCI-DSS compliant payment processors.

6. Who we share data with

We share data only with the processors needed to run the Service:

• Supabase — database, authentication, file storage.
• Cashfree — payment processing for web purchases.
• Google Play Billing — payment processing for in-app purchases.
• Vercel — application hosting.

We do not sell or rent personal data to advertisers or data brokers.

7. Your rights (as the parent/guardian)

Under the DPDP Act, you can:

• Request a copy of the personal data we hold about your child's account.
• Correct inaccurate data (Settings → Edit personal details).
• Delete the account and associated personal data at any time (Settings → Delete my account). Payment records are retained for accounting purposes as required by law, but are no longer linked to your identity once the account is deleted.
• Withdraw consent, which will result in account deletion since the Service cannot function without the data described above.

To exercise any of these rights, or for any privacy question, contact us at support@dhimantra.com.

8. Data retention

We retain account and learning data for as long as the account is active. If you delete the account, personal data is removed within a reasonable period, except where we are required to retain financial/accounting records by law — those records are kept but de-linked from your identity.

9. Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify parents through the app or by email before it takes effect.

10. Contact us

Dhi Mantra LLP
Email: support@dhimantra.com