Legal
Privacy Policy
Last updated: 29 October 2026
Who we are
The-Inversity is operated by Xploreroots Private Limited (CIN U80301KA2020PTC140401), 1658, First Floor, 27th Main Rd, Sector 2, HSR Layout, Bengaluru, Karnataka 560102, India. In this policy, "we", "us" and "our" mean Xploreroots Private Limited. We are the Data Fiduciary for the personal data described here, within the meaning of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"). This policy explains what personal data we collect through https://theinversity.com and our programmes, why, who we share it with, where it is stored, how long we keep it, and the rights you have over it. Languages: this policy is available in English and in Hindi at https://theinversity.com/hi/privacy. If you would like it in another language listed in the Eighth Schedule to the Constitution of India, write to our Grievance Officer and we will provide it.
Information we collect
Information you give us directly: • Enrolment, account and contact details: name, email address, phone number, postal address, city, state, PIN code, programme selection, session bookings and the messages you send us. • Parent or guardian details: where a learner is under 18, or is a person with a disability acting through a lawful guardian, the parent or guardian's name, email address and phone number, and the records we need to show that verifiable consent was given (see "Children and learners with lawful guardians"). • Masterclasses, email series and free-game sign-ups (adults only): name, email address, optional phone number, language, who you are (for example a parent or a student), your game answers and results, and a record of what you agreed to. • Campus ambassadors, referrals and partners: application details (college, city, course, organisation, role), referral or ambassador codes and how they performed, and the UPI ID and payment references we need to pay referral cashback or ambassador earnings. • Testimonials: if you choose to share your story publicly, your name, city, who you are, an optional age and short line about you, and your words. Information generated when you use our website, programmes and games: • Sign-in and device security data: we use one-time sign-in links, so we hold no password. To keep accounts secure, apply device and streaming limits and prevent unauthorised sharing, we record one-way hashes of sign-in links and sessions, a device and browser label, approximate location (city and country), IP address (or a one-way hash of it) and sign-in times. • Learning and gamification activity: your programme progress, scores, XP, streaks, answers and choices in quizzes, quests and scenario games, profile customisations you unlock, badges and certificates, and your part in family squads, group challenges and leaderboards. Leaderboards show only a made-up nickname and a score or XP, never your name or contact details. • Mentor chat, AI coach, Inversity Guide and scam-checker inputs: the messages you send to our mentors, our AI coach, the Inversity Guide or the scam-message checker, and the replies, so that we can answer you, keep your conversation history where you have an account, and check the safety and quality of answers. The text you paste into the scam checker is not stored. Please do not include sensitive personal or financial details (such as phone numbers, government ID numbers, or bank or card numbers) in these messages. We use automated filters designed to detect and redact or block such details, but automated filtering cannot guarantee that every format is caught. • Payment records: payments are processed by our payment gateway. We do not collect or store your full card number, CVV or UPI PIN. We receive only the transaction reference, amount, payment status and the type of payment method used. • Usage, security and analytics data: IP address, browser type, pages visited, time spent, the campaign, referral or ambassador code you arrived with, and diagnostic logs. We process IP addresses for security, rate limiting and approximate location, and keep a one-way hash instead of the full address wherever the full address is not needed. See also "Cookies and analytics".
Children and learners with lawful guardians
Our FLY programme is designed for learners aged 13 to 17, and some of our free educational games can be played by people under 18. We treat the personal data of anyone under 18 as a child's data, in line with Section 9 of the DPDP Act and Rules 10 and 11 of the DPDP Rules. • Verifiable consent: where a learner is under 18, or is a person with a disability acting through a lawful guardian (one appointed by a court, a designated authority or a local level committee under the applicable guardianship law), the enrolment and the learner's account are set up by the parent or lawful guardian. At checkout the parent or lawful guardian confirms that they are 18 or over, that they are the learner's parent or lawful guardian, and that they consent to us processing their own and the learner's personal data. Before we process the learner's data, we check that they are an identifiable adult using reliable details we already hold and the adult payment instrument they pay with. If those are not enough to be sure, we will ask for other reliable proof of age, identity or authority, which may include a virtual token issued by a government-authorised entity such as DigiLocker. The parent or lawful guardian then creates the learner's account from their own account. • Free games: a player who tells us they are under 18 can see their result and a 30-day family plan on screen, and can share a link to it with a parent from their own device (by WhatsApp, email or by copying the link). We do not ask for, or keep, their name, email address or phone number, we do not contact them, and we never receive the parent's details from that share. • Adult-only sign-ups: our email series (such as Scam of the Week and the Paisa Puzzle reminder), masterclass registrations and the campus ambassador programme are only for people aged 18 or over. • No tracking or targeted advertising: we do not track children across other websites, build advertising profiles of them, or direct targeted advertising at them; we never run analytics cookies for a visitor who tells us they are under 18; and we do not process a child's data in a way likely to harm their wellbeing. Inside the programme we record a learner's own progress only to teach them and to show that progress to them and to their parent or guardian. A parent or guardian sees their teen's progress and counts, not their chats or answers. • Parent and guardian controls: a parent or lawful guardian can see their teen's account status, switch off the teen's access, and withdraw consent or ask for erasure at any time, from their account or through the request form below. Withdrawing consent ends the learner's access to the programme. If you believe a child's data has reached us without the right consent, tell our Grievance Officer and we will stop using it and erase it as described under "How long we keep information".
Your consent, and how we record it
Each of our forms asks for consent separately for each purpose. The boxes are never ticked for you: • one required box for the service itself, such as saving and emailing your game result and 30-day plan, sending a masterclass joining link and reminders, or enrolling you in a programme; and • separate, optional boxes for calls, WhatsApp messages and emails about our programmes, and for opted-in email series such as a week of short money lessons. Saying no to an optional box never stops you using the service. Our team only calls people who ticked the box for calls, or who asked us to call them (for example by booking a counselling session, asking the Inversity Guide for a call-back or sending us an enquiry). Next to each form is a short "Data & Consent Notice" link, in English and Hindi, that lists the data that form collects, why, and how to withdraw consent or complain. When you give consent we record the version of the notice you were shown, the exact words you agreed to, the purposes you agreed to, the language and the time. The record is linked to a one-way hash of your email address or phone number rather than the address itself, so we can still show what was agreed after your other data has been erased. You can withdraw any consent at any time, as easily as you gave it: use the unsubscribe link in any email, tell the person who calls you, use the request form at https://theinversity.com/privacy/request, or write to grievance@theinversity.com. Withdrawal does not affect processing already carried out. Withdrawing the consent a service depends on ends that service.
How we use your information
We use personal data to: • Create and manage your enrolment and account, and give you access to the programme you bought. • Process payments, instalments, invoices and refunds, and apply referral, ambassador, partner, masterclass and returning-family discounts. • Pay referral cashback and campus ambassador earnings. • Schedule, confirm, change and cancel counselling sessions, live classes and masterclasses, and remind you of them. • Show you your game result and send you the plan, lessons or alerts you asked for. • Send service messages such as sign-in links, confirmations, invoices, learning reminders and important changes to a programme. • Answer enquiries, call you back when you ask us to, and support learners. • Contact you about our programmes, only where you have agreed to this. • Keep accounts and the website secure, and prevent spam, fraud, account sharing and misuse. • Improve our programmes and website, and check the safety and quality of AI and mentor answers. • Meet legal, accounting and tax obligations, and establish, exercise or defend legal claims.
Who we share information with
We do not sell your personal data. We share it only with Data Processors who process it on our behalf, under contracts that bind them to confidentiality and security, and only for the purposes in this policy: • Payment gateways and banking partners (such as Cashfree Payments): to process fees, UPI AutoPay instalments, refunds, referral cashback and ambassador payouts. • Cloud hosting, database and security infrastructure providers: to host the website and app, store account and enrolment records, and run short-lived caching, rate limiting and anti-abuse protection. • AI infrastructure providers: to process the text you send to our AI coach, the Inversity Guide and the scam checker, and write an educational reply. • Communication and email providers: to send sign-in links, confirmations, invoices, reminders and the email series you opt into, and to handle WhatsApp messages when you choose to contact us on WhatsApp (WhatsApp is also governed by Meta's own privacy policy). • Analytics providers (Google Analytics): to measure how the website is used, in aggregate, for visitors who choose to allow analytics in our cookie banner. We may also disclose personal data where the law, a court, or a government or regulatory authority (including the Data Protection Board of India) requires it, or where it is necessary to protect our legal rights, safety or property.
Where your information is stored
Our website and database are hosted on cloud infrastructure located in the United States. This means the personal data you give us is transferred to, stored and processed outside India. We transfer it under our contracts with those providers, which require appropriate security measures, and only to countries that the Central Government has not restricted under Section 16 of the DPDP Act. If you do not want your data stored outside India, we cannot provide the Service to you. You can contact our Grievance Officer to discuss this or to ask for erasure.
Cookies and analytics
We use cookies and similar technologies for two purposes: • Necessary cookies and local browser storage keep you signed in, identify your device for account security, remember choices such as your language and sound settings, and help prevent misuse. The Service does not work properly without them. • Analytics cookies, set by Google Analytics, tell us in aggregate which pages are visited, for how long and from roughly where. Google Analytics runs only after you choose "Allow analytics" in our cookie banner. If you choose "Only necessary", or have not chosen yet, it does not run. You can change your choice by clearing this site's data in your browser. We never run Google Analytics for a visitor who tells us they are under 18, and the games made for teens never run it at all. We also keep simple daily totals of visits, plays and finished games. They use no cookie and contain nothing that identifies you. If you arrive through an advertisement, another website, or a referral or ambassador link, your device remembers that source for 30 days. It is used only if you then send us a form, to tell which campaigns work and to apply the right discount, and it is never shared. You can set your browser to refuse cookies; some parts of the Service may then stop working.
How long we keep information
We keep personal data only as long as we need it for the purpose it was collected for: • Enquiries, call-backs, counselling bookings, saved game results, masterclass sign-ups, partner enquiries, unfinished checkouts, and campus ambassador applications that were declined or never approved: 24 months after your last activity with us. • Learner accounts: while your access lasts, then 24 months after it ends, unless you enrol again. • Enrolment, invoice, payment, refund, referral cashback and ambassador payout records: 8 years from the end of the financial year of the transaction, as Indian tax and accounting law requires. After that they are anonymised. • Email series and reminders: until you unsubscribe. A sign-up that is never confirmed is no longer used after 30 days. • AI coach and Inversity Guide conversation history: 90 days from the last message. • Public leaderboard entries: shown for 12 weeks. • Security, access and processing logs, and the record of questions to the free-game AI coach: 1 year. • Form submissions held back by our spam filter: reviewed for 90 days, so real enquiries are not lost. • Analytics data: 14 months, in Google Analytics. One-year minimum (Rule 8(3) of the DPDP Rules): the law requires us to keep personal data, the associated traffic data and processing logs for at least one year from the date of processing, for the purposes set out in the Seventh Schedule to the DPDP Rules. So nothing is deleted less than one year after it was processed. When a shorter period above ends, or you withdraw consent or ask us to erase your data, we stop using the data straight away and lock it away: it is not used, shown or shared for any other purpose, and it is deleted once that one-year minimum has passed. Records that tax law requires us to keep are kept for 8 years as described above. After these periods we delete the data or irreversibly anonymise it.
How we protect information
We use reasonable technical and organisational security measures to protect personal data, including encryption in transit (HTTPS), access controls and role-based permissions in our administrative systems, logs of access to personal data, and limiting access to the people who need it for their work. No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security.
If there is a data breach
If a personal data breach occurs, we will inform each affected person without delay, and the Data Protection Board of India, as the DPDP Act and Rule 7 of the DPDP Rules require. Our notice to you will set out: • a description of the breach, including its nature, extent, and when and how it happened; • the consequences it is likely to have for you; • the steps we have taken, and are taking, to reduce the risk; • the safety measures you can take to protect your interests (for example, being alert to calls or messages that ask for payment or sign-in details); and • the contact details of a person who can answer your questions about it: our Grievance Officer, at grievance@theinversity.com or +91 84319 56045.
Your rights
Subject to the DPDP Act and Rules, you have the right to: • Ask for a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with. • Ask us to correct, complete or update inaccurate or incomplete data. • Ask us to erase personal data we no longer need, or that you gave with a consent you have since withdrawn. • Withdraw your consent at any time, without affecting processing already carried out. • Nominate another person to exercise these rights for you in the event of your death or incapacity. • Raise a grievance with us, and then with the Data Protection Board of India. Where the learner is under 18, or acts through a lawful guardian, these rights are exercised by their parent or lawful guardian. How to make a request: use our request form at https://theinversity.com/privacy/request (in Hindi at https://theinversity.com/hi/privacy/request), or write to grievance@theinversity.com. So that we can confirm it is you, please write from the email address or phone number registered with us, or quote your enrolment or order ID. We will check that the request comes from you (or from the parent or lawful guardian of the learner) before acting on it, acknowledge it within 48 hours, and complete it within 30 days. Erasure is subject to the one-year minimum under Rule 8(3) of the DPDP Rules and to the records tax law requires us to keep: we will stop using the data at once and lock it away until it can be deleted, and we will tell you if a record has to be kept. Do not contact: if you do not want calls or marketing messages from us, tell the person who calls you, use the request form, or write to us. We will stop them. Service messages about a programme you have bought continue.
Grievance Officer
If you have a question, concern or complaint about how we handle personal data, contact our Grievance Officer: The Grievance Officer Xploreroots Private Limited 1658, First Floor, 27th Main Rd, Sector 2, HSR Layout, Bengaluru, Karnataka 560102 Email: grievance@theinversity.com Phone: +91 84319 56045 Request form: https://theinversity.com/privacy/request We will acknowledge your grievance within 48 hours and resolve it within 30 days of receiving it. If you are not satisfied with our response, or we have not resolved your grievance within 30 days, you may complain to the Data Protection Board of India through its official online platform, as provided under the DPDP Act and Rules.
Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and where a change is significant we will tell you by email or by a notice on the website before it takes effect.
How to contact us
Xploreroots Private Limited 1658, First Floor, 27th Main Rd, Sector 2, HSR Layout, Bengaluru, Karnataka 560102, India General enquiries: contact@theinversity.com Learner support: support@theinversity.com Privacy and data rights: grievance@theinversity.com Phone: +91 84319 56045