Privacy Policy
In short: We keep the least we need to run Galley. Your school’s papers and uploads are stored on our server in India, kept separate for each school, and visible only to people your school adds. Page images and question text are sent to Anthropic’s Claude to be read and solved. For billing and support we see each paper’s title and usage numbers, not its questions. We never sell your data.
1. Who we are
Galley is provided by [LEGAL NAME OF BUSINESS], [ADDRESS] (“we”, “us”). This policy explains what personal and school data Galley handles and why. It follows India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
2. What we collect
| What | Examples | Why |
|---|---|---|
| Account details | name, email, school, role (admin or teacher), when you were added and last active | to let you sign in and to let your school admin manage users |
| Passwords | never stored in readable form. Our sign-in provider stores only a one-way scrambled version (a “hash”). For offline sign-in, the computer you sign in on keeps a scrambled copy for up to 3 days. | to check it is you |
| School content | uploaded photos, scans and PDFs; typed questions, options, answers and figures; paper names; patterns, logos and Word templates | to make your papers |
| Usage and billing records | for each paper: its title, the teacher’s email, dates, number of pages and re-reads, answer-key questions, figures, exports and format, the AI model used, its token count and cost, and credits used | to count credits, bill fairly, find problems and improve Galley |
| Technical data | IP address, browser, error and security logs, sign-in attempts | to keep Galley secure and working |
| In your browser | a sign-in cookie (needed to stay signed in); your light/dark choice; the paper you have open | to make Galley work; no advertising or tracking cookies |
Galley is for teachers and school staff, not students. Please do not upload students’ personal information.
3. Where your data goes
| Who | What they receive | Where |
|---|---|---|
| Our server (rented from Hostinger) | school content, papers and uploads, kept in a separate area for each school; nightly backups kept 14 days | India |
| Anthropic (Claude AI) | page images and question text, to read pages, solve answer keys and redraw figures. Under Anthropic’s commercial terms this data is not used to train their models. | may be processed outside India |
| Supabase (sign-in and records) | account details, password hashes and usage and billing records, including paper titles; never the questions or uploads | [SUPABASE REGION] |
| Google (Gmail) | your email address and a 6-digit code, to send sign-in and password-reset emails | may be outside India |
These providers act for us and may use the data only to provide their service. We do not sell, rent or share your data for advertising. We may disclose data if the law requires it.
4. Who can see your school’s papers
- People your school adds can see your school’s papers. Teachers in the same school can see each other’s papers. No other school can see them.
- We (the Galley team) can see paper titles and usage numbers in our owner dashboard. We do not open your papers’ content, except when you ask us for support, when needed to fix a technical fault or keep Galley secure, or when the law requires it.
5. How we protect it
HTTPS on every page; each school’s files kept apart; passwords hashed; AI keys encrypted on our server; database access limited to checked functions; limits on repeated sign-in attempts; a firewall; and automatic security updates. No system is perfectly secure, so we cannot guarantee that data will never be accessed without permission. Please keep your password secret. Keeping question papers confidential is your school’s responsibility; see our Terms.
6. How long we keep it
- School content: while your school’s account is active, then deleted within [30] days of the account ending (backups expire within 14 days after that).
- Account details: until you or your school admin removes you.
- Usage and billing records: for as long as the law requires for accounts and tax (generally up to 8 years).
- Security logs: up to 90 days.
7. Your rights
Under the DPDP Act you may ask to see the personal data we hold about you, correct or update it, have it erased (unless we must keep it by law), and nominate someone to act for you. You may withdraw consent at any time; Galley may then stop working for you. Your school admin can also correct or remove your account. To make a request, write to [CONTACT EMAIL]. We reply within 30 days.
8. Grievance officer
[NAME], Grievance Officer · [EMAIL] · [ADDRESS]. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.
9. Changes
We will update this page and its date when our practices change, and tell school admins about important changes.