Privacy Policy

Gyanank helps researchers, institutions and field teams build surveys with AI assistance, collect responses, and get AI-assisted statistical analysis of the results. This page explains what we collect, why, and what rights you have — whether you're a researcher with a Gyanank account, or someone answering a survey built on Gyanank.

Two kinds of people use this site

Researchers create an account, design surveys, and view/export their own results. Respondents answer a survey through a public link, QR code, or WhatsApp share — no account needed. What we collect, and why, is different for each.

What we collect from researchers

• Name, email address, and a hashed (never plain-text) password, when you register.
• If you choose Continue with Google: the email address and name Google shares with us, and the number Google uses for your Google account, so we can recognise you next time. We receive nothing else from your Google account, and an account made this way has no password with us.
• The surveys you create — titles, questions, consent text, and any language translations you generate.
• Basic usage data: how many AI requests your account has made, so we can show you that on your dashboard.
• If you first arrived through a link we shared (for example on WhatsApp), the one word in that link that names the channel, so we know which of our own channels bring researchers here. It is not shared with anyone. We also count how many times each of those links is opened, as a daily total per link, with nothing recorded about who opened it.

What we collect from respondents

Only what the survey you're answering actually asks. Gyanank's question-generation AI is instructed not to ask for your name, email, or phone number unless the researcher explicitly designed the survey to ask for one — most surveys are anonymous by default. We also record the language you answered in, how long the form took to fill in, and whether you answered on a phone, a tablet or a computer — which helps researchers spot low-quality or automated submissions and report how their study was completed. The browser identification string itself is never stored, only which of those three it was, because the full string is detailed enough to act as a fingerprint.

We set one small, functional cookie per survey (not for tracking or advertising) so that if you've already submitted a response on this device, you see a thank-you page instead of a fresh form.

Documents you attach to a response

Some surveys ask you to attach a document — a payment slip, a receipt, a scanned form. If you attach one, here is exactly what happens to it.

• Only PDF, JPEG and PNG files are accepted, decided by reading the file itself rather than trusting its name, and there is a size limit (500 KB, or up to 100 MB on a researcher's paid plan).
• It is stored in Microsoft Azure Blob Storage in Central India, in a private container with public access switched off, under a randomly generated name. Your own filename is kept only so the researcher can see what you called it.
• Microsoft Defender for Storage scans it automatically for malware, and also classifies whether it appears to contain sensitive information. This is an automated security service, not a person reading your document. If a file is flagged as malicious, Gyanank refuses to hand it over to anyone, including the researcher.
• The researcher who owns the survey can view and download it. Nobody else can: the link is checked against that researcher's account on every request.
• It is deleted when your response is deleted, when the survey is deleted, when the researcher's account is deleted, and by the automatic retention sweep described below.
• It is never sent to an AI model, never read as text, and never analysed — not even its filename.

Please attach only what the question asks for. If a document shows more than the study needs — an identity number, an address, someone else's details — cover or crop it before attaching. A researcher should not ask you for an identity document unless their study genuinely requires one and they have said why.

People who register for a program

An organiser can use Gyanank to invite people to a program, such as a talk, a course or a health camp. If you register for one, Gyanank keeps what the invitation asks: your name and mobile number, your email address if the organiser asks for it, and your answers to the organiser's questions, with the language you used and when you registered. The organiser sees them, to plan the program and to check you in at the entrance. Gyanank uses them for nothing else and never sends them to an AI model.

If you give an email address, Gyanank emails you about the program and nothing else: the confirmation, a reminder a day before and two hours before it starts, and any change the organiser announces. These come from noreply@gyanank.com through Zoho CPaaS, on Zoho's servers in India.

Gyanank also sends the same messages to the mobile number you register with, on WhatsApp: the confirmation, the reminders, and any change the organiser announces. If the organiser turns it on, a 6-digit code is sent to that number on WhatsApp before you register, to check the number is yours; only a scrambled form of the code is kept, for ten minutes. These messages go from Gyanank's WhatsApp business number through Zoho CPaaS (India) and Meta's WhatsApp service.

Your pass is a page whose link only you are given. It shows your name and the program's details, never your mobile number or email address. Your browser keeps one small cookie for that program, holding your pass's code, so the invite page can take you back to your pass.

You can cancel from your pass at any time, which deletes your registration at once. Otherwise registrations are deleted automatically 90 days after the program ends, or sooner if the organiser deletes the invitation or their account.

People we are in touch with

Gyanank's own team keeps a record of the researchers, guides and institutions it talks to about Gyanank — at a talk, through a colleague, or because you wrote to us — including people who never create an account. It holds your name, your email address and phone number if you gave them, your role or course, your institution, how we came to know you, where our conversation stands, the date we plan to contact you next, and dated notes of what was said.

Only Gyanank's administrators see this record, in the administration console, and only to follow up on that conversation. It is never shown to respondents, never used for advertising, and never sent to an AI model. It is kept until we remove it, and creating or deleting a Gyanank account does not change it. To see, correct or remove your record, write to our Grievance Officer (see Your rights, below).

How AI is used, and what it does not see

Gyanank uses AI in seven places: drafting a questionnaire from a study description, drafting the wording of an invitation to a program from the organiser's own description, refining a questionnaire on request, translating it into other languages, choosing which statistical test fits a question asked about the data, writing a plain-English explanation of the result, and, for Gyanank's own team, suggesting general lessons for the analysis feature from logged questions whose right analysis is known (an answer a researcher marked not useful, one Gyanank's team checked, or a test question the AI missed) and any note the researcher left, with the survey's own words taken out first. The actual numbers are always computed by Python's statistics libraries, never by the AI.

Your individual survey answers are not sent to any AI provider. Only the researcher's own text and statistics computed from the responses — a mean, a count, a p-value, how many chose each option — are ever passed to an AI model. Nothing that identifies you goes with them: no reference code, no participant code, no name or contact detail, and never a written answer, a signature or an attached document. So even in a small study, where a statistic may sit close to one person's answer, the AI receives numbers about people it cannot identify.

To keep improving the analysis feature, Gyanank keeps a log of the questions a researcher types into Ask your data, the analyses chosen for each, a one-line summary of each computation and the written answer — the same aggregates that were sent to the AI, and never an individual response. The researcher can mark an answer as useful or not. Questions a researcher marked useful are shown back to the AI as examples when that same researcher asks again — never to another researcher. Gyanank's team also sends logged questions back to the AI to check and improve it: after the AI changes, when trying out a lesson for it, and, for an answer a researcher marked not useful, to ask what else it could have done, with the researcher's note. A lesson is one short instruction in general words, such as “when a question is about one group only, look only at that group”; it is written by Gyanank's team or suggested by the AI, and a person at Gyanank approves each one before the AI uses it for every researcher. Gyanank's administrators read this log; it is deleted after 90 days.

Rarely, a lesson may contain a word that also appears in a researcher's questionnaire, such as the name of a place, when a person at Gyanank decides the lesson needs it. Such a lesson is not deleted when that survey or that researcher's account is deleted.

Where your data lives, and cross-border processing

The application, its database and any documents attached to responses all run on Microsoft Azure infrastructure in India — the web application, database and document storage in Central India, and the AI resource in South India (where a request to it may be processed is described below). Backups are managed by Azure using its standard retention practices.

Payments are handled by Razorpay, an Indian payment gateway, on infrastructure in India. Email (verification and password-reset messages) is delivered through GoDaddy's mail servers. Emails about a program you registered for are sent through Zoho CPaaS, in India.

The AI provider on Gyanank's backend is Azure OpenAI. Its resource is in South India, but it is a global deployment: Microsoft may process a request in any of its data centres worldwide, and states that data at rest stays in the resource's region. So the researcher's text and the statistics described above may be processed outside India, while nothing is stored outside it. This is a cross-border transfer permitted under section 16 of the DPDP Act: no destination is currently restricted by the Government. This can change if the active provider changes — check back here for the current status.

How long we keep it

A survey and its responses are kept while the researcher's study is running. Once they close the survey, responses are automatically and permanently erased no later than 365 days after closure, unless a law requires us to keep them longer — reopening the survey resets this clock. A researcher can also delete a survey, or their whole account, immediately at any time (see Your rights, below), which erases the associated responses right away rather than waiting for this window.

When an account is closed, its sign-up details — the name, the email address, when the account was opened and closed, and which terms were accepted — are kept for 180 days, as the Information Technology Rules require of a platform that hosts other people's forms. Only Gyanank's administrators can see them, only for a lawful request, and they are erased automatically after that.

Registrations for a program are deleted 90 days after the program ends, or at once when you cancel (see People who register for a program, above).

Contact records kept by Gyanank's team (see People we are in touch with, above) have no automatic expiry: they are removed when we remove them, or when you ask us to.

Documents attached to a response follow the response exactly: they are erased at the same moment, by the same actions, whether that is you deleting your own response, the researcher deleting the survey or their account, or the automatic sweep above.

Payment records are the one thing we keep on a different clock. When a researcher buys a Study Pass or a subscription we record the payment identifier, amount, currency and status so the purchase can be reconciled — never the card or UPI details, and never the payment provider's raw message, which carries their contact and instrument data. These are financial records and are kept for the period Indian tax and company law requires, rather than being swept with research data.

Access logs (who opened what, and when, with a one-way fingerprint of the IP address rather than the address itself) are kept for 400 days, which is the minimum the DPDP Rules require for this kind of record, and then deleted automatically.

Security and administrator audit records can include an account identifier or email snapshot, the action and outcome, a reason, target record, timestamp, and a one-way IP fingerprint. We use these only to prevent abuse and investigate privileged activity. They are retained for 400 days and then automatically deleted. If an account is deleted, its email snapshot and direct user link in those records are immediately replaced with a pseudonymous deletion marker; the remaining event is kept only for that limited security period.

Your rights

Whether you're a researcher or a respondent, you can ask us to tell you what personal data we hold about you, correct inaccurate data, erase your data, or withdraw consent you previously gave — at any time and as easily as you gave it. Concretely:

• Respondents: the reference code shown after you submit a response lets you view, correct (by deleting and resubmitting), or permanently delete that response yourself, with no account needed, at Find my response.
• People registered for a program: your pass has a button to cancel, which deletes your registration. For anything else, contact the organiser or our Grievance Officer.
• People we are in touch with: write to our Grievance Officer to see, correct or remove the record we keep of you; there is nothing to log in to.
• Researchers: your Account page lets you download your account, research data, and relevant retained administrator-audit events, or permanently delete your account and every survey and response you own immediately. Limited security evidence is pseudonymised on deletion as described above. Your sign-up details are kept for 180 days after that, as described under How long we keep it.

For anything these tools can't do, or to raise a complaint about how your data has been handled, contact our Grievance Officer at admin@gyanank.com. We acknowledge every request within 24 hours and resolve it within 15 days. If you're not satisfied with our response, you may also raise a complaint with the Data Protection Board of India.

Children's data

Gyanank is not directed at children. Every respondent form requires confirming you're 18 or older, or that a parent/guardian is assisting you, before it can be submitted. We do no tracking, profiling, or advertising of any kind — to anyone, child or adult. Researchers whose studies involve minors are contractually required (see our Terms) to obtain verifiable parental consent per the DPDP Act and their institution's ethics process. If you believe a child's data was collected without appropriate consent, contact us and we'll remove it.

Nomination (Section 14, DPDP Act)

You may nominate another person to exercise your data-protection rights if you die or become incapacitated. Gyanank supports this as a simple written process: the nominee (or you, in advance) writes to our Grievance Officer at admin@gyanank.com with the reference code (for a survey response) or account email (for a researcher account), the nominee's identity, and reasonable proof of nomination or of death/incapacity. We act on verified requests within the same timelines as any other rights request.

Security

Passwords are stored as salted hashes using scrypt, never in plain text, and are re-hashed at the current strength when you log in. Logging in with a password also needs a one-time code: from your authenticator app if you use one, otherwise a code we email you. The emailed code is asked for on each new phone or computer, which is then remembered for 30 days by a small cookie in that browser. Changing a password signs the account out everywhere and forgets every remembered device. Logging in with Google relies on Google's own checks instead. Administrator accounts always use an authenticator app.

All traffic to Gyanank is encrypted in transit (HTTPS). Access to survey data is restricted to the researcher who owns that survey, checked on every request. Attached documents sit in a private container with public access disabled, are scanned for malware, and are refused if flagged. We use rate limiting and abuse-detection measures to protect the respondent form from bots and spam.

Who else processes data for us

We share data only with the providers needed to run Gyanank. Nothing is ever sold, and nothing is shared for advertising. Each of these acts on our instructions, for the one purpose named:

If we add or replace one of these, this list changes and the date at the top of the page changes with it. Everything in the table above is in India except GoDaddy's email delivery and WhatsApp messages, which are cross-border transfers permitted under the DPDP Rules, 2025 — no Government restriction currently applies to it.

If something goes wrong

If personal data held by Gyanank is lost, exposed or accessed without authorisation, we will notify every affected person and the Data Protection Board of India as required by section 8(6) of the DPDP Act — describing what happened, what it means for you, what we have done about it, and what you can do. For a survey response, "notify you" means telling the researcher who runs that study and publishing a notice on this site, because we deliberately hold no contact details for survey respondents. For a registration for a program, we also tell you directly, using the contact details you gave when you registered.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page. Significant changes will be flagged to registered researchers on their next login.

Contact

Questions, requests, or complaints about how Gyanank handles personal data: admin@gyanank.com (Gyanank Technologies Private Limited).