About CatalystBox
CatalystBox is a national education feedback and intelligence platform operated by Fresh Eye Foundation — a civic intelligence organisation registered as a One Person Company under the Companies Act of India, headquartered in Uttar Pradesh.
For the purposes of the Digital Personal Data Protection Act 2023, Fresh Eye Foundation is the Data Fiduciary for all data processed through CatalystBox. Privacy contact: hello@catalystbox.in.
Where This Policy Applies
This Privacy Policy covers: the CatalystBox website at catalystbox.in, the CatalystBox analytics dashboard, and all anonymous feedback forms deployed by CatalystBox to schools and institutions.
It governs three groups: feedback respondents (students, teachers, parents who submit feedback), website visitors (anyone who browses catalystbox.in), and dashboard users (school administrators and board officials who access the analytics platform). Each group is addressed separately below.
When You Submit Feedback
This is the most important section for students, teachers, and parents. Read it carefully — it explains exactly why you are safe when you speak through CatalystBox.
"We have built CatalystBox so that identifying who submitted a response is architecturally impossible. Not just against policy — impossible."
What we collect from you
- School identifier code — pre-filled in the form link. Identifies the school, not you.
- Academic year — pre-filled. Used for trend analysis over time.
- Respondent type — student, teacher, or parent. A category, not an identity.
- Scaled survey responses — your numeric ratings for school quality questions.
- Open text response — optional. AI-processed for sentiment only. Never shared. Please don't include personal names.
- Gender — student forms only, aggregated. Used for the girl student experience metric. Not used for identification.
- Submission timestamp — server-generated. Used for fraud detection at school level.
What we never collect from you
Your name, email address, phone number, device ID or fingerprint, IP address (not logged), GPS location, photograph, biometric data, social media profile, caste or religion. These fields do not exist in our forms. They cannot be submitted.
Legal basis
Processing is based on your voluntary consent by choosing to submit the form. Because we collect no personal identifiers, most of what we hold does not constitute "personal data" under the DPDP Act 2023. We nonetheless apply the Act's standards as a matter of policy — not just legal compliance.
When You Visit catalystbox.in
Our hosting infrastructure transiently processes your IP address to serve the page to your browser. We do not store it. It is not logged. It is not associated with your visit.
CatalystBox does not use Google Analytics, Meta Pixel, or any third-party behavioural tracking on its website. We do not track you across sessions or across sites. Our website sets no persistent cookies when you browse it.
School Admin & Board Access
School administrators and board officials who access the CatalystBox analytics dashboard have accounts in our system. We hold: email address (for login), assigned role, affiliated institution, and account timestamps.
This data is used solely to provide authenticated access. It is not used for marketing or profiling. Accounts can be deleted at any time by writing to hello@catalystbox.in. Accounts inactive for 12 months are deleted automatically.
We Don't Track You
The CatalystBox website
No cookies. No tracking scripts. No analytics. Visiting catalystbox.in leaves no traceable record with us beyond what hosting infrastructure processes transiently to serve the page.
Feedback forms
Our feedback forms are delivered through a third-party form provider. That provider may set functional cookies as part of their infrastructure — governed by their own privacy policy. We do not access or process any cookies they set.
Dashboard application
The dashboard maintains your session using a session token that expires automatically after 8 hours. It is used for no purpose other than keeping you logged in.
CatalystBox uses no advertising or remarketing technology anywhere. No Meta Pixel. No Google Ads. This is a permanent commitment.
Data Used Only for School Intelligence
Feedback response data
- Scoring: Compute school quality dimension scores and the CatalystBox composite benchmark index.
- Sentiment analysis: Extract qualitative signals from optional open text to detect school-level patterns.
- Benchmarking: Aggregate school scores into city, district, state, and national comparisons.
- Research: Provide anonymised aggregated datasets to research partners — no individual response data is used for this purpose.
- Fraud prevention: Detect and exclude anomalous or duplicate submissions at school level.
Website and dashboard data
- Page delivery: IP addresses processed transiently by hosting infrastructure only. Not stored by us.
- Authentication: Dashboard account details used to verify identity and authorise access only.
We do not use any data for advertising, marketing, behavioural profiling, or training AI models. We do not sell data. Full stop.
Who We Share Data With
CatalystBox shares data only in these specific circumstances:
- With schools: Their own aggregate scores and trends only. No individual responses. No other schools' data.
- With education boards: Aggregate metrics for affiliated schools only. No individual responses.
- With infrastructure providers: Third-party services that power our operations process data as required for those specific functions only, under data processing agreements.
- With research partners: Anonymised, aggregated datasets under signed agreements with anonymisation requirements and minimum cohort size thresholds to prevent re-identification.
- Under legal compulsion: Only when required by a valid, binding legal order from a competent Indian authority. We notify affected parties to the extent the law permits.
We never share individual response data, school scores with unaffiliated parties, or any data with commercial data brokers or advertisers.
Extra Protection for Every Student
CatalystBox is used by students — many of them under 18. The DPDP Act 2023 imposes specific obligations on systems handling children's data. Our architecture goes further than the law requires.
Because CatalystBox collects no personal identifiers from any respondent, it does not hold personal data about children in the conventional sense. Beyond that architectural guarantee, we apply these specific additional safeguards:
We do not build individual profiles from student responses. We do not use student data for advertising, recommendations, or targeting of any kind. Data from student submissions will never be sold or commercially transferred. This restriction is permanent and not subject to revision.
Open text from student forms is deleted after 12 months — shorter than numeric responses — because free text carries a greater risk of inadvertent personal disclosure.
CatalystBox has no direct contact with students outside the anonymous form. Schools that deploy our QR codes are responsible for communicating the voluntary and anonymous nature of participation to students and for applying any applicable child safety obligations.
If you have concerns about data from your child's school, write to hello@catalystbox.in. We cannot retrieve a specific student's response — by design, we cannot link any response to any individual. But we can confirm our practices in writing and provide assurance of deletion per our schedule.
Your Rights Under DPDP Act 2023
Under the Digital Personal Data Protection Act 2023, you have rights with respect to personal data held about you. Here is how those rights apply given our anonymous architecture.
🗂️ Right to Access
For feedback respondents: we hold no identifying information — no record linked to you exists. For dashboard users: contact us to receive a copy of your account data.
✏️ Right to Correction
For feedback respondents: responses cannot be linked to your identity. For dashboard users: contact us to update your account details.
🗑️ Right to Erasure
All response data is automatically deleted per our retention schedule. Dashboard users may request account deletion at any time. Completed within 30 days of request.
🔄 Right to Withdraw Consent
Participation is voluntary. Simply not submitting a form is all that is required. Dashboard users may request account closure at any time.
📢 Right to Grievance Redressal
Raise any privacy concern at hello@catalystbox.in. We acknowledge within 3 business days and resolve within 10 business days.
⚖️ Right to Escalate
If unsatisfied with our response, you have the right to escalate to the Data Protection Board of India under the DPDP Act 2023 framework.
How We Protect Data
CatalystBox implements encryption in transit (TLS/HTTPS), encryption at rest, role-based access controls, and audit logging across all systems.
The most meaningful security measure is structural: a breach of our response database cannot expose personal information about respondents — the database contains none. The only data at risk in a security incident is school-level aggregate metrics, which are not personal data.
In the event of a security incident, we follow our Data Governance Charter — containing the incident within 24 hours, notifying affected parties within 72 hours, and publishing a public summary within 30 days.
When This Policy Changes
Material changes — any change that reduces privacy protections or alters how we use data — require a minimum 30-day public notice period before taking effect.
Non-material changes — clarifications, corrections, additions for new features using the same data model — may be made without notice.
The current version is always at catalystbox.in/privacy.
Questions? Reach Out.
CatalystBox — Privacy
A product of Fresh Eye Foundation · Uttar Pradesh, India
We acknowledge all privacy communications within 3 business days and provide a substantive response within 10 business days. For technical data architecture details, see our Data Governance Charter.