Privacy Policy

Who we are

Four Leaves is a sole proprietorship owned and operated by ABS Saurabh, with its principal place of business at 26 D/4 Park Road, Darbhanga Castle, Allahabad-211002, Uttar Pradesh, India. Our GSTIN is 09DTFPS3944N1ZU. Where this policy says "we", "us" or "our", it means that business and its proprietor, who is the data fiduciary for the personal data described below.

This policy explains how we handle personal data under India's Digital Personal Data Protection Act, 2023 and other applicable law. If you have a question or a request about your data, write to fourleaves.co.in@gmail.com and we will answer.

Who uses Four Leaves

Four Leaves is a service for educators and parents. You hold the account and you are the person using it. Our lessons are about children and are made for children to learn from, but children are not users of this service and we hold no data about them.

We do not create profiles for children. We do not ask you for a child's name, age or date of birth. We do not record which lessons a particular child has used, or anything else about an individual child. The only person whose personal data we process is you, the account holder.

What we collect, and why

We collect the minimum needed to give you an account and keep it secure. Nothing below is optional in the sense that we collect it quietly — these are the fields on the sign-up form, and the reason each one exists:

• Your name — so we can address you when you sign in. If you leave it blank we display the first part of your email address instead, and store nothing extra.
• Your email address — to identify your account, to confirm that the address is yours, and to let you reset your password. It is also how we would reach you about the service.
• Your password — stored only as a cryptographic hash by our authentication provider. It is never stored in a readable form, and nobody at Four Leaves can see it.

Our authentication provider also records when you created your account, when you confirmed your email address, and when you last signed in. We use these to operate and secure your account — for example, to tell a confirmed account from an unconfirmed one. Together with the three fields above, that is the complete contents of a Four Leaves account.

We process this data to perform the agreement we have with you — to provide the service you have asked for — and, where you have given it, on the basis of your consent. You can withdraw consent at any time by closing your account, as described below.

What we do not collect

This list matters as much as the one above, so it is specific rather than reassuring:

• No analytics. There is no Google Analytics, no tag manager, no advertising pixel, and no third-party tracking script of any kind on this website.
• No tracking, profiling or behavioural advertising. We do not build a profile of you, we do not follow you across other websites, and we do not advertise to you.
• No payment information. We do not currently take payments, so there is no card or bank data to hold.
• No data about children. No profiles, no names, no ages, no progress records.
• No phone numbers, and no sign-in through Google, Facebook or any other provider — so we receive no profile information from them.
• No IP address logging for ordinary visitors. There is one narrow exception for our own staff, described under “Our administrators” below.
• We do not sell your personal data, and we never will. We do not share it for anyone else’s marketing.

Cookies

If you are signed in, we set one kind of cookie: the session cookie that keeps you signed in as you move between pages. We set it ourselves, for that purpose alone, and it is refreshed as you browse. If you are signed out, we set no cookies at all. There are no analytics or advertising cookies on this site, because we run no analytics or advertising.

Clearing that cookie signs you out. You can block it in your browser, but you will not be able to stay signed in.

One exception deserves stating plainly. Some lesson plans include a video. We embed those through YouTube's privacy-enhanced domain, with related-video suggestions and channel branding turned off, and nothing is requested from YouTube until the page displays the player. If you press play, Google receives that request and may store information on your device under its own privacy policy, which we do not control. If you would prefer that did not happen, do not play the video.

Where your data is stored, and who processes it

We use established service providers rather than running our own infrastructure. That means your data is processed outside India, and we would rather set out exactly where:

• Supabase stores your account and our lesson content in its Seoul, South Korea region (ap-northeast-2). This is where your name, email address and password hash live.
• Vercel hosts this website and assembles its pages in its US East region. Like any web host, Vercel keeps operational request logs that include IP addresses, under its own retention schedule.
• Resend delivers our account emails — address confirmation and password resets. It processes your email address and the contents of those messages in order to send them.

Each of these providers acts as a data processor on our instructions and under contract, and may process your data only to provide their service to us. They are not permitted to use it for their own purposes. We review this list when we change providers, and this page is updated when we do.

Our administrators

A small number of Four Leaves staff accounts can add and remove lesson plans. Every time one of them does, we record which staff account acted, what they changed, when, and the IP address they acted from. This is an internal accountability record that we deliberately cannot edit or erase, because its entire purpose is to be a reliable account of changes to the library.

This applies only to our own staff acting as administrators. It never applies to you as a customer, and no equivalent record is kept of ordinary account activity.

How long we keep your data

• Your account — for as long as your account is open. If you ask us to close it, we delete your account and the personal data in it within 30 days of confirming the request.
• Our administrator accountability record — for three years from the action it describes. These entries concern our own staff, not customers, and are kept so that changes to the lesson library remain auditable. They are designed to outlive the staff account that created them, and so are not removed when that account is closed.
• Email delivery and web server logs held by our providers — according to each provider's own retention period, which is short and which we do not control.

If you have not confirmed your email address, your unconfirmed account is removed after 30 days.

Your rights

Under the Digital Personal Data Protection Act, 2023 you have the following rights over your personal data, and we will honour them without charge:

• Access — ask us for a summary of the personal data we hold about you and how we process it.
• Correction and completion — ask us to correct anything inaccurate or complete anything incomplete. You can change your own name and email address from your account at any time.
• Erasure — ask us to delete your personal data and close your account. We will do so within 30 days, except where we are required by law to keep something.
• Withdraw consent — withdraw any consent you have given. Because the account itself depends on processing your email address, withdrawing it means closing your account.
• Nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — complain to us about how we have handled your data, and escalate to the Data Protection Board of India if our answer does not satisfy you.

To exercise any of these, write to fourleaves.co.in@gmail.com from the email address on your account. We may ask you to confirm who you are before we act, so that nobody else can make a request about your data. We will respond within 30 days.

Grievance redressal

If you are unhappy with how we have handled your personal data or a request about it, contact our grievance officer at fourleaves.co.in@gmail.com, with "Grievance" in the subject line. We will acknowledge within 7 days and resolve within 30 days.

If you remain dissatisfied, you may complain to the Data Protection Board of India.

How we protect your data

Your password is only ever stored as a hash. The connection to this site is encrypted. Access to your data in our database is restricted at the database itself and not only in our application code, so a mistake in the website cannot expose another person's account. Lesson files are held in private storage and released only through short-lived links issued after we have checked that you are signed in.

No service can promise it will never be breached. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

Children

Four Leaves accounts are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

We update this page when our practices change, and the date at the top tells you when that last happened. If a change materially affects how we handle your data, we will tell you by email before it takes effect. This version describes the service as of 6 October 2026.

Contact

Questions about this policy, or a request about your data: fourleaves.co.in@gmail.com.

See also our Terms of Service. Questions: fourleaves.co.in@gmail.com.