Sage
Privacy notice
Sage is an AI-native educational intelligence platform for parents of K–12 students. This notice explains exactly what we collect, why, who we share it with, and how to exercise your rights under India's Digital Personal Data Protection Act, 2023 (DPDP).
Who we are
Sage is operated by Perception, based in Bangalore, India. For the purposes of DPDP we are the Data Fiduciary — the entity that determines how your data is processed.
Contact: hello@perception.club. Grievance Officer: grievance@perception.club.
What we collect
About you (the parent)
- Full name and email address
- Hashed password (we never see your plain-text password)
- A memorable recovery phrase (hashed) so you can recover access without an email reset link
- Country (optional)
- Subscription plan + billing identifiers from Lemon Squeezy (we don't store card details ourselves)
- Account activity — last seen, login events, support grievances you've filed
- Optional nominee — a person you designate to act on your behalf if you become incapacitated (DPDP §14)
About your child
- First/full name, grade, curriculum board, school (optional), location (optional), gender (optional, to drive pronouns)
- Interests, activities, goals, and parent-reported concerns — entered by you
- Evidence documents you upload (school report cards, work samples, etc.)
- Sage-generated insights — intelligence profiles, gap analyses, roadmaps, badges, weekly briefs, Imagine snapshots
- Conversations between you and Sage's AI mentor
- Quick-capture journal entries you write about your child
- Letters you draft (and seal until a future date)
- Memory derived from the above — short structured notes Sage uses to maintain continuity across sessions
Why we process this data
Each purpose below corresponds to the checkboxes you tick on the intake screen. You can withdraw consent for any of them at any time:
| Purpose | What Sage does |
|---|---|
profile_generation | Build the Student Intelligence Profile — strengths, gaps, evidence, recommendations |
memory_storage | Store observations + evidence as memory so future generations are coherent |
mentor_chat | Power the AI mentor that answers your questions about your child |
weekly_brief | Generate the weekly briefing card (moment, conversation starters, question of the week) |
imagine | Generate plausibility-grounded future snapshots |
letters | Draft, store, and lock-until-unlock-date the letters you write to your future child |
journal | Store your quick-capture journal entries and feed them into Sage's memory |
documents | Parse + structure your uploaded evidence files |
heartbeat | Run autonomous Sage reviews on a cadence you control |
email_notifications | Send onboarding nudges + weekly digests (you can opt out anytime) |
Lawful basis (DPDP §6 + §9)
All processing is done on the basis of your explicit consent, captured when you save the intake form for each child. Because Sage's data subjects are children under 18, we rely on verifiable parental consent (§9): you confirm you are the parent or legal guardian at the moment of intake, and we record that consent with the version of this notice you agreed to, along with the IP address and timestamp.
Who we share it with
Sage uses five categories of third-party service: cloud infrastructure, AI language model processing, payment processing (Merchant of Record), transactional email, and content delivery / DDoS protection. We have a Data Processing Agreement in place with every provider in every category. The summary table — what each category sees, where it's processed, and what's deliberately excluded — is at perception.club/sage/subprocessors.
Specific provider names + DPA documents are available on request — email hello@perception.club. No data is sold to third parties. No data is shared for advertising. No data is used to train external AI models.
Where the data lives (§16, cross-border)
Sage's primary infrastructure and AI processing both run in the United States today, so some of your data is processed outside India. We only use providers that contract to keep it confidential and process it solely on our instructions. The Government of India has not, at the date of this notice, restricted transfers to those locations; if that changes we'll adjust accordingly. Your account works the same regardless of where you live. If you're outside India and want EU-region processing, write to us — we're working on it.
How long we keep it
- Active accounts: we keep your data as long as you keep using Sage
- Inactive accounts: after 24 months with no login, Sage automatically deletes your account and everything attached to it. We send a warning email before this happens
- Canceled accounts: deletion is immediate at your request via the Account page
- Payment / tax records: we keep transaction metadata for 7 years to satisfy Indian tax law, but it's unlinked from your identity once you delete your account
- Grievance log: kept indefinitely so we can demonstrate our response history if a regulator asks
Your rights under DPDP
You can exercise every right below from inside your Sage Account page, or by emailing the Grievance Officer:
- Right of access (§11): see exactly what Sage holds about you. The Account page shows live counts;
GET /me/data-summaryreturns the same as JSON - Right of data portability (§11): download all your data as a single ZIP archive. Account page → Download all my data, or
GET /me/export - Right to correction (§12): edit your profile and your child's intake at any time
- Right to erasure (§12): permanent deletion. Account page → Delete my account. We confirm by asking you to type your email; deletion is irreversible
- Right to withdraw consent (§6(4)): withdraw consent for any purpose; deletion is the most complete way to do this
- Right to nominate (§14): designate someone to act on your behalf in case of death or incapacity. Account page → Nominee
- Right to grievance redressal (§8(9)): file a grievance with our Data Protection Grievance Officer. We respond within 30 days
Security (§8(4))
- HTTPS everywhere with HSTS preload
- Passwords + recovery phrases stored as bcrypt hashes — never plain text
- Database encrypted at rest (AWS EBS volume encryption)
- Backups encrypted in transit and at rest (S3 server-side encryption)
- Internal admin actions are audit-logged
- Webhook payloads verified via HMAC-SHA256
- PII redaction filter on application logs masks emails and tokens
Breach notification
If we ever experience a personal data breach that affects you, we'll notify you and the Data Protection Board of India as soon as possible after discovery, with a clear description of what happened, what data was involved, and the steps we're taking.
Children's data (§9)
Sage's entire user model is built around parents acting on behalf of children, with verifiable parental consent before any processing. We do not let a child sign up directly. In line with §9(3) of the DPDP Act, for children we never:
- show targeted advertising — ever;
- carry out third-party tracking or behavioural monitoring of your child for our own or any advertiser's commercial purposes;
- sell personal data, or use your child's data to train external AI models.
Any analysis Sage does of your child's progress or behaviour is at your direction, as the parent, to help you support them — not surveillance, and never shared for advertising.
Your responsibilities (§15)
The DPDP Act asks you, as the Data Principal acting for your child, to:
- provide information that is authentic and not misleading;
- not impersonate another person when giving consent or data;
- not raise false or frivolous grievances.
These help us keep the record accurate and the service fair for every family.
Changes to this notice
When we make material changes we'll bump the version at the top of this page and, where appropriate, prompt you for fresh consent inside the app. Trivial wording changes won't trigger a re-prompt.
Contact
Questions, corrections, deletion requests, or to file a grievance: grievance@perception.club. General contact: hello@perception.club.