BYS information
Bright Young Scholars (BYS) Privacy Policy — R1 Discovery
Version R1.0 · Effective 2026-10-21
Who we are and what this notice covers
Bright Young Scholars (BYS) is a concept/programme of BSquare Matrix LLP, a registered Limited Liability Partnership (LLPIN ACI-2363). Its registered office is 4/461, 2nd Floor, Valamkottil Towers, Judgemukku, Thrikkakara, Ernakulam, Kerala – 682021, India. This notice explains how we use information in the BYS Discovery portal at portal.by-s.org, including Parent accounts, linked learner profiles, My Learning Journey, Books, BYS Shelf and service communications.
Discovery is currently offered without a subscription fee. Choosing not to use Discovery does not prevent a family from considering any future Access or Guided programme when separately offered and approved. Paid Access and Guided programmes, checkout, Coins and formal evaluation are not operational parts of this release. This notice does not describe those future services as available.
Effective date: 21 October 2026. Version R1.0.
The Parent and learner relationship
The current experience is Parent-mediated and designed for learners aged 7–17. An adult Parent or authorised Guardian manages the account and supplies information for children they are entitled to represent. Before a linked learner profile is created or activated, BYS requires an explicit Parent/Guardian authority declaration and affirmative acceptance of the separately versioned Parent/Guardian Consent & Child Data Notice for that learner/profile. Parent account creation alone is not either declaration. Children do not receive an independent R1 login. One Parent account may manage up to three linked learners in the current pilot, with separate records for each.
Please explain the experience to your child in language they understand. Capture their views faithfully and distinguish their words from your own observations. Do not provide another family's information, unnecessary sensitive details or material you are not entitled to share. Contact us if your authority to act changes or is disputed.
Information we collect and why
Information: Parent/Guardian name, email and mobile number; optional city, town or village Purpose: Create and verify the Parent account, communicate about the service and support the correct family. The verification request stores contact information before account activation.
Information: Password hash, verification/activation/recovery records, session and security information Purpose: Authenticate you, protect access, prevent misuse and support account recovery. Never send us your password or a one-time link.
Information: Learner name, date of birth, relationship to the Parent and authority attestation Purpose: Keep profiles distinct, understand age context and establish the claimed family relationship. A date of birth does not itself grant Discovery access.
Information: Notice versions and effective dates, acceptance time, Parent reference, authority confirmation, communication preference and optional promotional choice Purpose: Record what was accepted and when. A separate versioned Child Data Notice acknowledgement must also be tied to the exact published text and the linked learner/profile before that learner's R1 data is activated. Later acceptance is recorded without silently replacing earlier history.
Information: Discovery requests, decisions, approved dates, temporary reference, status and decision history Purpose: Operate the Parent-level Discovery period and explain its current state. The temporary reference is not a permanent Learner Code.
Information: Journey answers, their recorded source, optional Parent observations, draft/final records, clarification, review and publication versions Purpose: Support a private record of the child's experiences and human review. The current form identifies the answers required for final submission; optional prompts may be left blank.
Information: Optional profile photograph and supporting PDFs/images, file metadata and review information Purpose: Provide context for the private Journey. Do not upload medical reports, identity documents, financial details or information about other people unless specifically necessary and lawfully authorised.
Information: Books marked Read or To Read, optional author, note and completion date; Shelf selections and curation history Purpose: Maintain the selected learner's reading list and BYS-curated resource suggestions. Shelf is not a shop and does not require a purchase.
Information: Support messages, service email records and delivery outcomes Purpose: Respond to requests, deliver essential account messages and investigate delivery failures.
Information: Technical request information, timestamps, device/browser information, network addresses and security events where recorded by us or our providers Purpose: Operate the site, diagnose faults and protect accounts. We minimise the information needed for these purposes.
School, height and weight are not required by the R1 Discovery profile. Please avoid putting sensitive or unrelated details in free-text fields or uploaded files.
Private records and human review
Your family's records are not public profiles. Access is limited to the authorised Parent account and authorised BYS personnel who need it for the relevant task, with service providers supporting operation as described below. Siblings retain separate Journey, Books and Chosen-for-learner Shelf records. The wider published Shelf catalogue is shared resource information, not another child's private curation.
Final Journey submission locks the original. BYS may request clarification, publish a reviewed version privately to the family, or decide not to publish. Corrections retain a traceable history rather than silently rewriting the final submission. “Publication” in this workflow means a private family view, not publication on the public website.
R1 Journey is not a diagnostic assessment, formal evaluation, ranking or Coin award. We do not derive personality, ability or mental-health labels from these reflections. Public sample profiles are fictional and operationally separate. Uploading a private record does not authorise its use in public samples, marketing or Journals.
Communications and browser storage
We use the account email for verification, activation, recovery and other essential service communications. Choosing a routine contact preference does not replace necessary security messages or guarantee that a particular messaging integration is available. Optional promotional communications require a separate choice; they are not a condition of Discovery. Contact us to change that choice.
The portal uses necessary browser cookies for authentication and request protection, and limited browser-session storage to avoid duplicate actions. Blocking required cookies can prevent sign-in or saving work. No advertising or behavioural recommendation system is part of this R1 experience.
Providers and disclosures
We use Railway for application/database hosting and recovery infrastructure, Resend for transactional email when enabled, Google Workspace for BYS correspondence, and Cloudflare for domain/DNS services. Providers receive information needed for their service, such as recipient and message information for email delivery. Infrastructure and support processing may occur outside India; this is not an India-only storage service.
We do not sell learner records, use private Journey content as advertising material, or use learner activity for targeted advertising. We may disclose limited information when required by applicable law, a valid legal process, or necessary action to protect people and the service. Any additional external publication or materially different use requires its own appropriate notice and authority.
External resources, when available, operate under their own notices. No Journals gateway is currently active in the portal. Selecting a link later does not make that external service part of your private family record.
Retention, closure and deletion
We retain personal information only for as long as reasonably required for the relevant programme, operational, security and legal purposes. Information no longer required may be deleted or irreversibly anonymised. Expiry or closure of a Discovery period stops the relevant entitlement but does not itself erase the account or a child's history. Closing one learner does not delete an active sibling's records.
For a learner or account closure request, BYS checks the requester's authority, any active sibling records and any applicable operational or legal reason to retain limited information. We will explain an unresolved closure step instead of treating an unanswered request as completed. The approved internal Portal Data Retention Policy / Retention Schedule governs the detailed periods and disposal process; this notice does not make a fixed-day deletion promise.
Backups are internal operational safeguards, not a separate learning archive or a promise that any particular record can be restored. Backup copies expire through controlled retention cycles. Deletion from the live portal and expiry of recovery copies are separate steps. BYS must reconcile authorised working copies and recovery copies with completed closures, and reapply required deletions before restored data is returned to service. A live-deletion receipt is not, by itself, proof that every copy has expired.
Where applicable law or a valid legal hold requires a limited record to remain, we restrict it to that purpose, separate it from ordinary learning use, record the reason and review when it can be deleted. This exception is not a general reason to retain a child's complete portfolio indefinitely.
Your choices and requests
You may choose not to request Discovery and may omit optional profile or Journey material. If you do not provide information necessary to operate an account or establish authority, we may be unable to provide the relevant service. You may ask to correct information, change communication choices, withdraw consent or close a learner/account by contacting BYS. Withdrawal may end the service that depends on that information; it does not cancel a lawful retention requirement.
We may ask for proportionate information to verify your authority before disclosing, correcting or deleting family records. Do not email passwords, recovery links, identity documents or learner attachments as the first step. We will explain the appropriate secure process and any applicable limitation. An account-specific access or correction request must not expose another family or sibling's information.
Security and concerns
We use access controls, HTTPS, protected credentials, request protections and audit records to reduce unauthorised access. No online service can promise absolute security. Keep your credentials and one-time links private, sign out on shared devices, and tell us promptly if you suspect misuse. We will address security incidents and required notifications under the applicable rules.
General and privacy enquiries and grievances: info@by-s.org. Phone: +91 94953 38900. Grievance Officer: Vishnumaya. BYS will acknowledge and log complaints, route and investigate them, respond within applicable legal requirements, and escalate serious or unresolved matters internally. Portal: https://portal.by-s.org. Operator: BSquare Matrix LLP (LLPIN ACI-2363), registered office 4/461, 2nd Floor, Valamkottil Towers, Judgemukku, Thrikkakara, Ernakulam, Kerala – 682021, India. This contact route is not an emergency service.
Changes to this notice
We will identify the applicable version and effective date when publishing changes. Where renewed acceptance is required, we will ask for it and keep the historical acceptance record. We will not treat a new notice as permission to silently repurpose previously supplied child information.