Privacy policy

Last updated: [date]

This policy explains how [legal entity name] (“we”) handles personal data in [service name]. For learning data inside an institute, the institute decides how it is used (it is the controller) and we process it on its behalf; for your account and our website, we are the controller.

1. What we collect

Account: name, email address, password (stored hashed) or Google sign-in, and the institutes and roles you belong to.
Learning activity: enrolments, lesson progress, quiz answers, submissions and files, grades, evaluation results and certificates.
Attendance: session check-ins (time and method). For in-person check-in with a geofence, your device's location at the moment you check in and a random device identifier used to stop shared check-ins. The camera is used only on your device to read the QR code; no images are uploaded.
Payments: order details, billing name and address, GSTIN if you give one, and payment status. Card and UPI details go directly to Razorpay or Stripe; we never see or store them.
Technical: sign-in sessions (IP address and browser), and security logs. We use only essential cookies (your sign-in session); [list any analytics, or state there are none].

2. Why we use it

to run courses and cohorts: access, progress, schedules, reminders and attendance;
to grade, evaluate and issue, verify, revoke or reissue certificates;
to take payments, issue tax invoices and credit notes, and handle refunds;
to keep the Service secure (rate limiting, fraud and proxy-attendance prevention) and to fix problems;
to meet legal obligations such as tax record keeping.

Legal bases (where applicable): performance of a contract, legitimate interests in running a secure service, legal obligation, and consent where we ask for it. [Adapt for GDPR / India DPDP Act / other applicable law].

3. What is public

A certificate's verification page is public to anyone who has its link or ID: it shows the holder's name, the course or cohort, delivery mode and venue, the institute, issue and expiry dates, and status. Certificate pages are [not listed / listed] in our sitemap. Nothing else about you is public.

Your institute's staff see what they need to teach and administer. We use these processors:

hosting and database: [hosting provider, region];
file storage: [storage provider, e.g. Cloudflare R2];
email delivery: Resend;
payments: Razorpay and Stripe;
video meetings, when the institute uses them: Zoom or Google Meet;
error monitoring: [e.g. Sentry, or none].

We don't sell personal data. We disclose data if the law requires it.

5. How long we keep it

Account and learning data are kept while your account or institute is active and [N months] after. Certificates and their verification records are kept so they stay verifiable unless revoked. Payment and tax records are kept for [period required by tax law, e.g. 8 years]. Backups expire after [backup retention].

6. Your rights

Depending on where you live, you can ask to access, correct, export or delete your data, object to or restrict some uses, and withdraw consent. For learning data, we may pass your request to your institute. Contact [privacy contact email]; you can also complain to [data protection authority].

7. Security and transfers

Data is encrypted in transit; certificate signing keys are encrypted at rest. Access is limited by role. If data is transferred outside [country/region], we use appropriate safeguards. [Describe transfer mechanism].

8. Changes and contact

We'll post changes here and update the date above; material changes will be announced in advance. Questions: [contact email and postal address]. See also the terms of service.