Privacy Policy

This policy explains how elluminar (entity name pending incorporation details) (“elluminar”) processes personal data as a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and other applicable law. It covers learners, creators, mentors, and visitors.

• Account data — name, email, phone (optional), password hash, profile details, timezone.
• Learning data — enrollments, lesson progress, quiz attempts, project submissions, mentor reviews, credentials.
• Commerce data — orders, invoices, subscription status, refund requests. Card and banking details are processed by our payment partner (Razorpay) and never stored by us.
• Technical data — device and log information, cookies (see section 7), and error diagnostics.

We process personal data to provide the service you signed up for (contract), with your consent where required (e.g., marketing communications, public portfolios, talent-pool visibility), and to meet legal obligations (tax invoices, accounting records). We do not sell personal data.

• Processors — Supabase (database and storage), Razorpay (payments), Fermion (video, live classes, code labs), Resend (transactional email), Sentry (error monitoring), Netlify (hosting). Each processes data under contract, only on our instructions.
• Creators and mentors — see your progress and submissions for content you enrolled in with them.
• Public, only if you opt in — portfolio pages, credential verification pages, and hiring-partner visibility are consent-first and controllable from your settings.

You may access, correct, and update your data from your account settings, withdraw consent for optional processing, nominate a person to exercise rights on your behalf, and request erasure. Erasure is implemented as anonymization: your personal identifiers are irreversibly overwritten while non-personal records we must retain (e.g., tax invoices) are kept as law requires. To exercise any right, write to grievance@example.com. If unsatisfied, you may escalate to the Data Protection Board of India.

Account and learning data is retained while your account is active and for up to 90 days after a deletion request completes processing. Financial records (orders, invoices, ledgers) are retained for 8 years as required by Indian tax and company law, dissociated from your identity after anonymization.

We use strictly necessary cookies for sign-in sessions and cart state. Optional analytics cookies are set only after you consent via the cookie banner, and you can change your choice anytime from the banner settings. We do not use third-party advertising cookies.

Data is encrypted in transit, access is role-restricted, payments are handled by PCI-DSS-compliant partners, and we maintain audit logs on administrative actions. No system is perfectly secure; we notify affected users and the Data Protection Board of breaches as the DPDP Act requires.

The platform is not directed at children under 18. Where a minor uses the platform, verifiable parental consent is required and we do not serve behavioral advertising to minors.

Grievance Officer: grievance@example.com · all contact details. We will notify you of material changes to this policy before they take effect.