Privacy Policy

Commerce Study Connect ("we", "us", or "our") respects your privacy. This policy explains how we process digital personal data when you use our website, courses, quizzes, account features, and support channels. It is intended to describe our practices in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and applicable rules.

1. Who processes your data

Commerce Study Connect is the Data Fiduciary for the personal data described in this policy. For privacy requests or grievances, contact commercestudyconnect@gmail.com.

2. Personal data we collect

• Account data: name, email address, password credentials, account identifiers, and sign-in or confirmation details.
• Learning data: course selections, completed chapters, quiz attempts, scores, progress, ratings, and learning streaks.
• Device and usage data: browser, device, approximate technical information, pages or features used, and diagnostic information provided by hosting, analytics, or security services.
• Messages: information you include when you contact support or ask about a contribution or partnership.

Please do not submit sensitive personal data, identity documents, financial account details, or another person's information through the website or support form unless we specifically request it.

3. Why we use personal data

We use personal data to:

• create and secure accounts and authenticate users;
• provide courses, quizzes, progress tracking, and support;
• maintain, troubleshoot, protect, and improve the service;
• respond to requests, feedback, and grievances;
• measure use of the website and understand performance; and
• comply with applicable law and protect our legal rights.

Where consent is required under the DPDP Act, we request it for a specified purpose and do not treat silence or inactivity as consent. You may withdraw consent at any time by contacting us; withdrawal does not affect processing already completed lawfully. Some features may not work after withdrawal where the data is necessary to provide them.

4. Service providers and sharing

We may share the minimum data needed with service providers that help us operate the service, including Supabase for authentication and database hosting, Google Analytics for website measurement, Google advertising services where enabled, hosting providers, content delivery networks, and support tools. These providers must process data for the agreed purpose and apply appropriate safeguards. We may also disclose data where required by law, court order, or a lawful government request, or to prevent fraud or security harm. We do not sell personal data.

5. Cookies and local storage

The website may use authentication storage, local storage for course choices, and cookies or similar technologies used by analytics, advertising, hosting, or security providers. You can manage cookies through your browser. Blocking them may affect sign-in, progress, or other features. Third-party services may have their own privacy notices and controls.

6. Retention and security

We retain personal data only for as long as reasonably necessary for the purposes described here, account administration, legal obligations, dispute resolution, and security. When it is no longer required, we delete it or anonymise it where reasonably practicable. We use access controls, row-level database policies, and other reasonable technical and organisational safeguards, but no online service can guarantee absolute security.

If a personal data breach occurs, we will take steps to contain and investigate it and provide notices to the Data Protection Board of India and affected Data Principals where required by applicable law.

7. Your rights under the DPDP Act

Subject to applicable law and verification of your identity, you may request access to information about your personal data and its processing, correction or completion of inaccurate data, erasure of data that is no longer necessary, withdrawal of consent, and information about how to exercise these rights. You may also nominate another individual to exercise your rights in the event of death or incapacity, as permitted by law.

Send requests or complaints to commercestudyconnect@gmail.com with the subject “DPDP privacy request”. We may ask for reasonable information to verify the request. We will respond within the period required by applicable law. You may approach the Data Protection Board of India if your grievance is not resolved through our process.

8. Children

Our services are not intended to bypass protections for children. Where a user is a child under the age specified by applicable law, we require verifiable parental or lawful guardian consent before processing personal data where required. We do not knowingly use a child's data for tracking, behavioural monitoring, or targeted advertising where prohibited by the DPDP Act. A parent or guardian can contact us to request review or deletion of a child's data.

9. Transfers and policy changes

Our providers may process data in India or other countries. We will follow restrictions and safeguards applicable to cross-border transfers under Indian law. We may update this policy when our services, providers, or legal obligations change. The updated date above will show when the latest version took effect.

This policy is a general description of our current practices and should be reviewed with qualified legal counsel before being used as a compliance statement for a particular business or deployment.