Privacy Policy

1. Data We Collect

• Account Information: Name, email address, phone number, organization name, and role within the organization.
• Usage Data: Course progress, assessment scores, login timestamps, feature interactions, and session duration.
• Assessment Submissions: Answers, scores, time taken, and attempt history for all assessments.
• Device Information: Browser type, operating system, IP address, and screen resolution for compatibility and security purposes.

2. Purpose of Collection

• Service Delivery: To provide, maintain, and improve the LearnFlow platform.
• Analytics: To generate reports for organization administrators on learner progress and platform usage.
• Support: To respond to support requests and troubleshoot issues.
• Compliance: To meet legal and regulatory obligations under applicable Indian law.

3. Legal Basis

We process personal data based on the following legal grounds:

• Consent: Where you have given explicit consent for data processing.
• Contractual Necessity: Processing required to fulfill our service agreement with your organization.
• Legitimate Interest: Processing necessary for platform security, fraud prevention, and service improvement.

4. Data Storage

All data is stored on India-hosted infrastructure. Each tenant organization receives an isolated database. Data is encrypted at rest and in transit. Access is restricted to authorized personnel with role-based access controls.

5. Data Sharing

We do not sell personal data. Data is shared only in the following circumstances:

• Organization Administrators: Learner progress and assessment data is visible to authorized administrators within the same tenant.
• Service Providers: Third-party providers operating under contract with strict data processing agreements (e.g., hosting, email delivery).
• Legal Requirements: When required by law, court order, or government authority.

6. Data Retention

• Active Account: Data is retained for the duration of the active subscription.
• Terminated Account: A 90-day export window is provided after termination, after which data is permanently deleted.
• Legal Hold: Data may be retained longer if required by law or ongoing legal proceedings.

7. Your Rights under DPDP Act 2023

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access: Request a summary of personal data processed about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Withdraw Consent: Withdraw previously given consent for data processing at any time.
• Nominate: Nominate an individual to exercise your data rights in case of death or incapacity.

8. Cookies

We use session cookies for authentication and maintaining your logged-in state. Analytics cookies help us understand platform usage patterns. We do not use third-party tracking cookies. You can disable cookies in your browser settings, though this may affect platform functionality.

9. Children's Privacy

For users under the age of 18, parental or guardian consent is required as per the DPDP Act 2023. Educational institutions are responsible for obtaining appropriate consent and managing student accounts. We do not knowingly collect personal data from children without verifiable parental consent.

10. Data Breach Notification

In the event of a data breach, we will notify the Data Protection Board of India and all affected users within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, data affected, and remedial measures taken.