Privacy Policy
Last updated 2026-09-26
This Privacy Policy explains what personal data [[LEGAL ENTITY NAME, e.g. Synaptova Learning Private Limited]] ("Synaptova", "we") collects when you visit synaptova.com, use the Synaptova Learn app, send us a form, or buy the Programme, why we collect it, who sees it, how long we keep it, and what you can do about it.
Where the law stands. India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 are notified. Most of the duties they place on organisations like us are scheduled to start on 13 May 2027, and the Government has said it may bring that date forward. Until then, section 43A of the Information Technology Act, 2000 and the 2011 SPDI Rules are the data protection rules in force. We have written this notice to the DPDP standard now so that you can see how we handle your data. We do not claim that it has been approved by any regulator or lawyer. [[Lawyer review pending]]
In DPDP terms, we are the Data Fiduciary: we decide why and how your personal data is used.
1. What we collect, and why, at each point
1.1 When you create an account (email sign-in link)
| Data | Why we need it |
|---|---|
| Email address | To send your sign-in link and identify your account |
| Name (if you give it) | To address you and print it on your certificate |
| Profile choices you enter: goal, background, weekly study hours, study plan, theme | To personalise your plan and screens |
You sign in with an emailed link. We do not store a password.
1.2 When you learn
| Data | Why we need it |
|---|---|
| Lessons completed, time of activity | To show progress and unlock the next steps |
| Quiz, exam, lab and assignment attempts and scores; lab completion codes | To check your work, issue certificates and compute your IRI score |
| Notes you write | To save them for you |
| Project links you submit (for example a GitHub URL) and your self-score | To review your project |
| Review-queue items | To schedule revision |
| Certificates and IRI score | To issue and verify your certificate |
Python labs run inside your own browser. We store your lab results and completion codes. [[confirm: whether the code you type in a lab is saved on our servers, and say so here]]
1.3 When you pay
Payments are made through Razorpay. We never see or store your card, UPI or bank details. We receive from Razorpay: your name and email, the amount, the currency, the payment reference, the payment status and the date. If you give a GSTIN for an invoice we keep that too. We use this to give you access, issue your invoice, handle refunds, and keep the accounts that tax law requires.
1.4 When you fill in a form on the website
We have six forms: lead (free lesson), free consultation, contact, employer enquiry, grievance and data-rights request.
| Data | Why we need it |
|---|---|
| Name, email, phone (if the form asks), and what you write | To answer you |
| Your consent choices (service use, and separately, marketing), and the version of this notice you saw | To keep proof of what you agreed to |
| A ticket number and its status | So you can track your request |
The marketing box is always separate and starts unticked. If you leave it empty we do not send you marketing.
1.5 Cookies and analytics
Strictly necessary storage (your login session, your cookie choice, your theme) is always on. Google Analytics 4 runs only if you accept analytics in the cookie banner. It records things like pages visited, device and browser type, approximate location from your IP address, and cookie identifiers. See our Cookie Policy. You can change your choice at any time from the "Cookie settings" link in the footer.
1.6 Videos and fonts
Some lessons embed videos through YouTube's privacy-enhanced player (and possibly Bunny Stream [[confirm if used]]). When a video loads or plays, the video provider can receive your IP address and device details, under its own policy. Our site uses YouTube API Services: see the YouTube Terms of Service and the Google Privacy Policy. Our pages also load fonts from Google Fonts, which means your IP address is sent to Google when a page loads [[confirm: or self-host fonts and delete this sentence]].
1.7 Support and communications
If you write to us, we keep the messages and our replies. If you opt in to marketing, we keep your email (and phone number if you gave it) and the date and wording of your consent.
1.8 Security and technical logs
Our hosting and database providers keep server logs (IP address, time, pages or functions requested, errors). We use them to keep the service secure and to investigate faults and abuse.
We do not ask for sensitive data such as health, religion, caste or financial account numbers. Please do not put them in notes, forms or project links.
2. Consent, and other lawful grounds
- Consent. For most of what is in section 1 we ask for your consent when you sign up or tick a box. Consent is specific to the purposes stated, and you can say no to optional purposes (marketing, analytics) and still use the Programme.
- Withdrawing consent. You can withdraw any consent as easily as you gave it. Use the unsubscribe link in any email, the "Cookie settings" link in the footer, your account settings, the data-rights request form, or email [[grievance@synaptova.com]]. Withdrawal does not undo what we have already done. If you withdraw consent we need for the Programme to work, we may not be able to keep your account running.
- Legal obligation. We keep invoices and payment records because tax and accounting law requires it.
- Other permitted uses. The DPDP Act allows some processing without separate consent, for example to comply with a law or a court order, or to respond to a medical or safety emergency. We will use these grounds only where they apply.
We do not sell your personal data. We do not make decisions about you that have legal effects using automated means alone.
3. Who we share it with
We use service providers (called processors) who handle data on our instructions. We ask each to protect it. We have not yet confirmed the storage region for each one, and will fill in the table before launch.
| Provider | What they do | Data they handle | Region |
|---|---|---|---|
| Supabase | Database, sign-in, server functions | Account, learning, forms, payment references | [[confirm region]] |
| Cloudflare | Website hosting and delivery network | Visitor IP address, request logs | [[confirm region]]; global network |
| Razorpay | Payment collection and refunds | Payment details you enter at checkout; name, email, amount | [[confirm region]] (India) |
| Email sender for sign-in links and messages | Sends emails | Email address, message content | [[confirm provider and region]] |
| Bunny Stream | Video hosting (if used) | Visitor IP address, viewing events | [[confirm if used]] [[confirm region]] |
| Google Analytics 4 | Site statistics, only after consent | Pages, device, approximate location, cookie IDs | [[confirm region]] |
| Google Fonts | Font delivery | Visitor IP address | [[confirm region]] |
| YouTube | Embedded lectures, privacy-enhanced mode | Visitor IP address, device, viewing data | [[confirm region]] |
Labs may offer an "Open in Google Colab" link. If you use it, you are using Google's service with your own Google account, under Google's terms.
We may also disclose data if the law, a court or a government authority requires it, or to protect our legal rights.
4. Transfers outside India
Some providers above may store or process data outside India. The DPDP Act allows this unless the Government restricts a country, and we will follow any such restriction. We will list each provider's region in section 3 before launch. [[confirm]]
5. How long we keep it
These are the periods we propose. Items marked [[confirm]] need a business or accounting decision before launch.
| Data | How long |
|---|---|
| Lead, consultation, contact and employer-enquiry records | 12 months after our last contact with you [[confirm]] |
| Account and learning data | While your account exists. If you ask us to delete it, it is erased and backups are overwritten within 30 days. If you do not sign in for 3 years we will email you and then erase it [[confirm]] |
| Certificates and IRI score | With your account. If you delete your account, the certificate no longer verifies |
| Payment and invoice records | 8 years, kept without a link to your account after deletion [[confirm with CA]] |
| Records of your consent and withdrawals | 3 years after the consent ends [[confirm]] |
| Grievance, data-rights and support tickets | 3 years after closure [[confirm]] |
| Marketing list | Until you withdraw consent. We keep your email on a "do not contact" list so we can honour your opt-out |
| Analytics data | [[confirm Google Analytics retention setting, e.g. 14 months]] |
| Security and server logs | At least 1 year, then deleted [[confirm]] |
When the purpose has ended, or you withdraw consent, we erase the data unless a law requires us to keep it.
6. Your rights
Under the DPDP Act you can: - Access: ask for a summary of the personal data we hold about you, who we have shared it with, and what we use it for. - Correction and updating: ask us to correct, complete or update it. - Erasure: ask us to delete it, unless a law requires us to keep it. - Withdraw consent: at any time (section 2). - Nominate: name another person who can use these rights for you if you die or cannot act for yourself. - Grievance: complain to us about how we handled your data or a request.
If you have an account, you can download a copy of your data and delete your account yourself from Settings in the app. For anything else, use the data-rights request form or email [[grievance@synaptova.com]]. We may ask you to confirm it is you, by replying from your registered email. We aim to answer within 30 days and will never take longer than 90 days.
7. Children
The Programme is for people aged 18 and over. We do not enrol anyone under 18, and we do not knowingly collect their personal data. We do not track children, monitor their behaviour, or aim advertising at them. If we learn that someone under 18 has given us data, we will stop using it and delete it. If you are a parent and think your child has signed up, write to [[grievance@synaptova.com]].
8. Security
We use measures such as encrypted connections, access controls, database rules that limit each learner to their own records, and backups. We choose providers who publish their own security practices. No system is completely secure, and we cannot promise that nothing will ever go wrong.
9. If there is a data breach
If a breach affects your personal data, we will tell you without delay, saying what happened, what it could mean for you, what we have done, and what you can do. We will also report it to the Data Protection Board of India and to CERT-In as the law requires.
10. AI and your data
Synaptova does not have a live AI chatbot and does not send your personal data to AI services. We do not use your data to train AI models [[confirm]]. Please do not paste your own personal data, or anyone else's, into any third-party AI tool while doing course labs. See How we use AI.
11. Cookies
See our Cookie Policy. Optional cookies are used only if you accept them.
12. If you are outside India
We build for learners in India. If you are in the European Union, the United Kingdom, or a US state with its own privacy law, you may have extra rights, such as access, deletion and objection. Write to [[grievance@synaptova.com]] and we will consider your request under the law that applies to you. [[Lawyer to confirm which foreign laws apply before any ads outside India]] We do not sell personal information and do not share it for cross-context behavioural advertising unless you accept optional marketing cookies.
13. Advertising platforms
If you reach us through an advertisement on Facebook, Instagram, YouTube or Google, those platforms handle your data under their own policies. If we run advertising lead forms, we receive only what you entered and use it as described here. To have data we received through an advert deleted, use the data-rights request form (see also Your data rights).
14. Contact, Grievance Officer and the Data Protection Board
[[NAME]], Grievance Officer [[LEGAL ENTITY NAME, e.g. Synaptova Learning Private Limited]], [[REGISTERED ADDRESS, Bengaluru, Karnataka, India]] Email: [[grievance@synaptova.com]] · Phone: [[+91-XXXXXXXXXX]]
Write to this person for any question about how we use your personal data, or to use your rights. You can also use the online grievance form. If we do not resolve your complaint, you will be able to complain to the Data Protection Board of India once it is operating and the DPDP complaint rules are in force. At the time of writing the Board has been set up in law but has not yet begun hearing complaints. See Grievance Redressal.
15. Changes
If we change this policy we will update it here and, for material changes, tell you by email before the change takes effect.