Privacy Policy

TechVansh ("we", "us", "our") is a sole proprietorship owned and operated by Vansh Gurdaswani, registered in India. We provide online cybersecurity and technology courses through our website and platform at techvansh.in.

This Policy applies to all users of our website, mobile interfaces, course platform, and related services (collectively, the "Services"). It is written to comply with the Indian Information Technology Act, 2000 (and SPDI Rules), the Digital Personal Data Protection Act, 2023 (DPDP Act), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA / CPRA).

We only collect information that is necessary to deliver our Services, comply with the law, and improve your learning experience. We group it into three categories.

2.1 Information You Provide Directly

• Account information: full name, email address, phone number (which is also your WhatsApp number), date of birth, and a password (stored only as a salted hash — we never store your password in plain text).
• Profile information: profile picture (uploaded by you or imported from Google when you sign in with Google OAuth), bio, and any optional details you choose to add.
• Billing & order data: billing address, country, and (for B2B customers) company name and GSTIN. We do not store your card number, CVV, or UPI PIN. Card data is captured and stored by our PCI-DSS compliant payment processor (PayU). We only retain a payment gateway reference (gatewayPaymentId) for reconciliation.
• Learning data: course enrollments, lesson progress, quiz attempts and scores, certificates earned, and notes you create.
• User-generated content: course reviews, ratings, Q&A posts, and any messages you send through our support channels.
• Communications: emails, WhatsApp messages, and chat conversations between you and our support team.

2.2 Information Collected Automatically

• Device & technical data: IP address, browser type and version, operating system, device type, screen size, language preference, and referring URL.
• Usage data: pages viewed, time spent, video watch progress, click events, and search queries inside the platform.
• Cookies & similar technologies: session cookies, authentication tokens, and analytics identifiers. See our Cookies Policy for the full list.
• Approximate location: derived from your IP address (city / country level only) for fraud prevention, tax calculation, and regional content.

2.3 Information from Third Parties

• Google OAuth: if you sign in with Google, we receive your name, email address, profile photo, and Google account ID. We do not access your Gmail, Drive, or contacts.
• Payment gateways: PayU shares with us payment success/failure status, amount, currency, and a payment reference ID.
• Analytics partners: Google Analytics and Meta Pixel provide aggregated traffic and conversion data.

We use your information only for the purposes listed below. We do not sell your personal data to advertisers, data brokers, or any third party.

• Provide the Services: create and manage your account, deliver courses, track progress, generate certificates, and process payments.
• Communicate with you: send order confirmations, course updates, password resets, and important service notices via email, WhatsApp, or SMS.
• Customer support: respond to your questions and resolve issues.
• Marketing (with consent): send promotional emails or messages about new courses or offers. You can unsubscribe at any time.
• Improve the platform: analyze usage to fix bugs, improve performance, and design better learning experiences.
• Security & fraud prevention: detect suspicious activity, prevent unauthorized access, and protect our users.
• Legal compliance: issue GST invoices, maintain financial records, respond to lawful requests, and enforce our Terms.

Under GDPR and equivalent laws, we process personal data only when we have a lawful basis to do so:

• Contract: to deliver a course you have purchased and to provide account features you have signed up for.
• Consent: for marketing emails, WhatsApp marketing, non-essential cookies, and any optional features. You may withdraw consent at any time.
• Legitimate interest: to secure our platform, prevent fraud, debug issues, and improve our Services — provided your interests do not override ours.
• Legal obligation: to comply with tax laws (GST), the Companies Act, anti-money-laundering rules, and lawful court orders.

We share data only with the trusted service providers listed below, and only to the extent necessary for them to perform their function. Each is contractually obligated to protect your data and use it solely for the agreed purpose. We never sell your personal data to advertisers or data brokers.

We may also disclose information when required by a valid Indian court order, government request, or to protect our rights, our users, or the public — but only to the minimum extent legally necessary.

TechVansh is based in India, but several of our service providers (Vercel, Resend, Cloudflare, AWS, Google, Meta, Neon, Supabase) operate globally. Your data may therefore be processed on servers located outside India, including in the United States, the European Economic Area, and other regions.

Whenever we transfer personal data outside the user's home country, we rely on appropriate safeguards such as:

• EU Standard Contractual Clauses (SCCs) for transfers involving EU/UK personal data;
• Vendor compliance with frameworks such as the EU–US Data Privacy Framework, ISO 27001, and SOC 2;
• Encryption of data in transit and at rest, regardless of destination.

We keep your data only as long as needed for the purpose we collected it for, or as required by law:

• Account data (name, email, profile, learning history): retained until you ask us to delete your account.
• Invoices, payment records, GST data: retained for at least 7 years (or longer if required) to comply with the Indian Income Tax Act, GST law, and the Companies Act.
• Certificates: retained indefinitely to allow public verification, unless you specifically request removal.
• Support communications: retained for up to 3 years for quality and dispute resolution.
• Backups: retained for up to 90 days after deletion before being permanently overwritten.

After the relevant retention period, we either securely delete the data or anonymize it so it can no longer be linked to you.

Regardless of where you live, you have the following rights over the personal data we hold about you:

• Right to access: request a copy of the personal data we hold about you.
• Right to correction: ask us to fix incorrect or incomplete data.
• Right to deletion: ask us to delete your account and personal data, subject to legal retention obligations (e.g. tax records).
• Right to portability: receive your data in a structured, machine-readable format.
• Right to withdraw consent: stop receiving marketing communications or revoke any consent you have given.
• Right to complain: lodge a complaint with the relevant data protection authority in your country.

To exercise any of these rights, email us at support@techvansh.in. We will respond within 30 days. To protect your account, we may ask you to verify your identity before we act.

If you are located in the European Union, the United Kingdom, or the European Economic Area, you have the additional rights granted by the General Data Protection Regulation (GDPR):

• Right to erasure ("right to be forgotten"): request deletion of your personal data when it is no longer necessary, when you withdraw consent, or when you object to processing.
• Right to restrict processing: ask us to limit how we use your data while we verify a complaint or correct inaccuracies.
• Right to object: object to processing based on legitimate interest, including direct marketing and profiling.
• Right to data portability: receive your data in a commonly used, machine-readable format and have it transmitted to another controller.
• Right not to be subject to automated decisions: we do not make decisions with a legal or significant effect on you using purely automated means.

Our lead contact for GDPR matters is the email above. If you are unsatisfied with our response, you may complain to your local Data Protection Authority — for example, the Information Commissioner's Office (ICO) in the UK, or the CNIL in France.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you these additional rights:

• Right to know: what personal information we collect, the sources, the purposes, and the categories of third parties we share it with.
• Right to delete: request deletion of personal information we have collected from you.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell your personal information for money. Some advertising cookies (e.g. Meta Pixel) may qualify as "sharing" under the CPRA — you may opt out by adjusting your cookie preferences or emailing us.
• Right to limit use of sensitive personal information: we do not use sensitive personal information beyond what is necessary to provide our Services.
• Right to non-discrimination: we will not deny services, charge you a different price, or provide a different level of quality because you exercised a CCPA right.

To submit a CCPA request, email support@techvansh.in with the subject line "CCPA Request". You may also use an authorized agent — please include written proof of authorization.

If you are under 18, please do not create an account or submit any data to us.

If you are a parent or guardian and you believe a minor has provided us with personal information, please contact us at support@techvansh.in. We will delete the account and associated data promptly.

We use cookies and similar technologies to keep you logged in, remember your preferences, measure traffic, and improve our Services. You can manage or disable cookies in your browser settings, but some features of the platform may not work properly without them.

For full details — including the categories of cookies we use, their lifetimes, and your choices — please read our Cookies Policy.

Security is at the core of our work — we are a cybersecurity education platform, and we take the same standards we teach seriously for our own systems.

• All connections are encrypted with TLS 1.2+ (HTTPS) so data is protected in transit.
• Personal data is encrypted at rest in our databases and object storage.
• Passwords are hashed using industry-standard algorithms (bcrypt). We can never see your password.
• We never store credit card numbers, CVVs, UPI PINs, or full bank credentials. Card data is handled exclusively by our PCI-DSS compliant payment processor.
• Access to production systems is limited to authorized personnel and protected by multi-factor authentication.
• We perform regular security reviews, dependency audits, and penetration testing of critical components.
• We log access to sensitive endpoints and apply rate limiting to prevent abuse.

No system can be 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. You also play a role: keep your password strong and unique, do not share your account, and tell us immediately if you suspect unauthorized activity.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of it, in line with GDPR Article 33;
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms;
• Comply with the incident reporting requirements of the Indian CERT-In Directions (2022) and the DPDP Act;
• Document all breaches internally, including the facts, impact, and remedial action taken.

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, legal requirements, or business practices. When we do:

• We will update the "Last Updated" date at the top of this page;
• For material changes, we will email registered users at least 14 days before the changes take effect;
• We will keep older versions available on request so you can compare.

Your continued use of the Services after the effective date means you accept the updated Policy.

For any privacy-related question, request, or complaint, please reach out using the details below. We aim to respond within 7 business days.

Thank you for trusting TechVansh with your learning journey. Your privacy is — and will remain — a priority for us.