Skill Grimoire — Privacy Policy
Effective date: [●] 2026 · Last updated: [●] 2026
Skill Grimoire ("Skill Grimoire", "we", "us", "our") is a sole proprietorship concern of [Proprietor's Name], having its principal place of business at [Registered Address], Bengaluru, Karnataka, India. Contact: skillgrimoire.edu@gmail.com.
This Privacy Policy explains how we collect, use, share and protect personal data when you register on our website, use our courses, participate in our assessments and scholarship challenges, or otherwise interact with us. It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and rules thereunder, and other applicable Indian law. Skill Grimoire is the Data Fiduciary for the personal data described here.
By registering on our website or clicking "I Agree", you (and, if you are under 18, your parent or legal guardian on your behalf) consent to the practices described in this Policy.
1. Who this Policy covers
Students of our partner schools and colleges who register for Skill Grimoire courses; parents/guardians of students below 18; and visitors to our website.
2. Personal data we collect
A. Data you provide at registration: full name; date of birth; class/year of study; institution name and institution code; email address; mobile number; parent/guardian name, contact details and consent confirmation (for students under 18); city/state.
B. Data generated when you use our services: course progress and completion records; assessment responses, challenge submissions and scores (including scores generated with the assistance of automated/AI evaluation systems); scholarship and certificate records; support queries and communications with us.
C. Technical data: device type, browser, IP address, log data, and cookies (see Clause 9).
D. Optional location data: our website can display a live sky/weather theme. If you grant your browser's location permission, your approximate location is used only in your browser to fetch local sunrise/sunset and weather from a third-party weather service (Open-Meteo). We do not store your location on our servers. Declining this permission does not affect access to courses.
E. Payment data: where fees are collected by your institution, we receive only enrolment confirmation from the institution — not your payment details. If you ever pay us directly online, payments are processed by an RBI-authorised payment gateway; we do not store your card, UPI or banking credentials.
We do not knowingly collect sensitive data such as religion, caste, health information, passwords to third-party services, or biometric data. Please do not upload such information.
3. Children's data (students under 18)
- Registration by a student under 18 requires verifiable consent of a parent or legal guardian, obtained as part of the registration flow, as required by Section 9 of the DPDP Act.
- We do not undertake behavioural monitoring of children or serve targeted advertising to children. We do not display third-party advertising on our platform at all.
- A parent/guardian may exercise any of the rights in Clause 8 on the child's behalf.
4. Purposes for which we use your data
We use personal data only to: (a) create and manage your account and verify your enrolment through your institution; (b) deliver courses, recorded lessons, and monthly live classes; (c) conduct assessments and scholarship challenges, evaluate submissions (including with AI-assisted evaluation), publish results and leaderboards, and award scholarships and certificates; (d) issue and verify certificates (including QR-based verification); (e) send you service communications by SMS, WhatsApp, email or in-app notification (class schedules, challenge dates, results, certificates); (f) share limited reports with your institution as described in Clause 5; (g) improve our courses and platform; (h) maintain security, prevent fraud and malpractice; and (i) comply with law, including tax and audit obligations.
We will not use your personal data for purposes materially different from the above without fresh notice and consent.
5. Who we share data with
- Your institution: enrolment status, course completion, participation and results in assessments/challenges, and the identity of scholarship and certificate recipients. Aggregate performance reports may also be shared. This sharing is inherent to the programme and is a condition of enrolment.
- Service providers (Data Processors): hosting, video delivery, communication (SMS/WhatsApp/email) and payment providers, bound by contract to process data only on our instructions.
- Weather service: if you enable the location feature, your browser contacts Open-Meteo directly; we receive nothing.
- Legal: courts, law-enforcement or regulators where required by law; and any successor entity if our business is reorganised or transferred, subject to this Policy.
We do not sell personal data. We do not share personal data with advertisers.
6. Storage, security and retention
Data is stored on reputable cloud infrastructure with reasonable security safeguards appropriate to the nature of the data, including encryption in transit and access controls, as required under the DPDP Act and IT Act. No system is perfectly secure; you use the platform at your own risk to the extent permitted by law, and you must keep your login credentials confidential.
We retain: (a) account and course data while your account is active and for up to 3 years thereafter; (b) certificate and scholarship records for up to 8 years, so that certificates remain verifiable and to meet tax/audit obligations; (c) data required for legal compliance, for the period required by law. Thereafter data is deleted or irreversibly anonymised.
7. Cookies and analytics
We use essential cookies for login and session management, and basic analytics to understand aggregate usage. You can control cookies through your browser; disabling essential cookies may break login.
8. Your rights (Data Principal rights under the DPDP Act)
You (or your parent/guardian, for minors) have the right to: (a) access a summary of your personal data and processing activities; (b) correct or update inaccurate or incomplete data; (c) erase data that is no longer necessary for the stated purposes (note: erasure of assessment or certificate records may make your certificate unverifiable and may end your participation in the programme); (d) grievance redressal as per Clause 10; (e) nominate a person to exercise your rights in case of death or incapacity; and (f) withdraw consent at any time, with the consequence that we may be unable to continue providing the services. Withdrawal does not affect processing already carried out.
To exercise any right, email skillgrimoire.edu@gmail.com from your registered email with the subject "Data Request". We will respond within the timelines prescribed under applicable law.
9. Duties of Data Principals
Under the DPDP Act you must not impersonate another person, suppress material information, or register false or frivolous grievances or complaints.
10. Grievance Officer
Grievance Officer: [Name], Skill Grimoire, [Registered Address], Bengaluru, Karnataka. Email: skillgrimoire.edu@gmail.com (subject line "Grievance").
We acknowledge complaints promptly and endeavour to resolve them within the timelines under applicable law. If you remain unsatisfied, you may approach the Data Protection Board of India as provided under the DPDP Act.
11. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified on the website or by email/SMS. Continued use after the effective date of a change constitutes acceptance. The current version will always be available on our website.
12. Governing law
This Policy is governed by the laws of India. Subject to Clause 10, the courts at Bengaluru, Karnataka shall have exclusive jurisdiction.