Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Full name and email address when you register an account
• Password (stored as a secure hash — never in plain text)
• Payment details processed via Razorpay (we do not store card numbers or CVV data)
• Referral codes you share or redeem
• Communications you send to our support team

1.2 Information Collected Automatically

• IP address and approximate geographic location
• Browser type, operating system, and device information
• Pages visited, courses accessed, and lesson progress
• Session timestamps and navigation patterns
• Referral tracking data (who referred you, reward status)

1.3 Information from Third Parties

• Authentication data from Supabase (user ID, session tokens)
• Payment confirmation and transaction IDs from Razorpay
• Email delivery and open/click status from Resend

2. How We Use Your Information

• To create, manage, and authenticate your account
• To process course and lesson purchases and verify payment status
• To grant and manage access to purchased course content
• To send transactional emails (receipts, invoices, access confirmations, expiry reminders) via Resend
• To manage your referral code, track referred users, calculate reward amounts, and process claim requests
• To detect and prevent fraud, abuse, or unauthorized access
• To analyze usage patterns and improve platform performance and content quality
• To respond to your support requests and communications
• To comply with applicable legal and regulatory obligations

3. Data Storage & Security

3.1 Where Your Data Is Stored

• Supabase — user authentication, session management, and file storage (course media, thumbnails)
• Our database (via Prisma ORM) — user profiles, purchases, lesson purchases, referrals, and claim requests
• Razorpay — payment processing and transaction records (governed by Razorpay's own privacy policy)
• Resend — transactional email delivery (governed by Resend's own privacy policy)

3.2 Security Measures

• All data is transmitted over HTTPS using TLS encryption
• Passwords are hashed using industry-standard algorithms and never stored in plain text
• Course content is served via signed, time-limited URLs to prevent unauthorized sharing
• Access to production data is restricted to authorised team members only
• Payment card data is never stored on our servers — all payment processing is handled entirely by Razorpay

4. Third-Party Services

We work with the following third-party services that may process your data:

• Supabase — Authentication, session management, and file storage. Privacy Policy
• Razorpay — Payment processing for course and lesson purchases. Privacy Policy
• Resend — Transactional email delivery. Privacy Policy

We do not sell your personal data to any third party. We only share data with service providers to the extent necessary to operate our platform.

5. Course Content Access

• Access to courses and lessons is tied to your purchase and any applicable expiry date
• Lifetime purchases grant permanent access as long as your account remains active
• Subscription-based purchases expire on the date shown at the time of purchase
• When access expires, your account and purchase history are retained, but course content becomes inaccessible until renewed
• Course content is delivered via signed URLs that expire after a short period to prevent unauthorised distribution

6. Referral Program

• When you share your referral code, we record the referral relationship between you and any user who signs up using it
• We store the referred user's email address for the purpose of tracking referral eligibility and reward amounts
• Reward amounts are calculated based on qualifying purchases made by your referred users
• Rewards follow a lock-up period before becoming eligible for claiming; the remaining lock period is visible in your dashboard
• Referral rewards are paid at our discretion and subject to our referral program terms

7. Data Retention

• Account data is retained for as long as your account is active
• Purchase and transaction records are retained for a minimum of 7 years to comply with financial and tax regulations in India
• Referral and claim records are retained for 7 years for accounting purposes
• If you delete your account, we will remove your personal profile data within 30 days; however, anonymised transaction records may be retained for legal compliance

8. Your Rights

• Right to Access — You may request a copy of the personal data we hold about you
• Right to Correction — You may request correction of inaccurate or incomplete data
• Right to Deletion — You may request deletion of your account and associated personal data, subject to legal retention obligations
• Right to Data Portability — You may request your data in a machine-readable format
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw it at any time

To exercise any of these rights, contact us at the email in Section 13. We will respond within 30 days.

9. Cookies & Tracking

• We use session cookies to keep you logged in during your visit
• Authentication tokens are stored securely and managed by Supabase
• We do not currently use advertising cookies or third-party tracking pixels
• You can configure your browser to refuse cookies; however, certain features may not function correctly without them

10. Children's Privacy

Our platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has registered on our platform, please contact us immediately and we will promptly delete the associated account and data.

11. India-Specific Provisions

11.1 IT Act 2000 & SPDI Rules 2011

We comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Sensitive personal data (passwords, payment information) is collected only for lawful purposes and with your consent. You may withdraw consent at any time by contacting our Grievance Officer.

11.2 Grievance Officer

In accordance with the IT Act 2000, our Grievance Officer is:
Name: Balagangadhara S
Email: grievance@skillsofcrossword.com
Response Time: Within 30 days of receiving a complaint

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date at the top of this page, send an email notification to your registered address, and display a prominent notice on the platform. Continued use of the platform after any update constitutes your acceptance of the revised policy.

13. Contact Us

If you have any privacy-related questions or requests, please contact us: