Privacy Policy

We process personal data on the following lawful bases depending on the context:

• Contractual Necessity. To provide the Service you have subscribed to (account creation, course delivery, assessment)
• Consent. For analytics cookies, marketing communications, and optional data uses. You may withdraw consent at any time
• Legitimate Interests. To improve the platform, ensure security, and prevent abuse, where our interests do not override your fundamental rights
• Legal Obligation. To comply with applicable laws, legal processes, or regulatory requirements

Under the DPDP Act, we act as a Data Fiduciary. Under the GDPR and UK GDPR, we act as a Data Controller.

Account Information. When you sign up, we collect your name, email address, and authentication credentials. If you subscribe to a paid plan, payment processing is handled by Stripe, and we do not store full payment card details.

Profile Information. You may optionally provide a display name, avatar, learning goals, and preferences. This information is used to personalise your learning experience.

Learning Data. We collect your assessment responses, course interactions, quiz answers, chat conversations with our AI tutor, and learning progress data. This data is used to generate personalised content, assess your knowledge, and improve course quality.

Technical Data. We collect IP address, browser type, device information, operating system, and usage patterns to operate and improve the Service.

Cookies & Tracking. Details are set out in Section 4 below.

To Provide the Service. We use your data to assess your knowledge, generate personalised course content, deliver interactive learning materials, and power our AI tutor.

To Improve the Platform. Aggregated and anonymised usage data helps us refine course quality, fix bugs, and optimise the learning experience. We do not use your personal learning data to train or fine-tune our AI models without your explicit, separate opt-in consent. For further details, see Section 11 (AI & Machine Learning).

To Communicate. We send account-related emails (password resets, subscription receipts) and, with your consent, product updates and learning tips.

To Ensure Security. We monitor for abuse, unauthorised access, and violations of our Terms of Service.

We do not sell your personal information. We share data only with trusted service providers who help us operate the platform. Each provider operates under a Data Processing Agreement (DPA) that requires them to protect your data to standards equivalent to our own:

• Stripe — payment processing. We never see your full card number
• Supabase — database hosting and authentication
• Anthropic — AI model inference for assessments and tutoring
• Langfuse — LLM observability and quality monitoring
• PostHog — product analytics (with your consent only)

We may disclose information if required by law, to protect our legal rights, or in connection with a business transaction (merger, acquisition, or sale of assets), with notice to you where required by law.

International Transfers. Your data may be transferred to and processed in countries other than your own, including the United States (where Anthropic, Stripe, and PostHog operate). For transfers from the European Economic Area, the United Kingdom, and India, we rely on Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms recognised by applicable law. Our service providers are contractually bound to provide adequate protection for your data.

We use the following categories of cookies and similar technologies:

• Essential Cookies. Required for authentication, security, and core platform functionality. These do not require prior consent and cannot be disabled.
• Analytics Cookies.We use PostHog to understand platform usage and improve the Service. These are set only with your prior consent. You can manage your preferences through the cookie settings panel available at any time via the “Cookie Settings” link in the footer.

We do not use third-party advertising cookies or sell browsing data to ad networks.

We retain your personal information for as long as your account is active or as needed to provide the Service. After account deletion or termination, we retain your data for a period consistent with applicable legal and regulatory requirements, after which it is securely deleted or anonymised.

• Account data: retained until account deletion plus 90 days for backup purposes
• Learning data: retained as above; anonymised for platform improvement
• Financial records: retained for 8 years to comply with tax and audit requirements
• Analytics data: retained for 26 months (subject to your consent preferences)

Depending on your location, you have the following rights regarding your personal data. We will respond to your request within the timeframes required by applicable law (typically 30 days):

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your data (subject to legal retention obligations)
• Objection / Restriction — object to or restrict certain processing activities
• Portability — request a structured, machine-readable copy of your data
• Withdrawal of Consent — withdraw consent at any time without affecting the lawfulness of processing before withdrawal
• Grievance Redressal (India) — lodge a grievance with our Grievance Officer (see Section 10)
• Complaint to Supervisory Authority (EU/UK)— lodge a complaint with your local data protection authority (e.g., the Data Protection Commission in Ireland or the Information Commissioner’s Office in the UK)

To exercise your rights, contact us at privacy@zonastery.com. We may need to verify your identity before processing your request. We do not discriminate against users who exercise their privacy rights.

California Residents (CCPA). You have the right to know what personal information we collect, the right to request deletion, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your CCPA rights.

We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest, regular security audits, and access controls. No method of transmission over the Internet is 100% secure, but we strive to protect your data using commercially acceptable means.

Data Breach Notification. In the event of a data breach affecting your personal information, we will notify you and the relevant data protection authorities within the timeframe required by applicable law (72 hours for GDPR breach notification, as soon as practicable under the DPDP Act). Notifications will include the nature of the breach, contact information for further inquiries, and recommended mitigation steps.

EU & UK Users (GDPR / UK GDPR). Our lawful basis for processing is set out at the beginning of this policy. International data transfers are safeguarded by Standard Contractual Clauses (SCCs). You have the right to lodge a complaint with your local data protection supervisory authority (e.g., ICO for the UK, DPC for Ireland). Our representative within the EU for data protection matters can be contacted at privacy@zonastery.com.

Indian Users (DPDP Act). We are a Data Fiduciary under the DPDP Act. You have the rights set out in Section 6 above, including the right to grievance redressal. Please see Section 10 for our Grievance Officer details.

California Residents (CCPA). We do not sell your personal information. You may exercise your access, deletion, and opt-out rights as described in Section 6.

If you access the Service from outside India, your data may be transferred to and processed in India, the United States, or other countries where we or our service providers operate. By using the Service, you consent to such transfer, subject to applicable safeguards. Where local law requires a higher standard of protection, that standard will apply to your data.

The Service is not directed at children under 18. In compliance with the DPDP Act, the GDPR (Article 8), COPPA in the United States, and other applicable laws, we do not knowingly collect personal information from individuals under 18 without verifiable parental consent. If we become aware that a child under 18 has provided us with personal data without such consent, we take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@zonastery.com.

In compliance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021), we have appointed a Grievance Officer:

Grievance Officer: Apurv Wagh
Email: grievance@zonastery.com
We acknowledge receipt of grievances within 24 hours and resolve them within 15 business days.

Our platform uses AI models (provided by Anthropic) to generate personalised learning content, assessments, and tutoring responses. Here is how we handle data in relation to AI:

• Inference Only.Personal learning data is sent to AI models solely for the purpose of generating responses and content for you. It is not used by Anthropic to train or improve their models. See Anthropic’s privacy policy and DPA for details.
• No Model Training Without Consent. We do not use your learning data (assessment responses, chat conversations, course interactions) to train, fine-tune, or improve our AI models unless you give us explicit, separate opt-in consent. If consent is provided, you may withdraw it at any time.
• Human Review. Anonymised and aggregated samples may be reviewed by our team to improve course quality, but your identity is not associated with such samples.
• Opt-In for Model Improvement. If we ever offer a programme where your data contributes to model improvement, it will be voluntary, transparent about exactly what data is used, and revocable at any time.

We honour browser Do Not Track (DNT) signals. When we detect a DNT signal, we disable non-essential tracking and analytics for that session.

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the platform. Continued use after changes take effect constitutes acceptance of the updated policy.

Questions about this policy? Reach out to us at privacy@zonastery.com.