Privacy Policy

1. Information We Collect

We collect only the personal information necessary to provide our educational services, credentialing, and marketplace functionality:

• Account Information: Name, email address, phone number (optional), profile photo, skills, bio, and password hash.
• Verification Data: Government-issued ID (for KYC on payouts), payment details (bank account, UPI, UPI QR) for wallet payouts.
• Activity Data: Course progress, lesson completion, quiz scores, Certificate generation, Work Marketplace applications, deliverables, and payout history.
• Communication Data: Support tickets, chat messages, and correspondence with our team.
• Technical Data: IP address, device information, browser type, access timestamps, and usage analytics (aggregated, anonymized).

We do not collect sensitive personal data such as racial/ethnic origin, political opinions, religious beliefs, health data, or biometric data.

2. How We Use Your Information

• Service Delivery: Account authentication, course access, progress tracking, Certificate issuance, Work Marketplace matching, wallet and payout processing.
• Verification & Trust: Public Certificate registry (name, program, completion date, Certificate ID), KYC compliance for payouts, fraud prevention.
• Communications: Transactional emails (purchase receipts, Certificate issuance, payout notifications), support responses, important platform updates (opt-out available for non-essential).
• Platform Improvement: Aggregated, anonymized analytics to improve curriculum, marketplace matching, and user experience.
• Legal Compliance: KYC/AML for payouts, tax reporting, legal obligations, fraud prevention, and security.

We do not sell, rent, or monetize your personal data to third-party advertisers or data brokers.

3. Information Sharing & Disclosure

We share your information only in the following limited circumstances:

• Work Marketplace: When you apply to a project, your name, verified Certificates, portfolio, and proposed deliverables are shared with the Client for evaluation.
• Certificate Verification: Certificate holder name, program name, completion date, and Certificate ID are publicly accessible via our verification registry for client authentication.
• Payment Processors: Payment details shared with our payment partners (Razorpay, bank partners) solely for transaction processing.
• Legal Requirements: When required by law, court order, or regulatory authority (KYC/AML, tax reporting, fraud investigation).
• Service Providers: Trusted subprocessors (cloud hosting, email delivery, analytics) under strict data processing agreements.
• Business Transfers: In the event of a merger, acquisition, or asset sale, user data transfers as part of the business with continued privacy protections.

We do not sell your personal data to advertisers, data brokers, or for targeted advertising.

4. Public Certificate Registry

When you earn a Certificate, the following information is made publicly accessible via our verification portal for client verification:

• Your full name
• Program name and tier
• Completion date
• Unique Certificate ID (e.g., ZG-2026-ABC123)

No contact details, email, phone, or private profile information are publicly disclosed. You may request Certificate revocation (which removes public verification) by contacting support, subject to verification.

5. Data Security

• Encryption: TLS 1.3 for data in transit; AES-256 encryption for data at rest.
• Authentication: PBKDF2 (10,000 iterations) password hashing, secure session tokens with automatic expiry, optional 2FA.
• Access Control: Role-based access control (RBAC), principle of least privilege, audit logging for admin actions.
• Infrastructure: Hosted on SOC 2 Type II certified cloud infrastructure (AWS/GCP); regular penetration testing and vulnerability scanning.
• Incident Response: Documented breach notification procedures; affected users notified within 72 hours where required by law.

6. Data Retention & Deletion

• Active Accounts: Data retained for the life of the account plus 2 years after last activity.
• Financial Records: Payout records, KYC documents, and tax-related data retained for 8 years per Indian tax law.
• Deleted Accounts: Personal data deleted within 30 days of account deletion request, except where legal retention obligations apply (financial, tax, legal hold).
• Anonymized Analytics: Aggregated, anonymized usage data may be retained indefinitely for product improvement.

7. Your Rights

Under applicable data protection laws (including India's DPDP Act 2023), you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data (subject to legal retention obligations).
• Portability: Receive your data in a structured, machine-readable format.
• Restriction/Objection: Restrict or object to certain processing (e.g., marketing).
• Withdraw Consent: Where processing is based on consent, withdraw at any time.

To exercise these rights, contact us at privacy@zetagrow.com. We respond within 30 days.

8. Cookies & Tracking

We use essential cookies for authentication, session management, and security. We do not use third-party advertising cookies, tracking pixels, or cross-site tracking. Analytics are first-party, anonymized, and aggregated. You may disable cookies via browser settings, but authentication will not function.

9. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact us immediately for deletion.

10. International Data Transfers

Our servers are located in India. If you access the Platform from outside India, your data will be transferred to and processed in India under the protections described in this Policy.

11. Changes to This Policy

We may update this Policy to reflect legal, technical, or operational changes. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The "Last updated" date above reflects the most recent revision.

12. Contact

Questions, concerns, or rights requests? Contact our Data Protection Officer at:

privacy@zetagrow.com
Zetagrow Edutech and Solutions (ZetaGrow) Legal Team
[Registered Office Address]