Comprehensive Privacy Policy
Effective Date: October 17, 2026
1. Introduction & Policy Overview
Smart Computer Academy ("SCA", "We", "Us", or "Our") operates a comprehensive EdTech, Coaching, and Franchise SaaS platform. We recognize the paramount importance of data privacy and are fiercely committed to safeguarding the personal, academic, and financial information of our students, franchise partners, instructors, and website visitors.
This Privacy Policy ("Policy") details our exhaustive protocols regarding the collection, processing, storage, and sharing of your data. By accessing our platform, enrolling in courses, or utilizing our SaaS tools, you explicitly consent to the data practices delineated in this policy.
We understand that your privacy is a fundamental human right. Therefore, we design our systems with Privacy by Design principles. This document is meant to be transparent, readable, and legally exhaustive.
This policy aligns with modern data protection standards and applicable Indian legislation, including the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
2. Categorization of Data We Collect
We collect data through direct interactions, automated technologies, and verified third parties. The data we collect is categorized comprehensively to ensure compliance with strict regulatory frameworks:
Identity Data: Full legal name, date of birth, gender, profile photographs (for AI proctoring and ID cards), government-issued identification numbers (Aadhaar, PAN where legally mandated for certifications or franchise operations), and demographic data.
Contact Data: Residential and permanent addresses, primary and secondary email addresses, mobile numbers, emergency contact details, and social media handles (if integrated for SSO).
Academic & Educational Data: Prior educational qualifications, transcripts, course enrollments, real-time attendance records, digital exam scores, assignment submissions, coding challenge metrics, and overall performance metadata within our Learning Management System (LMS).
Financial Data: Partial payment instrument details (we do not store full credit card numbers), transaction history, billing addresses, and GST details (specifically for Franchise partners).
Technical Data: Internet Protocol (IP) addresses, browser types and versions, time zone settings, operating systems, hardware configurations (e.g., screen resolution, CPU architecture), and device identifiers.
Usage Data: Granular telemetry detailing how you navigate our platform, clickstreams, time spent on video lectures, engagement rates on interactive elements, and search queries.
Biometric & Proctoring Data: During remote examinations, we may collect facial recognition data, ambient audio, and eye-tracking telemetry strictly for anti-cheating proctoring purposes. This data is processed temporarily and not stored long-term unless tied to an active academic dispute.
3. Legal Basis & Purpose of Data Processing
We do not collect data aimlessly. Every piece of information we process is tied to a specific operational or legal requirement. The legal bases for our processing include:
Contractual Necessity: To register you as a student or franchise, process your fees, grant LMS access, schedule exams, generate verifiable digital certificates, and provide ongoing technical support.
Legitimate Business Interests: To analyze platform usage, optimize User Interface/User Experience (UI/UX), prevent fraud, debug technical errors, protect our intellectual property, and maintain the overarching security of our SaaS infrastructure.
Explicit Consent: To process sensitive personal data (such as biometric proctoring data) and to send promotional materials. You have the right to withdraw this consent at any time.
Legal Compliance: To maintain mandatory academic, administrative, and financial records as mandated by educational and taxation authorities (e.g., maintaining 7-year audit trails for GST compliance).
4. AI & Machine Learning Processing
As a forward-thinking EdTech platform, SCA utilizes Artificial Intelligence (AI) and Machine Learning (ML) to enhance the learning experience. This includes:
Personalized Learning Paths: We analyze your academic data to recommend courses, adjust quiz difficulty, and identify areas where you may need additional tutoring or resources.
Automated Grading & Feedback: Our code-execution environments and essay grading modules utilize ML models to provide instantaneous, objective feedback on your submissions.
Data Anonymization for Training: We may aggregate and anonymize your Usage and Academic Data to train our proprietary AI models. Once anonymized, this data is entirely untraceable to you and is not considered Personal Data under this Policy.
We categorically do NOT use your private data to train public foundation models, nor do we sell your data to third-party AI companies.
5. Advanced Cookies & Tracking Technologies
Our platform utilizes a sophisticated array of tracking technologies, including persistent cookies, session cookies, web beacons, pixels, and local storage mechanisms (such as JWT tokens for secure authentication).
Strictly Necessary Cookies: Essential for the platform to function. They handle user authentication, CSRF protection, and load balancing. You cannot opt out of these.
Performance & Analytics Cookies: Deployed (via tools like Google Analytics and PostHog) to understand user behavior, page load times, and error rates. This helps us refine our software architecture.
Functional Cookies: Used to remember your preferences, such as Light/Dark mode themes, language preferences, and video playback speeds.
Targeting/Advertising Cookies: Used to deliver relevant advertisements across the internet based on your interest in specific SCA courses.
Disabling core authentication cookies will render the student dashboard and franchise portals completely inaccessible. You retain full control over tracking cookies via your browser settings.
6. Data Disclosure & Third-Party Integrations
SCA adheres to a strict "No Data Selling" mandate. We never sell, rent, or trade your personal data to data brokers. However, to operate a modern SaaS platform, we integrate with trusted third-party sub-processors:
Cloud Infrastructure Providers: Such as Amazon Web Services (AWS), Vercel, and MongoDB Atlas, where our databases and applications reside securely.
Payment Gateways: Such as Razorpay, required to securely authorize and execute financial transactions. We do not process these transactions on our own servers.
Communication APIs: SMS, Email, and WhatsApp gateways (e.g., SendGrid, Twilio, WhatsApp Business API) required to dispatch OTPs, password resets, and critical alerts.
Placement Partners: With your explicit, prior consent, we may share your academic profile, project portfolio, and resume with partnered tech companies to facilitate job placements and internships.
Legal Authorities: We may disclose your data if legally compelled by a court order, subpoena, or law enforcement request to prevent imminent harm, fraud, or terrorism.
All third-party sub-processors are legally bound by stringent Data Processing Agreements (DPAs) that prohibit them from utilizing your data for any independent purposes.
7. Global Data Transfers & Localization
Smart Computer Academy operates primarily out of India. Your data is stored on cloud servers situated in the Asia Pacific (Mumbai/Singapore) regions to ensure low latency and regulatory compliance.
If you are accessing our platform from outside India (e.g., European Union, United States), please note that your data will be transferred to and processed in India. By using our services, you consent to this international transfer. We ensure that such transfers are protected by standard contractual clauses and adequate security measures.
8. Enterprise-Grade Security Architecture
We deploy a multi-layered security architecture to prevent unauthorized access, alteration, disclosure, or destruction of your data. Our protocols include:
Encryption: All data transmitted between your device and our servers is encrypted in transit using industry-standard TLS 1.2/1.3 protocols. Sensitive database fields (e.g., passwords, API keys) are hashed and salted (using bcrypt) or encrypted at rest (using AES-256).
Access Controls: Strict Role-Based Access Control (RBAC) ensures that only authorized SCA personnel (with a legitimate "need-to-know") can access specific user data. We enforce the principle of least privilege.
Infrastructure Security: Our servers are protected by Web Application Firewalls (WAF), rate-limiting mechanisms, and continuous vulnerability scanning. We employ regular penetration testing to identify and patch security loopholes.
Incident Response: In the highly unlikely event of a data breach, we have a rapid incident response plan. We are legally committed to notifying affected users and the relevant regulatory bodies within 72 hours of identifying a severe breach.
9. Data Retention & Archival Policy
We retain your personal data only for as long as is objectively necessary to fulfill the purposes outlined in this policy. Our retention schedules are defined as follows:
Active Users: Data is retained for the duration of the active relationship (while you are a student or an active franchise owner).
Academic Records: Post-completion of a course, essential academic records (transcripts, certificate hashes, roll numbers) are archived permanently. This is a vital industry requirement to allow for lifetime certificate verification by future employers.
Financial Records: Invoices, payment receipts, and tax-related metadata are retained for a minimum of 7 to 10 years to comply with Indian Corporate and Taxation laws (e.g., Income Tax Act, 1961).
Telemetry & Logs: Server logs and technical telemetry are routinely purged or anonymized after 90 days.
Once the retention period expires, data is either securely wiped from our databases or irreversibly anonymized for statistical research.
10. General User Rights (Data Subject Rights)
We empower you with comprehensive control over your personal data. Depending on your jurisdiction, you possess the right to:
Right of Access & Rectification: View and update your personal information directly via your profile settings dashboard.
Right to Erasure (Right to be Forgotten): Request the permanent deletion of your account and associated non-academic data, subject to our overriding legal retention obligations.
Right to Data Portability: Request an export of your core academic data in a standard, machine-readable format (JSON/CSV).
Right to Restrict Processing: Request a temporary halt to data processing if you are disputing the accuracy of the data.
To exercise any of these rights, please raise a formal support ticket from your dashboard or contact our Grievance Officer.
11. Specific Rights for EU/UK Residents (GDPR Compliance)
If you are a resident of the European Economic Area (EEA) or the United Kingdom, you are granted specific rights under the General Data Protection Regulation (GDPR).
In addition to the general rights listed above, you have the right to object to automated decision-making and profiling. You also have the right to lodge a formal complaint with a supervisory authority in your member state if you believe our processing violates the GDPR.
We process your data strictly on the lawful bases of Contractual Necessity (Article 6(1)(b)) and Legitimate Interests (Article 6(1)(f)).
12. Specific Rights for California Residents (CCPA Compliance)
If you are a resident of California, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information.
Right to Know: You may request disclosure of the specific pieces of personal information we have collected about you over the past 12 months.
Right to Opt-Out: You have the absolute right to direct us not to sell your personal information. As a reminder, SCA does not sell personal information.
Non-Discrimination: We will not discriminate against you (e.g., by denying services or altering prices) for exercising any of your CCPA rights.
13. Protection of Minors & COPPA Compliance
Our platform is designed for individuals capable of pursuing professional technical education. However, we acknowledge that teenagers frequently enroll in basic computer courses.
We do not knowingly solicit or collect data from children under the age of 13. If an applicant is a minor (under 18 in India), the enrollment and consent must be facilitated by a parent or legal guardian.
If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will take immediate steps to permanently delete that information from our servers in accordance with the Children's Online Privacy Protection Act (COPPA).
14. Third-Party Links & External Platforms
Our courses and blog posts may occasionally contain links to external websites, open-source repositories, or third-party tools (e.g., GitHub, CodePen).
Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these external websites and are not responsible for their privacy statements. When you leave our platform, we strongly encourage you to read the privacy notice of every website you visit.
15. Communications & Opt-Out Policies
We may send you marketing communications, newsletters, and promotional offers. You can ask us to stop sending you marketing messages at any time by:
Following the opt-out/unsubscribe links in any marketing email sent to you.
Adjusting your communication preferences in your dashboard settings.
Please note that even if you opt out of marketing emails, you will continue to receive critical transactional and service-related messages (e.g., password resets, exam scheduling alerts, invoice receipts) as these are fundamental to our contract with you.
16. Franchise Data & B2B Privacy
Franchise Owners using our SaaS ERP operate as independent Data Controllers for their local branches, while SCA operates as the centralized Data Processor.
Franchises must independently adhere to applicable local privacy laws when manually collecting data from walk-in students.
SCA guarantees the logical isolation of franchise data (Multi-Tenant Architecture) ensuring that Branch A cannot access the student data of Branch B under any circumstances.
17. Policy Evolution & Notifications
As our SaaS platform scales, new features are introduced, and regulatory landscapes shift, this Privacy Policy will iteratively evolve.
Major structural changes (e.g., implementing new AI tracking, changing sub-processors) will be communicated proactively via email and prominent dashboard banners at least 15 days prior to taking effect.
Minor administrative or typographical updates will be reflected silently on this page. The "Effective Date" at the top of this document will always indicate the most recent revision.
18. Grievance Redressal & Contact Authority
If you harbor any concerns regarding our data processing practices, wish to exercise your data subject rights, or want to report a potential privacy violation, please escalate the matter to our designated authority:
Data Protection & Grievance Officer: Mr. Praveen Kumar (Director) Email: privacy@smartcomputeracademy.in Phone: +91 9905788324 Head Office: S.S.V. College Road, Kahalgaon, Bhagalpur (813203), Bihar, India.
We aim to acknowledge all formal privacy grievances within 48 hours and resolve them within a maximum timeframe of 30 working days.