Privacy Policy

---

Last updated: 20 August 2026  |  Version: 2.0

Learningsol Ventures Private Limited ("CCC", "we", "us") operates the Confident Communicators Club platform. We are the data fiduciary for personal data processed on the Platform.

Contact: 140, Geown Oasis, V. Kallahalli, Sarjapur Road, Bengaluru 562125, Karnataka, India · General support: support@learningsol.com Grievance Officer: Ankita Pandey · info@gamified.club · 140, Geown Oasis, V. Kallahalli, Sarjapur Road, Bengaluru 562125, Karnataka, India (appointed under the DPDP Act 2023)

This policy is written in plain language on purpose. It explains what we collect, why, how long we keep it, and your rights. Because the Platform processes information about children, please read Sections 3 and 4 carefully.

• Tutors — adults who deliver the CCC programme.
• Parents — adults who hold the parent login for an enrolled student.
• Students — children aged 6–17 enrolled in the programme. Students do not have their own accounts; their data is accessed through the parent login.

First name — entered by the tutor at enrolment. Used to identify the student within their batch and on reports and certificates.

Attendance per session — entered by the tutor. Used for progress tracking and certificate eligibility.

XP awarded per session — entered by the tutor. Used for progress and motivation tracking.

Tutor note (maximum 140 characters) — entered by the tutor. Used to give the parent session feedback.

Submitted written work, typed or pasted — entered by the parent or student, optional. Used for tutor feedback and progress tracking.

Submitted handwritten work, as an image — entered by the parent or student, optional. Used for tutor feedback and progress tracking.

Link to audio or video, URL only — entered by the parent or student, optional. Used for tutor feedback. See Section 6 for an important limitation.

Certificates earned — generated by the Platform. Kept as a progress record.

Email address (used as the parent login and for credentials, reports, and notices), and consent records with timestamps.

Name, email, account and consent records (with timestamp and IP address), batch and session activity, and invoice records.

We do not collect: a child's date of birth, home address, phone number, school name, photographs of the child's face, biometric data, device identifiers, or browsing behaviour. We collect no data for advertising or profiling of any kind, and we do not display advertising. We use only essential cookies (see the Cookie Policy).

4.1 The Platform processes personal data of children. Under the DPDP Act 2023, this requires verifiable parental consent, and children's data may not be used for tracking, behavioural monitoring, or targeted advertising. We do none of those things.

4.2 Consent is obtained in layers:

• At enrolment: the tutor confirms, before adding each student, that they have obtained the informed consent of the student's parent or guardian to enrolment and to the data processing described in this policy. This confirmation is logged with a timestamp. [Counsel to confirm this mechanism satisfies the "verifiable consent" requirement under the DPDP Rules, or advise an additional direct parent-consent step.]
• At first submission: before any student work is submitted, the parent is shown the Submission Consent and must actively accept it. Video/audio links require an additional, specific consent. These acceptances are logged with timestamps.

4.3 Consent can be withdrawn at any time — see Section 9. Withdrawal does not affect processing already carried out.

We process personal data solely for: delivering the programme (session plans, attendance, XP); generating session reports and certificates; enabling optional work submission and tutor feedback; platform administration and tutor billing; maintaining legally required consent and audit records; and platform security.

Our legal basis is consent, obtained as described in Section 4, and, for limited records (consent logs, invoice records), our legal obligations and legitimate operational needs recognised under applicable law. We do not sell personal data, and we do not share it with anyone for marketing.

When a video or audio recording is submitted, it is submitted as a link only (e.g. YouTube or Google Drive). The recording itself lives on that external platform — not on CCC's servers. We store only the URL, attached to the student's session record.

This means:

• You control the recording's privacy. You are responsible for setting the video to private or unlisted on the hosting platform. If it is public, CCC cannot control who views it.
• We can delete the link; we cannot delete the video. On a deletion request, we remove the URL from our database. The recording on YouTube or Google Drive can only be deleted by you, on that platform.
• The external platform's own privacy policy governs the recording itself.

• A tutor sees data only for students in their own batches.
• A parent sees only their own child's data.
• CCC (platform administration) can access platform data for operation, support, and legal compliance.
• No one else. There is no public visibility of any student data, and no tutor can see another tutor's students.

Access is enforced technically through per-user access controls at the database level.

We use the following service providers to run the Platform. Each processes personal data only on our instructions, under a data processing agreement:

Supabase provides our database, authentication, and file storage (submitted work and certificates). Its data processing agreement is at https://supabase.com/legal/customer-resources/data-processing-addendum

Vercel provides application hosting and serverless functions. Its data processing agreement is at https://vercel.com/legal/dpa

Where the data is stored. Our primary database and file storage are hosted in Tokyo, Japan (Northeast Asia region). This means personal data — including students' first names, session records, and submitted work — is stored outside India. Under the DPDP Act 2023, transfer of personal data outside India is permitted except to countries the Central Government restricts by notification; Japan is not currently restricted. [Counsel to confirm the current notified position and whether any additional disclosure or safeguard is required. If the restricted-country list changes, this section and the storage region must be reviewed immediately.]

Vercel serves the application from a global edge network; application content is delivered from the location nearest the user, while the personal data itself resides in the database region above.

We share personal data with no other third parties, except where required by law or to protect a child's safety.

Parents (on behalf of their child) and tutors have the right to: access the personal data we hold; correct inaccurate data; erase data (subject to Section 10's retention rules and our legal obligations); withdraw consent for optional processing such as submissions; nominate a person to exercise these rights on their behalf, as provided by the DPDP Act; and grieve — raise a complaint with our Grievance Officer, and if unresolved, with the Data Protection Board of India.

To exercise any right, email info@gamified.club from your registered email address. We respond within [timeframe per DPDP Rules].

We keep personal data only as long as it is needed for the purpose it was collected for — with one important exception explained below.

Active student records — kept while the student is enrolled, plus [12 months] after their last activity, after which identifiers are removed.

Session logs, attendance, and XP records — kept for [24 months] after the batch ends, then deleted or anonymised.

Submitted work — text, images, and files — kept for [12 months] after the module ends, or deleted sooner on request.

External video and audio links (URLs) — removed on request, or together with the submission record above.

Parent contact email — kept while the child is enrolled, plus [12 months].

Tutor records — kept for the duration of the tutor's agreement, plus the period required for tax and legal purposes.

Certificates and tier-completion records are kept, not deleted. The CCC programme spans three tiers between roughly ages 6 and 17, and the graduate certificate can only be issued to a learner who has completed all three. If we deleted the record that a child completed Explorers, we could never validly issue their graduate certificate years later.

These records are deliberately minimal — the learner's name, the tier completed, and the date — and are kept for as long as the learner may still be progressing through the programme. 

Some records cannot be deleted on request, because the law requires or permits us to retain them as evidence of compliance:

• Consent records and legal acceptance logs — proof that consent was given, and for which version of which document
• Records of consent withdrawal — proof that a withdrawal was made and honoured
• Financial and tax records, including Credit purchases by tutors — retained per applicable tax and accounting law

We review data against this schedule on a quarterly basis and delete or anonymise what has passed its retention period, including the underlying files in storage — not just the database records. Deletion is permanent. Certificates already downloaded by a family remain theirs.

Where a deletion request is made, we act on it under Section 9 rather than waiting for the next review, except for the records in 10.3.

Data is encrypted in transit, access is restricted by role-based controls and row-level database security, passwords are stored hashed, and administrative access is limited and logged. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the Data Protection Board as required by law.

If we change this policy materially, we will notify registered users by email and on login, and where the change affects the basis of consent, ask for re-acceptance. Each version is dated and archived, and our records show which version you accepted.