Privacy Policy

Last updated: TODO — replace with actual publish date.

⚠️ DRAFT — placeholder content. Replace with lawyer-reviewed copy before public launch.

1. Who we are

TODO: Legal entity name, registered address, contact email (e.g. support@engitrack.in), and grievance officer per DPDP Act §10.

2. What data we collect

Identity: full name, email, phone, college, year of study, branch.
Application content: skills, motivation statement, task submissions.
Payment metadata: Razorpay order/payment IDs and amount (we never store card numbers).
Technical: IP address, browser user-agent, cookies necessary for session.

3. How we use it

TODO: explicit purposes — service delivery, communication, certificate generation/verification, fraud prevention, legal compliance.

4. Third-party processors

Razorpay Software Pvt. Ltd. — payment processing.
Resend, Inc. — transactional email delivery.
MongoDB Atlas (MongoDB, Inc.) — database hosting (region: TODO).
Vercel Inc. — application hosting.
Cloudinary Ltd. — image hosting (portfolio thumbnails).

TODO: confirm data-residency commitments with each.

5. Retention

TODO: define retention periods. Suggested defaults: applications kept for 3 years from submission; payment records 7 years (income tax); certificates retained indefinitely for verifiability.

6. Your rights under DPDP Act 2023

You have the right to access, correct, or request deletion of your personal data. Contact us at support@engitrack.in to exercise these rights. We will respond within 30 days.

7. Cookies

We use only session cookies required for authentication. No third-party tracking or advertising cookies.

8. Grievance officer

TODO: name, address, email, phone of designated grievance officer per DPDP Act §10.

9. Changes to this policy

We will notify registered users by email of material changes at least 30 days before they take effect.

10. Contact

Questions about this policy: support@engitrack.in