1. Who is responsible
[LEGAL ENTITY NAME], [REGISTERED ADDRESS], is the data fiduciary for personal data processed through Skylar Learning.
2. Using Skylar without an account
Learning progress stays on your device. If you do not sign in, completed lessons, test scores and the name you enter for certificates are stored only in your browser's local storage. They are not sent to our servers.
3. Learner accounts: what we collect and why
Accounts are optional. If you sign in, we process the following, with your consent, which you give by ticking the consent box on the sign-in page:
- Email address, to sign you in by email link or through Google, and to contact you about your account. If you choose Google sign-in, Google also shares your name and profile picture with us; we use only your name, to greet you on your account page.
- Learning progress: lessons completed and when, chapter-test and Market Rewind scores, and the name you choose for certificates. We use it to save your progress across devices and to work out which certificates and Skylar Coins you have earned.
- Community profile and posts: your display name, handle, bio, city, experience level, interests, avatar colour, the groups you join, and the questions, answers and votes you post. Your profile, posts, answers and group memberships are public; your votes, follows and reports are not. Reports you make are seen by moderators.
- Skylar Coins and referrals: your coin activity (what earned or spent coins, and when), the chapters you unlocked, your invite code, and, if you joined through or shared an invite link, which accounts are linked as inviter and invited. Your inviter can see how many people they invited and how many were rewarded, but not who they are or what they studied.
- Issued certificates: credential ID, the course completed, completion and issue dates, and the name on the certificate. Anyone who has a credential ID can see these details on our verification page; that is the purpose of a verifiable certificate. Nobody can list or search certificates without the ID.
- Sign-in records: technical data our authentication provider keeps to secure your account, such as sign-in times and IP address.
Who can see it at Skylar. A small number of authorised Skylar staff can view account details (email, name, sign-up and last sign-in dates, learning progress, coins, certificates and referral links) in an internal dashboard, only to run the service, prevent abuse and answer your requests.
We do not use this data for advertising, profiling or investment recommendations, and we do not share it with brokers.
4. Who processes it for us
- Supabase (Supabase Inc.) hosts our database and sign-in service as our data processor. Data is stored in [Supabase region, e.g. ap-south-1, Mumbai].
- Google, only if you choose "Continue with Google"; Google processes that sign-in under its own privacy policy.
- jsDelivr serves the sign-in software library, and Google Fonts serves the Montserrat typeface. Both receive your IP address when your browser requests these files.
- Our hosting provider may log technical information such as IP address, browser type and pages requested, for security and reliability. [Confirm hosting provider and log retention period.]
Where a processor stores data outside India, we transfer it only as permitted under section 16 of the DPDP Act.
Emails you send us. If you contact us, we receive your email address and message, and use them only to respond.
5. What we never do
- We do not sell your personal data.
- We do not ask for your trading account credentials, bank details, PAN or Aadhaar.
- We do not share your learning activity with brokers. If you open a broker account through a link on our site, the broker collects your data under its own privacy policy.
6. Your rights and withdrawing consent
Under the Digital Personal Data Protection Act, 2023, you may access, correct and erase personal data we hold about you, withdraw consent, nominate someone to exercise your rights if you die or become incapacitated, and raise a grievance. Withdrawing consent is as easy as giving it:
- Access: your account page shows what we hold, and "Download my data" gives you a copy.
- Correct: change the name for future certificates on My progress. The name on a certificate that has already been issued is fixed; email us to correct it.
- Erase and withdraw consent: "Delete my account" on your account page erases your account, progress and issued certificates immediately; their credential IDs stop verifying. You can also email us.
- Without an account: progress on your device can be deleted at any time from My progress ("Reset all progress") or by clearing your browser data. Signing out also clears your account's copy from that device.
We respond to requests within [30] days.
7. Security and retention
Account data is protected by encryption in transit and by database rules that let each learner read and change only their own records. We keep account data until you delete your account. [State the period after which inactive accounts are deleted, with notice sent 48 hours before, as the DPDP Rules require.] Sign-in records are kept by Supabase for [period]. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.
8. Children
Learner accounts are for people aged 18 and over; you confirm this when you sign in. We do not knowingly create accounts for children, and we delete any we find. Children may use Skylar without an account, which stores nothing on our servers.
9. Contact and grievances
Privacy questions and requests: . Grievance Officer: [NAME], . If you are not satisfied with our response, you may approach the Data Protection Board of India.