Privacy Policy & Data Notice

1. Dual Operational Roles: Data Fiduciary vs. Data Processor

Under the Digital Personal Data Protection Act, 2023 (DPDP Act 2023), VishwaDrishti operates under two distinct legal capacities depending on how you access the platform:

2. Categories of Personal Data Collected & Processed

We collect and process only the minimal digital personal data necessary to provide academic services:

• Identity & Profile Data: Full name, email address, mobile number (for OTP authentication), username, optional avatar selection, and target examination category.
• Authentication & Security Data: Cryptographic password hashes (one-way hashed), session tokens, Multi-Factor Authentication (MFA) setup keys, and role assignments.
• Academic Submissions & Answer Copies: Scanned handwritten descriptive answer papers (PDF/images), OCR-extracted text, test attempts, quiz scores, and student self-evaluations.
• Faculty & Evaluator Annotations: Evaluator comments, rubric scorecards, marks breakdown, and personalized improvement remarks.
• Institutional & Cohort Records: Enrolled batch IDs, roll numbers, mentor assignment links, and session attendance timestamps where enabled by your coaching institute.
• Academic Analytics & Learning Velocity: Syllabus completion indices, topic retention scores, flashcard mastery curves, and academic risk/dropout prevention indicators.
• Device, Network & Security Telemetry: Masked IP addresses (for rate-limiting and DDoS mitigation), browser user-agent strings, and system audit logs for CERT-In statutory compliance.
• Commercial & Billing Records: Order identifiers, plan durations, GST invoices, and payment gateway transaction references (we do NOT collect or store credit/debit card numbers, CVVs, or UPI PINs).

3. Artificial Intelligence, Automated Evaluation & Analytics

VishwaDrishti incorporates machine learning and generative artificial intelligence tools (such as Rubric Studio) to deliver formative academic feedback:

4. Purposes and Lawful Bases for Processing

Digital personal data is processed strictly under legitimate, lawful grounds recognized by the DPDP Act 2023:

• Contractual Performance (DPDP Sec 6): To create user accounts, deliver test series, process evaluations, and enable LMS portal features.
• Consent (DPDP Sec 6): To send optional academic updates, study summaries, and platform notifications.
• Institutional Instructions (DPDP Sec 8(2)): To process student batch rosters and attendance on behalf of the client institute.
• Legal Obligation & Security: To comply with tax/accounting mandates (GST Act) and cybersecurity directives (CERT-In incident reporting).

5. Cookies and Client-Side Storage

We utilize minimal, functional cookies and local storage tokens necessary to operate the application safely:

• Authentication Cookies (VDAccessToken, VDLoggedIn): Secure, HttpOnly cookies used to authenticate and maintain your active session.
• User Preferences (theme): Local storage key used to remember your Light/Dark interface theme selection.
• Consent Markers (cookie_consent): Cookie used to record whether you have acknowledged our privacy and cookie notice.
• No Third-Party Ad Cookies: We do NOT deploy third-party advertising cookies or cross-site tracking pixels.

6. Third-Party Service Providers & Subprocessors

VishwaDrishti engages reputable third-party infrastructure and service providers bound by strict confidentiality and data protection obligations:

7. Technical & Organizational Security Safeguards

Pursuant to Section 43A of the Information Technology Act, 2000 and Section 8(5) of the DPDP Act 2023, we implement reasonable technical and organizational measures:

• In-Transit Encryption: All active communications are secured using modern Transport Layer Security (TLS) with HTTP Strict Transport Security (HSTS).
• Credential Protection: Passwords and API secrets are protected using one-way cryptographic algorithms with salt parameters.
• Multi-Tenancy Isolation: Logical isolation enforcement in edge middleware and query filters guarantees zero cross-tenant visibility.
• Access Control: Administrative interfaces require role-based access control (RBAC) and Multi-Factor Authentication (MFA).

8. Data Retention & Statutory Deletion Boundaries

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was gathered, subject to legal limitations:

• Active Account Duration: Aspirant profiles and study histories are maintained throughout the active lifecycle of your account.
• User Account Deletion: Upon verified erasure request, personal data and uploaded copies are deleted from active databases within thirty (30) days.
• Tax & Accounting Exception: Commercial invoices, billing records, and GST transaction ledgers are retained for eight (8) years under applicable Indian tax statutes.
• Cybersecurity Audit Logs: System event logs are retained for statutory periods in compliance with CERT-In directions.
• Backup Lifecycle: Residual copies in automated disaster-recovery backup snapshots expire in accordance with standard backup rotation schedules.

9. Children & Minor Data Protection

VishwaDrishti is primarily designed for adult aspirants preparing for Civil Services and professional competitive examinations (where the standard eligibility age is 21 years and above).

Where the platform is deployed in foundation or school programs involving individuals under the age of 18 years, the enrolling institution acts as the Data Fiduciary responsible for securing verifiable parental/guardian consent under Section 9 of the DPDP Act 2023. VishwaDrishti provides a dedicated Parent Portal (`/parent/portal`) for guardian oversight and strictly prohibits behavioral tracking or targeted advertising directed at minors.

10. Data Principal Rights under Indian Law

Under the Digital Personal Data Protection Act, 2023, Data Principals enjoy statutory rights, exercisable through our settings portal or by contacting our Grievance Officer:

11. Grievance Redressal Officer & Corporate Contact

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, any privacy complaints, rights requests, or grievances may be addressed to: