Privacy Policy

1. Data Fiduciary / Controller Information

This Privacy Policy is issued by Studya EdTech ("Studya", "we", "us", or "our"), operating in India as an educational digital technology platform providing modular online courses and eBooks.

2. Categories of Personal Data We Collect

We only collect data that is strictly necessary for legitimate operational purposes:

• Identity & Account Data: Your full name, email address, password hash (encrypted by Supabase Auth), and assigned unique referral code.
• Transactional & Order Data: Details of courses and modules purchased, module completion levels, payment reference numbers from Cashfree, and Studya Coins balance. We never see or store your credit card numbers, debit card PINs, or bank passwords. All payments are processed on Cashfree's PCI-DSS certified gateway.
• Affiliate & Payout Data: If you participate in Refer & Earn and request cash withdrawals, we collect your designated UPI ID or bank account details strictly to transmit approved referral payouts.
• Technical Session Data: IP address, browser type, and operating system collected in server logs strictly to prevent cyber attacks, brute-force attempts, and payment fraud.

3. Lawful Grounds & Purpose of Processing

In compliance with Section 4 of the Digital Personal Data Protection Act, 2023, your personal data is processed solely under the following lawful grounds:

• Performance of Contract: To provision your course modules, retain your lesson progress, and grant access to downloadable learning assets.
• Legitimate Uses: To credit 71% referral commissions and 11% Studya Coins cashback into the financial ledger.
• Legal & Tax Obligations: To maintain verifiable accounting records required under Indian taxation and e-commerce laws.
• Security & Fraud Prevention: To protect users against unauthorized account access and payment fraud.

4. Third-Party Service Providers (Data Processors)

We only share personal data with trusted, enterprise-grade service providers bound by strict confidentiality and security contracts:

• •Supabase Inc.: Cloud database and authentication infrastructure encrypted at rest and in transit.
• •Cashfree Payments India Pvt. Ltd.: RBI-authorized payment aggregator processing secure transactions via UPI, cards, and net banking.
• •Vercel Inc.: Secure, serverless hosting and application distribution platform.

5. Your Rights as a Data Principal

Under the DPDP Act 2023 and global standards, you enjoy the following rights:

6. Children's Privacy

Studya is intended for adults aged 18 years and older, or minors operating with explicit parental or legal guardian consent and supervision. We do not knowingly collect personal data from children under 18 years of age without verifiable parental consent. If we learn we have inadvertently gathered data from a child without parental consent, we will delete the account immediately.

7. Data Retention Period

We retain your personal data for as long as your account remains active to provide continuous access to your unlocked modules and referral ledger. If you request account closure, we securely anonymize or delete your personal details within 30 days, retaining only non-identifiable financial transaction logs mandated by applicable tax and accounting laws.