Privacy Policy

1. Information we collect

You give us, when you register:

• Your name and email address — required.
• A password, which we never store in readable form (see section 6).
• Your date of birth — required, so that we can tell whether the law treats your account as a child's account. See section 8.
• Your college or university name and your phone number — both optional.
• If you are under 18: your parent or legal guardian's name and email address, and the moment their consent was recorded.

You give us, as you use the platform:

• Links to the work you submit for each week, and any message you send us through the contact form or by email.
• Your enrolment record — which track you joined, whether as a course or an internship, and its duration.

We generate or record automatically:

• Certificate records: your name, certificate ID, track, and completion date.
• Server logs of requests to our API, which include your IP address, the browser's user-agent string, the page or endpoint requested, and the time. These are kept to operate the service and investigate abuse.
• Login timestamps and the verification status of your email address.

We do not ask for and do not want your Aadhaar number, PAN, bank details, card details, caste, religion, health information or biometrics. Please do not send them to us.

2. Why we use it

The DPDP Act requires us to tell you the specific purpose of each use rather than a general one. We use your data only for these:

• Name, email, password — to create your account, let you sign in, verify that the email address is yours, and let you reset a forgotten password.
• Date of birth — solely to determine whether guardian consent is required for your account.
• Guardian name and email — solely to record and notify the consent required for a student under 18, and to give that guardian a way to withdraw it.
• College name — to print your institution on your certificate and to understand which institutions our students come from.
• Phone number — to reach you about your enrolment, and, only if you have separately opted in, to send task and certificate updates over WhatsApp.
• Submitted work and enrolment record — to have a mentor review it, track your progress, and decide whether a certificate is due.
• Certificate records — to issue your certificate and to let anyone you show it to confirm it is genuine.
• Server logs — to keep the service running, to rate-limit and block abuse, and to investigate security incidents.

We do not sell your personal data, we do not share it with advertisers, and we do not use it to build advertising profiles or to make automated decisions that produce legal effects for you. Every certificate decision is made by a human mentor.

3. Consent and withdrawal

When you register, you tick a box confirming that you have read and agree to this Privacy Policy, the Terms of Service and the Refund Policy. We record the moment you did so. You cannot create an account without that affirmative step.

WhatsApp updates are a separate, optional tick-box that is off by default. We will not message you on WhatsApp unless you have turned it on, and turning it off in your dashboard profile stops it immediately. We will still email you about anything that affects your enrolment, because those messages are part of the service you bought rather than marketing.

Withdrawing consent. You may withdraw your consent at any time, as easily as you gave it, by writing to support@troviq.in. Withdrawal is not retrospective: it does not undo processing that was lawful before you withdrew. If you withdraw the consent your account depends on, we will close the account, and we may be unable to continue providing the course or internship.

4. Who we share it with

We do not sell your personal data. We rely on the following processors to run the platform. Each receives only what that function needs:

• Supabase — our PostgreSQL database and the private storage bucket that holds certificate PDFs. Holds account, enrolment, submission and certificate data.
• Render — hosts our API and the certificate rendering service. Processes data in transit and holds server logs.
• ZeptoMail (Zoho Corporation) — delivers transactional email. Receives your name and email address and the contents of the message.
• Resend — used only for our own infrastructure alerts, which do not contain student data.
• Cloudflare — serves and protects the website. Sees request metadata including your IP address.
• Meta Platforms (WhatsApp Cloud API) — used only if you have opted in to WhatsApp updates. Receives your phone number and the contents of those notifications.

Beyond these, we share data only in two situations: publicly verifiable certificate details (name, certificate ID, track, completion date) shown to whoever you give a certificate ID or QR code to; and disclosures to courts, regulators or law enforcement where Indian law compels them.

Transfers outside India. Some of these providers operate infrastructure outside India, so your data may be processed abroad. Section 16 of the DPDP Act permits such transfers except to countries the Central Government has restricted, and we will stop transferring to any provider that falls under such a restriction. Our email is sent through ZeptoMail's Indian endpoint.

5. Data retention

We keep your account data for as long as your account is open. If you ask us to delete your account, we erase it and instruct our processors to do the same.

Two things survive deletion, and you should know this before you ask:

• Certificate records are kept indefinitely. A certificate whose record we had deleted could not be verified, which would devalue every certificate we have issued. The retained record is limited to the name, certificate ID, track and completion date printed on the certificate itself.
• Records we are required to keep by company, tax or accounting law, for the period that law prescribes.

Server logs are retained only as long as our hosting providers hold them in the ordinary course, and are not used to build any profile of you.

6. Security and breaches

Traffic to the site and the API travels over HTTPS. Passwords are stored only as bcrypt hashes, which means we cannot read them and cannot tell you what your password is. Session cookies are httpOnly, Secure and SameSite=Lax, so page scripts cannot read them. Certificate PDFs live in a private bucket and are streamed through an authenticated endpoint rather than a public link. Access to production data is restricted to the company's own administrators.

No system is completely secure. If a personal data breach occurs, the DPDP Act requires us to notify the Data Protection Board of India and every affected person. We will do so without undue delay, telling you what happened, what data was involved, and what you should do about it. Please use a strong, unique password and tell us at once if you think your account has been accessed by someone else.

7. Your rights

As a Data Principal under the DPDP Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you, what we are doing with it, and the processors we have shared it with. The My data panel on your dashboard downloads all of it as a single file, immediately, including the list of processors in section 4.
• Correction, completion and updating of data that is wrong or out of date. You can edit your name, college and phone number yourself from your dashboard.
• Erasure of your personal data and your account, subject to the retention limits in section 5. Delete my account on your dashboard does this at once, after asking for your password. Where you hold a certificate we have already issued, we keep only that certificate and the name printed on it, so it stays verifiable for the college or employer relying on it, and erase everything else.
• Grievance redressal through the Grievance Officer in section 12, before approaching the Data Protection Board.
• Nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. You can record, change or remove a nominee from the My data panel on your dashboard.
• Withdraw consent at any time, as described in section 3.

Access, nomination and erasure are self-service, so you do not have to ask us or wait for us. For anything else, email support@troviq.in from the address registered on your account and we will respond within the timelines in section 12. The Act also requires you to exercise these rights in good faith and not to file false or frivolous complaints.

8. Students under 18

Section 9 of the DPDP Act treats anyone under 18 as a child and does not allow us to process a child's data without verifiable consent from a parent or legal guardian. That is why the date of birth on the registration form is mandatory.

If the date you enter makes you under 18, the form asks for your parent or legal guardian's full name and email address and for their explicit consent before the account can be created. We then email that guardian to tell them the consent has been recorded, and give them a direct route to withdraw it — at which point we delete the account and the data held with it.

The Act also forbids tracking, behavioural monitoring and targeted advertising directed at children. We do none of these for any user, of any age.

If you believe a child has registered without their guardian's consent, write to support@troviq.in and we will act on it.

9. Cookies

We set a single essential cookie of our own, trv_token, when you log in. It holds your session and is required for the platform to work. It is an httpOnly cookie, so it cannot be read by JavaScript running in your browser; it is marked SameSite=Lax and Secure, and it expires 7 days after login or immediately when you log out.

We do not use advertising cookies, and we do not run Google Analytics or any similar product that profiles you across sites. Our website is served through Cloudflare, which adds its own privacy-focused traffic measurement to pages it serves and may set cookies for security and bot protection. That measurement reports aggregate traffic to us; it does not identify you to us and we do not combine it with your account.

10. Third-party links

Our platform may contain links to external websites. We are not responsible for their privacy practices and encourage you to review their policies.

11. Changes to this policy

We may update this policy from time to time. Where a change materially affects how we handle your data, we will email registered users before it takes effect, and where the law requires it we will ask for your consent again rather than assume it. The date at the top of this page always shows the current revision.

12. Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it, and the Consumer Protection (E-Commerce) Rules, 2020, the following officer may be contacted for any complaint about your personal data or your use of this platform:

• Designation: Grievance Officer, TROVIQ (OPC) PRIVATE LIMITED
• Email: support@troviq.in — please put "Grievance" in the subject line
• Phone: +91 79847 64001, Monday to Friday, 10:00–18:00 IST
• Post: Grievance Officer, B-2 Sahyog Society, Refinery Road, Gorwa, Vadodara, Gujarat 390016, India

A grievance raised through the contact form is given a reference number of the form TRV-C-XXXXXXXX the moment it is recorded, shown on screen and repeated in the acknowledgement we email you. Quote it in any follow-up. We acknowledge every grievance within 48 hours of receiving it, and resolve it within one month. If you are not satisfied with the outcome, you may escalate a data protection complaint to the Data Protection Board of India, or a consumer complaint to the National Consumer Helpline or the appropriate consumer forum.

13. Contact

The Data Fiduciary for your personal information is TROVIQ (OPC) PRIVATE LIMITED, a One Person Company incorporated in India and registered with the Registrar of Companies, Gujarat, Dadra & Nagar Haveli.

• Corporate Identity Number (CIN): U62011GJ2026OPC182113
• Registered office: B-2 Sahyog Society, Refinery Road, Gorwa, Vadodara, Gujarat 390016, India
• Email: support@troviq.in
• Phone: +91 79847 64001

For any privacy-related questions or requests, including access, correction or deletion of your data, contact us at the email or postal address above.