Privacy Policy
Last updated: [DD Month YYYY]
Most privacy policies are written to protect the company. This one is written so you actually know what happens to your information.
Read it. It's shorter than it looks, and there's a summary right below if you're in a hurry.
The short version
- We collect your name, email, phone number, what you learn, and what you submit. That's most of it.
- Your phone number is visible to everyone in your course's WhatsApp group. That's how WhatsApp works, and it's the single most important thing on this page.
- We don't sell your data. Not to advertisers, not to recruiters, not to anyone.
- We never see your full card or bank details. The payment gateway handles that.
- We don't know how much you paid or whether you paid ₹0 in any way that affects how you're treated. Nobody in a community group can see your payment amount.
- Some lessons embed YouTube videos, and YouTube can set cookies when you watch them.
- You can ask us to show you your data, fix it, or delete it. Email [privacy@shattak.com].
Now the detail.
1. Who this covers
This policy explains how [LEGAL ENTITY NAME] ("Shattak", "we", "us") handles your personal information when you use [shattak.com], our courses, our assignment and certificate systems, our mentorship sessions, and our community groups.
It applies to students, mentors, and casual visitors. It sits alongside our [Terms & Conditions].
If you're in India, this policy is written with the Digital Personal Data Protection Act, 2023 in mind. Under that law you're the "Data Principal" and we're the "Data Fiduciary". We'll use plain words instead of those, but that's the legal shape of the relationship.
2. What we collect
Things you give us directly
When you create an account: your name, email address, phone number, and password. We store the password in hashed form, meaning we can't read it and neither can anyone who gets hold of the database.
Optional profile details: your city, education background, current role, goals, or anything else you choose to add. Skip these if you'd rather not. Nothing breaks.
When you enroll and learn: which courses you've joined, which lessons you've opened, how far you've got, when you last logged in, and which access keys you've used.
When you submit an assignment: the project itself. Code, documents, files, links, designs, whatever the course asked for. Plus the date you submitted and any resubmissions.
When you fill the feedback form: your rating and comments about the course, before your certificate unlocks.
When you pay: the amount, the date, and a transaction reference. See Section 5 for what we deliberately don't collect here.
When you book mentorship: your availability, the topic you want help with, and anything you write in the booking notes.
When you contact us: whatever's in your email or support message, including any attachments.
Things we collect automatically
- Device and browser type, operating system, screen size
- IP address, and the rough location it suggests (city level, not your street)
- Pages you visit on Shattak, and how long you spend on them
- Referral source, so we know whether you found us through search, a friend, or a link somewhere
- Error logs when something crashes
Things we get from elsewhere
- Confirmation from our payment gateway that a transaction succeeded or failed
- Basic account details if you sign up using Google or another sign-in provider
- Aggregate, non-identifying analytics from tools we use
3. WhatsApp: read this part properly
Our course communities currently run on WhatsApp. It's where students already are, and it lets us build mentorship groups without spending money we'd rather put into courses. But it comes with a real trade-off, and you should decide with your eyes open.
When you join a Shattak WhatsApp group:
- Your phone number becomes visible to every other member of that group. Students, mentors, everyone.
- Your WhatsApp display name and profile photo are visible too, depending on your own WhatsApp privacy settings.
- Anything you post is visible to the whole group and can be screenshotted or forwarded by anyone in it.
- We cannot un-send, un-see, or delete something once other members have seen it.
- WhatsApp is owned by Meta and processes your data under its own privacy policy, not ours.
What we do about it:
- We don't extract member lists to build marketing databases.
- We don't sell or share group phone numbers with anyone outside Shattak.
- Our community rules forbid members from scraping numbers and messaging people who didn't ask. We remove people who do it.
- You can leave a group at any time without losing access to your course. The access key stays valid once you've used it.
What we can't do: control what another student does with your number after they've seen it. If that's a dealbreaker, use a secondary number for the group, or skip the group and reach us over email instead. Tell us at [support@shattak.com] and we'll get you the access key another way.
We may move communities to Telegram or to our own in-platform system later. When we do, we'll update this section and tell you what changes.
4. Why we use your information
Every piece of data above earns its place. Here's what each is for:
| What we use | What it's for |
|---|---|
| Name, email, password | Running your account and logging you in |
| Phone number | Community group access, and important course notices |
| Course progress | Showing you where you left off, and spotting where students get stuck |
| Assignment submissions | Reviewing your work and deciding whether you've met the outcome |
| Feedback form | Improving the course for the next batch |
| Payment records | Knowing a course is closed out so your next one can open |
| Device and usage data | Fixing bugs, keeping the platform up, blocking abuse |
| Support messages | Answering you |
We also use aggregated, anonymised patterns to improve curriculum. For example, if most students abandon a course at module four, that tells us module four needs rewriting. That analysis doesn't identify you.
On the legal basis for all this: mostly it's necessary to provide the service you signed up for. Where it isn't, such as marketing emails, we ask for your consent first and you can withdraw it whenever you like.
5. Payment information
We use third party payment gateways to process contributions.
We do not collect or store:
- your full card number
- CVV
- UPI PIN
- net banking credentials
Those go directly to the payment provider, who is certified to handle them. We only ever see the outcome: amount, date, status, and a reference ID.
One thing worth saying plainly: because you choose your own amount, including ₹0, that number sits in our records. It is not visible to mentors, not visible to other students, and not visible inside community groups. It doesn't affect your certificate, your mentorship access, or how anyone treats you. Nobody at Shattak is going to think less of you for a ₹0, and the system isn't built to let them find out anyway.
6. Cookies and similar technologies
We use cookies for the boring necessary things:
- Essential: keeping you logged in, remembering your session, security
- Preference: remembering settings like language or theme
- Analytics: understanding which pages get used and where people drop off
You can block cookies in your browser. Essential ones being blocked will break login, so that's the trade.
Embedded YouTube videos: many of our lessons point to or embed YouTube. When you play one, YouTube and Google may set their own cookies and collect viewing data under their policies. We don't receive that data, and we can't switch it off on their behalf. Where possible we use privacy-enhanced embedding.
7. Who we share your information with
We do not sell your personal data. No advertisers, no recruiters, no data brokers, no exceptions.
We share it only with:
Mentors, and only what they need. A mentor can see your name, your course progress, and the assignment you submitted to them. They don't see your email, your payment history, or your other courses. In WhatsApp groups they see your number like everyone else does.
Service providers who run parts of the platform for us, including hosting, email delivery, payment processing, video hosting, and analytics. They're contractually limited to doing the job we hired them for.
Anyone you choose. If you share your certificate link publicly or post your project somewhere, that's your call.
Authorities, if we're legally required to, or if we need to protect someone's safety or defend a legal claim. We'll tell you if we're allowed to.
A future owner, if Shattak is acquired or restructured. Your data would move with the business under the same protections, and we'd notify you.
8. Certificates and your work
Certificates: if we issue verifiable certificate links, anyone with the link can see your name, the course name, and the completion date. That's the point of verification. It's designed to be shown to employers.
Your assignments: stay yours. We store them, review them, and use them to decide whether you've met the outcome. We may look at them internally to improve how a course teaches something.
We will not publish, feature, or showcase your work without asking you first. If you say no, nothing happens to your certificate or your standing.
Feedback: we may quote feedback publicly, but only anonymised or with your name if you've explicitly agreed.
9. How long we keep things
- Account data: as long as your account is open, then up to [90] days after you close it
- Course progress and certificates: kept indefinitely, so your certificate stays verifiable years later
- Assignment submissions: [2] years after course completion, then deleted unless you ask us to keep them
- Payment records: as long as tax and accounting law in India requires, which is currently up to 8 years
- Support conversations: [3] years
- Server logs: [90] days
If you ask us to delete your account, we'll do it, but we may keep the minimum needed for legal and accounting obligations, and we'll keep certificate verification records so we're not invalidating a credential you might be relying on. Tell us if you want that removed too and we'll discuss it.
10. Security
What we do:
- Encrypt data in transit using HTTPS
- Hash passwords, so nobody including us can read them
- Limit internal access to people who need it for their job
- Use established providers for payments and hosting rather than building our own
- Review access and patch things when problems surface
What we won't pretend: no system is perfectly secure. If a breach happens that puts you at risk, we'll tell you and the relevant authority, as the law requires.
Your side of it matters too. Use a password you don't reuse elsewhere, and tell us fast at [security@shattak.com] if something looks wrong with your account.
11. Your rights
You can, at any time:
- See what we hold. Ask for a copy of your data and a summary of how we've used it.
- Correct it. Fix anything wrong, incomplete, or out of date. Most of it you can edit yourself in your profile.
- Delete it. Ask us to erase your data, subject to the legal retention in Section 9.
- Withdraw consent. For anything we asked consent for, like marketing emails. Unsubscribe links work, and so does emailing us.
- Nominate someone. Under the DPDP Act you can nominate a person to exercise these rights on your behalf if you die or become incapacitated.
- Complain. To us first, and to the Data Protection Board of India if we don't sort it out.
Email [privacy@shattak.com] with what you want. We'll respond within [30] days. We may ask you to confirm your identity first, because handing your data to someone pretending to be you would be worse than a slow reply.
These rights are free to use. If a request is repetitive or excessive we may push back, but we'll explain why.
12. Marketing emails
We'll send you emails about the courses you're enrolled in, assignment deadlines, certificate availability, and anything operational. Those aren't optional, since they're part of the service.
For everything else, new course launches, offers, newsletters, we'll ask first. Unsubscribe whenever. It won't affect your access to anything.
13. Students under 18
If you're under 18, a parent or guardian needs to agree to this policy and to our Terms before you use Shattak.
For users we know to be children, we do not:
- run behavioural tracking or advertising
- use their data for marketing
- collect more than the account and course data we need
If you're a parent and you believe your child signed up without your consent, email [privacy@shattak.com] and we'll delete the account and its data.
14. Where your data lives
Our servers and service providers may be located outside India. Where that's the case, we take reasonable steps to make sure your data gets equivalent protection, and we only use providers permitted under Indian law.
15. Changes to this policy
Shattak is early and still being built. This policy will change as we add features, move communities off WhatsApp, or start producing our own video.
When we change something significant, we'll update the date at the top and notify you by email or in the platform. Minor edits get the date change alone.
16. Grievance Officer
Under Indian law, we're required to give you a named contact for privacy complaints.
Grievance Officer: [NAME] Email: [grievance@shattak.com] Address: [REGISTERED ADDRESS]
We aim to acknowledge within [48] hours and resolve within [30] days.
17. Contact us
For anything privacy related:
Email: [privacy@shattak.com] General support: [support@shattak.com] Address: [REGISTERED ADDRESS]
We collect what we need to teach you something and prove you learned it. Not more. If you ever think we've crossed that line, tell us and we'll fix it.