Privacy Policy

We process your personal data for the following purposes:

• To create and manage your account
• To deliver your internship simulation, review your submissions, and track your progress
• To process payments and issue GST invoices
• To issue offer letters and certificates, and to let anyone verify a certificate by its ID
• To send transactional emails, such as sign-in and password reset links, purchase confirmations, invoices, and certificates
• To answer your support tickets and run the referral programme
• To send promotional or educational communications, only where you have opted in
• To comply with applicable Indian laws and regulatory obligations
• To detect and prevent fraud, abuse, or unauthorised access
• To fix errors and improve the Platform using analytics

Under the DPDP Act, 2023, we process your personal data on the following grounds:

• Consent - you provide explicit, informed consent at the point of registration and at relevant data collection points
• Contractual necessity - processing required to deliver the internship simulations you have purchased
• Legal obligation - compliance with Indian tax laws (GST), financial regulations, and court orders
• Legitimate interests - fraud prevention, platform security, and aggregate analytics, balanced against your rights

You may withdraw consent at any time by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but may impact your ability to use certain features of the Platform.

We do not sell your personal data. We share it with the service providers that run the Platform, and each one receives only what it needs to do its job:

• Razorpay - payment processing
• Vercel and our cloud hosting providers - hosting the Platform and its API, plus cookie-free performance analytics
• Neon - database hosting
• Cloudflare - file storage for uploads and learning materials
• Resend - sending emails
• PostHog - product analytics and error tracking
• Judge0 (via RapidAPI) - running and grading the code you submit in coding exercises
• Google and GitHub - only if you choose to sign in with them

We may also share your data:

• With professional advisors (lawyers, auditors) under strict confidentiality obligations
• With government authorities or regulators where required by Indian law, court order, or legal process
• In connection with a business restructuring, merger, or acquisition, subject to the acquirer upholding this policy

Each provider processes your data only to provide its service to us, under its own data protection terms.

We operate only in India, but some of our service providers store or process data outside India. Our database is hosted in Singapore, product analytics are processed in the United States, and the other providers listed in section 4 may process data wherever they run their infrastructure. We transfer personal data outside India only as permitted under Section 16 of the DPDP Act.

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account data: retained for the duration of your account plus 3 years after closure
• Payment and transaction records: retained for 8 years in compliance with Indian accounting and GST requirements
• Learning activity data: retained for the lifetime of your account
• Analytics data: retained in anonymised/aggregated form indefinitely

On account deletion, we will erase or anonymise your personal data unless retention is required by law.

We implement appropriate technical and organisational measures to protect your data, including:

• SSL/TLS encryption for all data in transit
• Passwords stored only as one-way hashes
• Role-based access controls limiting staff access to personal data
• Regular security assessments and vulnerability testing
• Incident response procedures in case of a data breach

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant Data Protection Board and, where required, affected users, in accordance with the DPDP Act.

Under the DPDP Act, 2023, you have the following rights:

• Right to Access - you may request a summary of the personal data we hold about you and how it is being processed
• Right to Correction - you may request correction of inaccurate or incomplete data
• Right to Erasure - you may request deletion of your data, subject to legal retention obligations
• Right to Grievance Redressal - you have the right to raise a complaint with us and to escalate to the Data Protection Board of India if unresolved
• Right to Nominate - you may nominate another individual to exercise your rights in the event of your death or incapacity

To exercise any of these rights, please submit a written request to tech@devitinternational.com. We will respond within 30 days.

In accordance with the IT Act, the SPDI Rules, and the DPDP Act, we have designated a Grievance Officer to address data-related concerns:

We encourage you to contact us directly before escalating any concern to the Data Protection Board of India.

You must be at least 13 years old to use the Platform. Users between 13 and 17 may use it subject to the following:

• Users under 18 must have the verifiable consent of a parent or legal guardian to register and use the Platform
• Parents or guardians registering on behalf of a minor are responsible for ensuring the accuracy of the information provided and for supervising the minor’s use of the Platform
• We do not knowingly collect personal data from children under 18 without verifiable parental or guardian consent
• We do not serve behavioural advertising to users identified as minors
• Parents or guardians may request access to, correction of, or deletion of a minor’s data by contacting us at tech@devitinternational.com

If we become aware that we have collected personal data from a child under 18 without appropriate parental consent, we will take prompt steps to delete such data.

We use a small number of cookies and similar browser storage:

• Sign-in (essential) - __Secure-authjs.session-token keeps you signed in, __Host-authjs.csrf-token protects sign-in forms from cross-site request forgery, and __Secure-authjs.callback-url returns you to the right page after signing in. These are set on every visit, and the Platform cannot work without them.
• Referral - devit_ref remembers the referral code from a link you opened, for up to 30 days, so the person who referred you gets credit. It is deleted once you sign in.
• Analytics - PostHog sets a ph_<id>_posthog cookie and uses local storage to assign your browser a random ID, so we can count page views and track errors. When you are signed in, this activity is linked to your account (user ID, name, email, and role).
• Payments - Razorpay may set its own cookies when the payment window opens. These are covered by Razorpay’s privacy policy.

Vercel Analytics and Speed Insights, which we use to measure site performance, do not use cookies. You can block or delete cookies in your browser settings, but blocking the sign-in cookies will stop you from signing in.

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. We will notify registered users of material changes via email or a prominent notice on the Platform at least 15 days before the changes take effect. Your continued use of the Platform after that period constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact: