Privacy Policy
Last updated: July 2026
Note: This document has been drafted to reflect what Varnalayam actually collects and does with your data, but has not yet been reviewed by a qualified lawyer. Treat it as a solid working draft, not a final legal document — get it reviewed for compliance with India's DPDP Act and other applicable data protection laws before relying on it in a dispute.
1. Information We Collect
- Account data: name, email, phone, language preference.
- Purchase data: order details, billing/shipping addresses, UPI payment screenshots (used only to verify payment, via automated OCR and manual review).
- Learning data: enrolled courses, lesson progress, quiz results, certificates issued.
- Eligibility data: for in-person class registration, whether you hold certificates for our online courses, and your self-declared country of residence.
- Marketplace data: artwork submissions, images, pricing, and any custom commission rate you request or are granted.
- Technical data: IP, browser, device, usage analytics.
2. How We Use Information
- Provide and improve the learning experience.
- Process purchases and deliver orders.
- Send transactional notifications (email, in-app).
- Comply with legal obligations.
3. Sharing
We share data only with processors necessary for service delivery — cloud infrastructure (AWS), email provider (AWS SES), and shipping partners. We do not sell personal data.
4. Security
Passwords are hashed (bcrypt). Data is transmitted via HTTPS and stored in encrypted databases hosted in the ap-south-1 (Mumbai) region.
5. Your Rights
You may request access, correction, or deletion of your data by emailing privacy@varnalayamarts.com.
6. Cookies
We use essential cookies for authentication and session management. No third-party tracking cookies are used in the MVP.
7. Data Retention
Account data is retained for the life of your account plus 30 days. Order records are retained for 7 years for tax/legal compliance.
8. Grievance Officer
In accordance with Indian IT Rules, complaints or concerns about how your data is handled can be directed to our Grievance Officer at privacy@varnalayamarts.com. We aim to acknowledge complaints within 48 hours and resolve them within 30 days.
Action needed: name a specific Grievance Officer (individual name, designation, and a direct phone number/postal address) here — a role-based email alone is a placeholder, not full compliance.