Privacy Policy

1. Who is responsible for your data

This portal is operated on behalf of [ to be provided by the client ], whose registered address is [ to be provided by the client ]. Under India's Digital Personal Data Protection Act, 2023, they are the Data Fiduciary — the party that decides why and how your personal data is processed, and the party ultimately answerable for it.

The development team that built and maintains the portal acts as a Data Processor, handling data only on those instructions. You are a Data Principal, and you hold the rights set out further down this page.

2. What we collect

Only what the portal actually needs. In full, that is:

Your name

Given by you at registration. Used to identify you on the portal and against the feedback you submit.

Your email address

Given by you at registration. It is your login identity and how we contact you, including when you ask to reset your password.

Your password

Stored only as a salted cryptographic hash, never as readable text. Nobody — including the administrators and the development team — can read your password or recover it for you. If you forget it you set a new one; we cannot tell you the old one.

Your consent record

The date and time at which you ticked the consent box, kept as proof that consent was given and when.

Your account status

Whether your account is a teacher or an administrator account, and whether it is currently active.

Your video watch records

For each video you open: which parts of it you actually played, the total time played, that total as a percentage of the video's length, and the date a video was marked as watched. Explained in more detail below.

Your feedback responses

The answers you give on the feedback form, together with your name, email address and the date you submitted them.

Sign-in records

The session tokens that keep you signed in, and the ordinary technical records a web server keeps while serving your requests.

We do not collect your phone number, your postal address, the name of your school, an employee identifier, your date of birth, or any payment details. We do not ask for them and there is nowhere on the portal to enter them.

Your network (IP) address is looked at briefly to limit how many password-reset emails can be requested in a short period. It is not written to your account or kept afterwards.

3. Why we collect it

Each item above has one purpose, and we do not use it for anything else:

• Your name and email address let you sign in, identify you on the portal, and allow us to reach you about your account.
• Your password secures your account.
• The consent record demonstrates that you agreed, and when.
• The watch records let the review programme see which content has been reviewed and which has not.
• Your feedback is the point of the exercise — it is what the content is revised against.

We do not use any of it for advertising, for profiling, or to make automated decisions about you.

4. The legal basis

We process your personal data on the basis of your consent, given by ticking the consent box at registration. Consent is tied to the purposes described above; if those purposes change, we will ask again rather than assume.

You may withdraw your consent at any time. Withdrawing it stops further processing and leads to your data being deleted, as described under your rights below. Because the portal cannot function without an account, withdrawing consent means you can no longer use it.

5. How the portal records what you watch

This is the part people most want spelled out, so here it is in plain terms.

• While a video plays, the portal records which seconds of it were actually played. Only those count.
• Dragging the progress bar forward earns you nothing — a portion you skipped past was never played, so it is never counted.
• Re-watching a section you have already seen does not add to the total either. The record is of which parts you have seen, not of how long you sat there.
• Once 90% of a video has been played, or the player reports that the video reached its end, it is marked as watched and a tick appears against it in your list.
• Progress is kept between visits. If you watch half a video today and the rest next week, you are not made to start again.
• The tick cannot be set by hand — not by you, and not by an administrator on your behalf. It follows from playback only, and once set it stays set.
• The percentage played is held internally because it is what the 90% threshold is measured against. It is not shown on any screen.

None of this is hidden from you: the ticks are on your own screen, and this policy and the notice at registration are where the recording is disclosed. An administrator can see, for each teacher, which videos carry a tick and the date each was earned. Nothing beyond that is shown to them — no duration figures, no session counts, no partial progress.

One honest limitation: the portal can record that a video was played to the end. It cannot know whether anyone was watching it.

6. Who your data is shared with

We do not sell your personal data, and we do not share it for advertising. It reaches only these parties, and only to make the portal work:

YouTube (Google)

Every video is hosted on YouTube and played through YouTube's own player. We embed them through the privacy-enhanced domain, which means YouTube does not set its tracking cookies unless you actually press play. Once you do, your use of the player is subject to Google's own privacy policy, which we do not control.

Our email provider

Your email address is passed to the service that delivers portal email, such as a password-reset link.

The feedback spreadsheet provider

Feedback responses are recorded in a spreadsheet held by the client, shared only with named people on their side. It is not accessible to anyone who merely has the link.

Our hosting provider

The servers the portal and its database run on.

We may also disclose data where the law requires it of us.

7. Cookies

The portal sets only what it needs to keep you signed in. There are no analytics cookies, no advertising cookies and no third-party trackers on the portal's own pages.

• Sign-in cookies, which your browser holds and scripts on the page cannot read. They are how the portal knows it is you between one page and the next.
• A sign-in token stored by your browser for the same purpose. Signing out clears both.
• YouTube may set its own cookies once you press play on a video. That is Google's doing, not ours, and it does not happen until you play something.

8. How long we keep it

Your data is kept for as long as this content review phase requires it, and no longer. The retention period is [ to be provided by the client ].

At the end of the phase, teacher accounts and watch records are either deleted or kept for a further stated period under a stated purpose. Feedback responses may be kept indefinitely once they have been anonymised — that is, once your name and email address have been removed, so the responses are no longer personal data.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the following rights, and you can exercise any of them by writing to the contact address at the end of this policy:

Access

Ask for a copy of the personal data we hold about you, and a summary of how it is being processed.

Correction

Ask us to correct anything inaccurate or incomplete, or to complete anything missing.

Erasure

Ask us to delete your account and your data. Your account, your watch records and your feedback row are removed.

Withdrawal of consent

Withdraw your consent at any time. This stops further processing and leads to deletion, as above.

Grievance redressal

Raise a complaint about how your data has been handled. We will respond within [ to be provided by the client ].

Nomination

Nominate another person to exercise these rights on your behalf if you die or become incapacitated.

If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

10. How we protect your data

• Passwords are stored only as salted cryptographic hashes, and are never written down, logged or emailed in readable form.
• The portal is served only over an encrypted (HTTPS) connection.
• Administrative screens, including the watch record, are reachable only by an authenticated administrator account. A teacher cannot reach another teacher's records by editing a link — the server checks who you are on every request, not just when a page loads.
• Password-reset links can be used once, and expire shortly after they are issued.
• Personal data is kept out of application logs and error messages.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.

11. Changes to this policy

If this policy changes, the revised version appears on this page with a new date at the top. Where a change affects what you originally consented to, we will ask for your consent again rather than rely on the old one.

12. Contact us

For any question about this policy, to exercise any of the rights above, or to raise a grievance, contact the Grievance Officer:

Name

[ to be provided by the client ]

Email

[ to be provided by the client ]

Postal address

[ to be provided by the client ]