Privacy Policy

This policy explains how Invisible Mechanics Pvt. Ltd. ("we") collects and uses personal data when you use Invisible Mechanics. We are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. What we collect

• Account data: name, email address, phone number, target exam, grade, and an optional profile picture.
• Payment data: order amounts and payment identifiers from Razorpay, our payment processor. We never see or store your card/UPI credentials.
• Usage data: classes joined, watch time and resume positions, mock-test attempts and scores, chat/community posts, and device information (IP address, browser) for each login session.

Aggregate course activity: When enabled, our aggregate measurement counts course-page landings, course views and Enrol-button clicks in daily totals grouped by course and a fixed link-placement label. These totals help us understand interest in our courses. Our measurement table contains no names, contact details, account or session identifiers, browser identifiers, IP addresses, browsing histories or individual event records. We do not connect these totals to student or payment records or follow a person across pages or visits. Counts are activity totals, not unique people.

Technical request information: Measurement uses no analytics or advertising cookies, and its requests do not include the website sign-in cookie or referring-page URL. Our server briefly checks user-agent information to discard obvious automated requests without retaining it in the measurement table. Our hosting providers process ordinary connection and request information, such as IP addresses, user-agent information, timestamps and technical request identifiers, to deliver and protect the service. This operational processing is separate from the daily measurement table and is not used by this feature to profile students or target advertising.

2. Why we collect it (lawful purposes)

• Providing the service you purchased: login, playback, live classes, results.
• Payment processing, receipts, and fraud prevention.
• Security: enforcing one-active-session, detecting account sharing and abuse — this is why we record login device/IP details.
• Service messages: OTP codes, class reminders, purchase confirmations.

We do not sell personal data and do not use it for third-party advertising.

Financial summaries: We also summarise existing payment records to understand captured payments and refunds for each course. These financial totals are separate from website activity totals and do not attribute a student's purchase to a campaign or link.

3. Who we share it with (data processors)

• Supabase (database and file storage) and Render/Vercel (hosting).
• Cloudflare (video streaming and delivery).
• Razorpay (payments), Resend (email), MSG91 (SMS OTP).

Each processes data only to provide their service to us. Some are located outside India; transfers comply with the DPDP Act.

4. Children and students under 18

Most of our students prepare for JEE/NEET and may be under 18. If you are under 18, your parent or guardian must consent to your use of the Platform at signup. We do not use personal data of minors for tracking, behavioural monitoring, or targeted advertising.

5. Retention

We keep account data while your account exists, and payment records as required by tax law (typically 8 years). Login-session records are retained for up to 12 months for security. You may request deletion (below); we will delete data not required by law.

Daily aggregate measurement totals use a rolling 90-calendar-day reporting window; expired totals are removed from the active table during daily maintenance. Copies may remain in daily backups for their separate backup cycle: up to 7 days in native database backups and 30 days in our off-provider daily backups. Aggregate counter data is excluded from future monthly logical backups. After a restore, expired aggregate totals are removed before measurement reporting resumes. These limits do not change the retention of student or payment records.

Current operational dashboard log retention is 14 days on Render, 30 days for Vercel runtime logs, and 7 days on Supabase. These periods describe the dashboard logs and do not guarantee deletion of every separate provider security record.

6. Your rights (DPDP Act)

• Access a summary of your personal data and how it is processed.
• Correct or complete your data (most fields are editable in your profile).
• Withdraw consent or request erasure, subject to legal retention duties.
• Nominate a person to exercise these rights for you.
• Raise a grievance (Section 8) and escalate to the Data Protection Board of India.

7. Cookies

We use one essential cookie (im_session) to keep you signed in. It is httpOnly and not used for tracking. We currently use no analytics or advertising cookies; if that changes, this policy and a consent notice will be updated first.

8. Grievance officer

Rajbir Chakraborty — support@invisiblemechanics.com, Fourth Floor, Site.54, Yelenahalli Main road, Akshayanagar, Bangur Hobli, Road, off Bannergatta Road, Bengaluru, Karnataka 560114. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. See Contact & Grievance.

9. Changes

Material changes will be announced on the Platform or by email before they take effect.