Privacy Policy

1. Introduction

Sparq Academy (the "Platform") is operated by Sparq IT Services (India) ("we", "us", or "our"), a company incorporated and operating from Lucknow, Uttar Pradesh, India. We are committed to protecting your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian privacy laws.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Platform at https://sparqacademy.in. Please read it carefully before registering or making a purchase.

2. Data We Collect

We collect the minimum personal data necessary to provide our services:

• Identity Data: Full name and profile picture (obtained via Google OAuth on sign-up).
• Contact Data: Email address (used for account communication and course access notifications).
• Payment Data: Transaction IDs and payment status. We do not store card numbers, UPI IDs, or bank details — these are handled exclusively by Razorpay, our PCI-DSS-compliant payment processor.
• Usage Data: Course enrolment records, lesson progress, certificates earned, and login timestamps (stored securely in Supabase).
• Technical Data: IP address, browser type, and device information collected automatically for security and analytics purposes.
• Communications: Any messages, queries, or feedback you send us via our contact form or email.

We do not collect sensitive personal data such as biometrics, financial information beyond payment confirmation, health data, or government ID numbers.

3. Legal Basis for Processing (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, we process your data on the following lawful bases:

• Consent: You provide explicit consent during account registration and before purchase.
• Contractual Necessity: Processing required to fulfil your course enrolment, issue certificates, and deliver our services.
• Legitimate Interests: Security monitoring, fraud prevention, and improving our Platform.
• Legal Obligation: Where required by Indian law, including tax records and regulatory compliance.

4. How We Use Your Data

Your personal data is used exclusively to:

• Create and manage your account on the Platform.
• Process payments and grant access to purchased courses.
• Send transactional emails: course access confirmations, payment receipts, and certificate notifications.
• Respond to support queries and resolve disputes.
• Prevent fraud, abuse, and unauthorised access.
• Comply with applicable legal and regulatory obligations.
• Send product updates or promotional communications (you may opt out at any time via the unsubscribe link in any email).

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

5. Google OAuth & Third-Party Services

Sparq Academy uses Google OAuth 2.0 for authentication. We request only the openid, profile, and email scopes — your name, email address, and profile photo. We do not request access to your Google Drive, Gmail, Contacts, Calendar, or any other Google service.

Our data sub-processors include:

• Supabase — Database and authentication infrastructure (hosted on AWS, with data residing in data centres selected for GDPR adequacy).
• Razorpay — Payment processing (PCI-DSS Level 1 certified, operates under RBI regulations).
• Resend — Transactional email delivery.
• Vercel — Web hosting and content delivery.

Each sub-processor is contractually obligated to process data only on our instructions and to maintain appropriate security measures.

6. Cookies & Tracking

We use strictly necessary cookies to maintain your authenticated session (managed via Supabase SSR). We do not use third-party advertising trackers, Facebook Pixel, or Google Ads conversion cookies on this Platform.

Analytics, if any, is performed using privacy-respecting, aggregated data and does not involve individual user tracking across external sites.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account & Profile Data: Retained for the lifetime of your account and deleted within 30 days of a verified account deletion request.
• Payment Records: Retained for 7 years as required under the Income Tax Act, 1961 and GST regulations.
• Course Progress Data: Retained for the duration of your account.
• Communication Logs: Retained for 2 years for dispute resolution purposes.

8. Your Rights as a Data Principal (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data (subject to our legal retention obligations).
• Right to Grievance Redressal: Raise a grievance with our Data Protection Officer and receive a response within 30 days.
• Right to Nominate: Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Right to Withdraw Consent: Withdraw consent at any time; note that withdrawal may affect your ability to use certain services.

To exercise any of these rights, email our Grievance Officer at: support@sparqacademy.in with the subject line "DPDP Data Request".

9. Data Security

We implement industry-standard security measures including HTTPS/TLS encryption for all data in transit, row-level security (RLS) policies in Supabase, and access controls limiting data access to authorised personnel only. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

In the event of a data breach that is likely to cause high risk to your rights, we will notify affected users in accordance with the DPDP Act, 2023.

10. Children's Privacy

Sparq Academy is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors without verified parental consent. If you believe a minor has provided us with personal data, please contact us immediately at support@sparqacademy.in and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you via email or a prominent notice on the Platform at least 7 days before any material changes take effect.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are:

Grievance Officer: Admin, Sparq IT Services (India)
Email: support@sparqacademy.in
Address: Lucknow, Uttar Pradesh, India
Response Time: Within 30 days of receiving a grievance.