Privacy Policy

This Privacy Policy describes how Eco Software Consultancy Services, a sole proprietorship registered in Hyderabad, Telangana, India, operating the brand "ClearSteps" (referred to as "we," "us," "our," or "ClearSteps"), collects, uses, stores, and discloses personal data when you use our website clearsteps.co.in and related services (collectively, the "Platform"). We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This policy explains the rights you have under the DPDP Act and how to exercise them.

We collect the following categories of personal data: (a) Account information: name, email address, mobile number, school name (optional), class/grade, board (CBSE), and a password (stored in encrypted form). (b) Academic data: subjects you select, practice paper attempts, scores, time spent on questions, answers submitted, and learning preferences. (c) Payment information: processed by our payment gateway partner. We do not store your card numbers, UPI IDs, or bank credentials on our servers. We retain only the transaction reference, amount, and status. (d) Technical data: IP address, browser type, device identifiers, operating system, and access logs, used for security and analytics. (e) Communications: any messages, queries, or feedback you send us via email, WhatsApp, or in-app forms.

We collect your data: - Directly from you when you register, subscribe, or interact with the Platform. - Automatically through cookies and similar technologies (see Section 1.11 — Cookie Notice). - From your parent or legal guardian when consent is required (see Section 1.6).

We process your data only for these specified purposes: 1. To create and manage your account. 2. To deliver the educational content and services you have subscribed to. 3. To personalise your learning experience based on your performance and preferences. 4. To process payments and send invoices. 5. To respond to your queries and provide customer support. 6. To send you service-related communications (subscription reminders, exam date notifications, important updates). 7. To improve the Platform through aggregated, anonymised analytics. 8. To comply with applicable Indian laws and respond to lawful requests from authorities. We do not use your data for behavioural advertising, profiling for advertising, or to build commercial profiles of minor users. This is a strict commitment under Section 9 of the DPDP Act.

We process your personal data based on: - Your consent (or your parent/guardian's consent if you are a minor), which you may withdraw at any time. - Performance of our service to you under our Terms & Conditions. - Legal obligations under Indian law (taxation, regulatory).

ClearSteps is built for Class 10 and Class 12 students, which means many of our users are below 18 years of age and are classified as "children" under the DPDP Act. If you are below 18: - We will only process your data after obtaining verifiable consent from your parent or legal guardian. - We will not track your behaviour for advertising purposes. - We will not display advertisements targeted to you on the basis of your behaviour. Parents/guardians: if you discover that your child has registered without your consent, write to admin@clearsteps.co.in and we will delete the account and associated data within 7 working days.

We share your data only with: - Service providers who help us operate the Platform (payment gateway, hosting, email delivery, SMS, WhatsApp Business API, analytics). All providers are bound by confidentiality and data protection obligations. - Government authorities when required by Indian law, court order, or legal process. - Successors in the event of a merger, acquisition, or sale of business assets, with prior notice to you. We do not sell, rent, or trade your personal data to any third party for commercial purposes.

- Account data: retained while your account is active and for 12 months after deletion or last activity, whichever is later. - Academic performance data: retained for the duration of your subscription plus 12 months for support and re-enrolment purposes. - Payment and tax records: retained for 8 years to comply with the Income Tax Act and GST law. - Anonymised, aggregated analytics: retained indefinitely. You can request earlier deletion under Section 1.10.

Your data is stored on servers located in India and/or other jurisdictions where our service providers operate. We use reasonable technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest where applicable, and access controls. No system is fully secure. In the event of a personal data breach affecting your data, we will notify you and the Data Protection Board of India in accordance with the DPDP Act.

Under the DPDP Act, you have the right to: 1. Access: request a summary of the personal data we hold about you and the purposes of processing. 2. Correction: ask us to correct inaccurate or incomplete data. 3. Erasure: ask us to delete your personal data when it is no longer necessary for the purpose for which it was collected (subject to legal retention obligations). 4. Withdraw consent: withdraw your consent for processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. 5. Grievance redressal: lodge a complaint with our Grievance Officer (see Section 1.12) and, if unsatisfied, with the Data Protection Board of India. 6. Nominate: nominate another person to exercise your rights in case of your death or incapacity. To exercise any of these rights, write to admin@clearsteps.co.in with the subject line "DPDP Request — [your request type]".

We use cookies and similar technologies to operate the Platform, remember your preferences, and analyse usage. - Strictly necessary cookies: required for the Platform to function (e.g., session cookies). Cannot be turned off. - Functional cookies: remember your preferences (e.g., chosen subjects, language). - Analytics cookies: help us understand Platform usage in aggregate (e.g., Microsoft Clarity, Google Analytics). Data is anonymised where possible. - Marketing cookies: if you arrived from a campaign (e.g., Instagram, Google Ads). For users below 18, we do not use marketing cookies for behavioural targeting. You can manage cookie preferences via the cookie banner shown on your first visit, or through your browser settings.

In accordance with the Information Technology Rules, 2021, and the DPDP Act, our designated Grievance Officer is: Name: Mallikarjun K Designation: Grievance Officer & Data Protection Contact Email: admin@clearsteps.co.in Phone: +91 90000 38862 Address: 718, RV Silpa Hilltop, Gachibowli, Hyderabad – 500032, Telangana, India We will acknowledge your grievance within 24 hours and resolve it within 15 days of receipt, in accordance with the IT Rules, 2021.

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be notified to you by email and/or via a prominent notice on the Platform.

For any questions about this Privacy Policy, write to admin@clearsteps.co.in.