Privacy Policy & Data Protection Notice
This Privacy Notice is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act", India), the Information Technology Act, 2000, and the Google API Services User Data Policy. It explains how Skilli Platform ("we", "our", or "us") collects, processes, stores, protects, and handles personal data for enrolled students, faculty mentors, and institutional administrators.
Key Commitments Under Digital Personal Data Protection Act, 2023
- Data Fiduciary: Skilli Platform acts as a Data Fiduciary regarding the personal information provided for academic capstone management.
- Data Principal: As a student, faculty member, or educator, you are the Data Principal entitled to all statutory rights under Sections 11–14 of the DPDP Act.
- Purpose Limitation: We collect and process data strictly for educational project management, academic milestone tracking, mentorship sessions, and institutional grading. We NEVER sell or monetize personal data.
- Withdrawal & Erasure: You retain the right to withdraw third-party consents (Google Calendar, GitHub) and request correction or erasure of non-statutory records at any time.
1Personal Data We Collect (Notice & Itemized Breakdown)
Under Section 5 of the DPDP Act 2023, data fiduciaries must give itemized notice of personal data collected and the specific purpose for which it is processed:
A. User Identity & Academic Profile
Full Name, Institutional Email Address, Mobile Phone Number (for two-factor OTP verification and milestone alerts), Department (e.g. MCA, Computer Science), Academic Year, Division, and University Roll / PRN Number.
B. Capstone & Project Submissions
Project titles, synopses, uploaded architecture proposals / PDF documents, team member rosters, Kanban task boards, milestone evaluation rubrics, and faculty mentor feedback logs.
C. Third-Party OAuth Data (Google Calendar)
When you explicitly connect Google Calendar, we receive your Google account email and an encrypted OAuth refresh token to synchronize your project deadlines and viva milestones directly to your calendar. We DO NOT read, modify, or delete your unrelated personal calendar events.
D. Technical & Security Logs
IP address, browser user-agent, session timestamps, and authentication audit logs required to prevent unauthorized access, mitigate brute-force attacks, and preserve academic integrity.
2Lawful Basis & Purpose of Processing (Section 4 & 6)
We process your personal data under the lawful grounds of informed consent and the legitimate academic use necessary for fulfilling institutional capstone curriculum requirements:
3Google API Services User Data Policy & Limited Use Disclosure
Skilli's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically for Google Calendar Integration:
- We request the
.../auth/calendar.eventsscope solely to insert and synchronize official capstone milestones, review dates, and deadlines. - We DO NOT read your unrelated emails, personal meetings, or third-party appointments.
- We DO NOT transfer or sell your Google user data to advertisers, data brokers, or external AI model training pipelines.
- You can disconnect Google Calendar anytime via the Integrations Hub or through Google Account Security settings, which immediately wipes all stored OAuth tokens.
4Your Rights as a Data Principal (Sections 11, 12, 13, 14)
As a citizen and student user under Indian law, you have the following enforceable statutory rights:
1. Right to Access Information (Sec 11)
You have the right to obtain a summary of personal data being processed, identities of all data fiduciaries, and any categories shared.
2. Right to Correction & Erasure (Sec 12)
You can correct inaccurate personal data, update incomplete fields (e.g. phone number in Profile settings), or request erasure of non-academic records.
3. Right of Grievance Redressal (Sec 13)
You have the right to have grievances addressed by our designated Grievance Officer within a maximum period of 30 days.
4. Right to Nominate (Sec 14)
You have the right to nominate any individual to exercise your data principal rights in the event of death or incapacity.
5Data Storage, Security Safeguards & Retention
In adherence to Section 8(5) of the DPDP Act 2023, Skilli implements reasonable security safeguards to prevent personal data breaches:
- Cryptographic Protection: Passwords are protected using salted bcrypt hashes. OAuth tokens (GitHub, Google) are encrypted in database storage.
- Database Hosting: Primary database records are housed on MongoDB Atlas enterprise clusters equipped with role-based access control and TLS 1.3 encryption in transit.
- Retention Schedule: Academic capstone records and evaluation grades are retained for the duration of your academic degree program plus statutory institutional audit periods (typically 3–5 academic years). Temporary session tokens are purged automatically upon logout.
Designated Grievance Redressal Officer (Section 13)
In compliance with the Digital Personal Data Protection Act, 2023, you may address any data privacy concerns, consent withdrawal requests, or statutory grievances to our appointed Grievance Officer: