Privacy Policy

Koshi Academy ("we," "us," or "our") operates koshipixel.com and the related educational services ("Services"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Services. By using the Services, you agree to the practices described below.

1. Who we are and how to reach us

Koshi Academy is an online education provider headquartered in Noida, Uttar Pradesh, India. For any privacy-related enquiry or to exercise your rights, contact our Data Protection Officer at [email protected], or write to C-62, Sector 63, Noida, UP 201301, India.

2. Information we collect

2.1 Information you give us directly

• Account & enrollment data: name, email, phone, billing address, GST number (if provided), chosen course(s), chosen plan.
• Learning activity: lesson progress, quiz scores, assignments uploaded, forum posts, support tickets.
• Payment details: processed by our PCI-DSS compliant payment gateways (Razorpay / Stripe / PayU) — we never store your full card number on our servers.
• Communications: emails you send us, WhatsApp messages, voice calls (if recorded, we tell you first).

2.2 Information collected automatically

• Device & usage: IP address, browser type, operating system, device identifiers, pages visited, time on page, referral source.
• Cookies and local storage: see our Cookie Policy for details.
• Analytics events: aggregated and anonymised through Google Analytics 4 and Microsoft Clarity.

2.3 Information from third parties

If you sign in via Google or Facebook, we receive your name, profile picture and email as permitted by the respective platform. We do not receive your password.

3. How we use your information

• To deliver purchased courses, grade assignments, and issue certificates.
• To process payments and prevent fraud.
• To provide customer support and respond to your enquiries.
• To send transactional emails (receipts, course reminders, certificate issuance).
• To send marketing emails about new courses, discounts and tutorials — only if you opted in. You can unsubscribe anytime with one click.
• To improve our Services — identify broken pages, understand which lessons are confusing, test new features.
• To comply with legal obligations (Indian tax law, consumer protection regulations, DPDP Act 2023).

4. Legal bases for processing (GDPR / DPDP)

Where EU/UK or Indian DPDP Act requirements apply, we rely on the following legal bases:

• Contract performance — to deliver courses you paid for.
• Consent — for marketing emails, non-essential cookies and testimonial publication.
• Legitimate interest — for anti-fraud, product improvement and security monitoring.
• Legal obligation — for tax records, consumer-complaint responses and regulator requests.

5. Sharing with third parties

We do not sell your personal data. We share information only with the following categories of processors, all bound by data-processing agreements:

• Payment processors: Razorpay, Stripe, PayU — to charge your card and remit refunds.
• Hosting & infrastructure: Amazon Web Services (ap-south-1 Mumbai region), Cloudflare CDN.
• Email delivery: Postmark, Mailchimp (for newsletter).
• Analytics: Google Analytics 4, Microsoft Clarity (anonymised).
• Customer support: Freshdesk ticketing system.
• Legal / regulatory: only when required by law, court order or to protect our rights.

6. International transfers

Some of our processors are located outside India. When we transfer your data abroad, we rely on Standard Contractual Clauses (SCCs) and only use processors with equivalent protection levels.

7. Data retention

We retain information only as long as needed:

• Account & course access: for as long as your account is active + 2 years thereafter.
• Payment & tax records: 8 years (as required by Indian tax law).
• Support tickets: 3 years from closure.
• Marketing subscribers: until you unsubscribe.
• Website logs: 12 months.

8. Your rights

Depending on your location, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (subject to legal retention obligations).
• Object to or restrict certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time (without affecting prior processing).
• Lodge a complaint with your data protection authority. In India, this is the Data Protection Board under the DPDP Act.

To exercise any right, email [email protected]. We respond within 30 days.

9. Security

We protect your information with industry-standard measures: TLS 1.3 encryption in transit, AES-256 at rest, access controls based on least privilege, 2FA on all admin accounts, quarterly penetration tests, and automated vulnerability scanning. No system is 100% secure — if we become aware of a breach that materially affects you, we notify you within 72 hours as required by applicable law.

10. Children's privacy

Our Services are intended for users aged 16 and above. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, email us and we will delete it promptly.

11. Testimonials & user-generated content

If you post testimonials, forum replies or course reviews, those posts (and your name/initials/profile photo) may be displayed publicly. You can request removal at any time.

12. Automated decision-making

We do not make automated decisions that produce legal or similarly significant effects on you.

13. Changes to this policy

We may update this policy to reflect legal, operational or technical changes. Material changes are notified by email to active account holders. The "Last updated" date at the top always reflects the current version.

14. Contact & complaints

Any question or complaint about our privacy practices: [email protected] or by post to our registered office at C-62, Sector 63, Noida, Uttar Pradesh 201301, India. We aim to resolve all complaints within 30 days.