Privacy Policy

01Who we are

The controller/fiduciary responsible for your data is TRINETRA CYBER DEFENSE PRIVATE LIMITED, G-04 Satyam Complex-2, Plot Cs-05, Alpha Greater Noida, Gautam Buddha Nagar, Noida, Uttar Pradesh 201310, India. For any privacy question, contact our Grievance Officer (see section 11) or info@trinetracyberdefense.com.

02Data we collect

• Account data: name, email address, hashed password (Argon2id — we never store your password in plaintext), and your consent records (Terms / AUP acceptance, age confirmation, timestamps).
• Profile & learning data: display name, rank, XP, badges, challenge solves, lab sessions, quiz results, and certificates you earn.
• Payment data: billing identifiers and subscription status. Card/UPI details are handled directly by Stripe and Razorpay — we receive only tokens and transaction metadata, never full card numbers.
• Technical data: IP address, device/browser type, and log data, used for security, abuse prevention, and reliability.
• Usage / analytics data: pages viewed and feature events — collected via PostHog only if you opt in through our cookie banner.
• AI mentor interactions: the questions/messages you send to the in-app AI mentor. Flag values are redacted before any content is sent to the AI provider.
• Support communications: emails and messages you send us.

03Why we use it & lawful basis

04Processors & who we share with

We do not sell your personal data. We share it with the following categories of data processors, who act on our instructions under contract:

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, or property of Trinetra, our users, or the public.

05International data transfers

Some processors are located outside India and the EEA. Where personal data is transferred internationally, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses and the processors' own data-protection commitments — and on transfers permitted under the DPDP Act to countries not restricted by the Indian government.

06How long we keep data

We retain personal data only as long as necessary for the purposes above:

• Account & learning data: for the life of your account, then deleted or anonymised within 90 days of account closure, unless a longer period is required by law.
• Payment/transaction records: retained for the period required by Indian tax and accounting law (typically up to 8 years under the Companies Act, 2013).
• Security logs: typically 12 months.
• Backups: encrypted backups are retained on a rolling 30-day cycle, after which deleted data ages out of all backup copies.
• Analytics data: retained per our PostHog configuration and deleted/anonymised thereafter.

07Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy (data export).
• Correct inaccurate or incomplete data.
• Erase your data ("right to be forgotten") — you can request deletion of your account and associated personal data.
• Withdraw consent (e.g. turn off analytics) at any time, without affecting prior lawful processing.
• Object to or restrict certain processing, and to data portability (GDPR).
• Nominate another individual to exercise your rights in the event of death or incapacity (DPDP).
• Complain to the Data Protection Board of India or your local supervisory authority.

You can exercise account export and deletion from your account settings, or by emailing info@trinetracyberdefense.com. We will respond within the timeframes required by law.

08Children's data

The Service is not directed at children under 16. Users under the age of majority must have verifiable parental/guardian consent as required by the DPDP Act. We do not knowingly profile children or serve them targeted advertising. If we learn we have collected a child's data without the required consent, we will delete it.

09Security

We use technical and organisational measures appropriate to the risk: Argon2id password hashing, encryption in transit (TLS), access controls, isolated lab containers (dropped capabilities, read-only root filesystem, internal-only networking), and the principle of least privilege. No method of transmission or storage is perfectly secure; we will notify affected users and the relevant authority of a personal data breach as required by law.

10Cookies & tracking

We use strictly necessary cookies to operate the Service and, with your consent, analytics cookies. See our Cookie Policy for the full list and how to change your choices.

11Grievance Officer / Data Protection Officer

12Changes to this policy

We may update this Privacy Policy. The "Last updated" date reflects the latest version; we will give notice of material changes. Please review it periodically.