1. Introduction
BrilMind.org (“we,” “our,” “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA).
This policy applies to all parents/guardians and students who register for BrilMind.org.
2. What data we collect
2.1 Student data
| Data type | Examples |
|---|---|
| Personal information | Full name, date of birth, email address |
| Academic information | Class, school name, board, academic marks |
| Documents | School ID card image, marksheet image (uploaded by the parent) |
| Contact information | WhatsApp number (if provided) |
2.2 Parent / guardian data
| Data type | Examples |
|---|---|
| Personal information | Full name, email address, address |
| Contact information | WhatsApp number |
| Consent records | Digital signature, consent date, consent checkboxes |
2.3 Technical data
| Data type | Examples |
|---|---|
| Device information | Browser type, IP address, device type |
| Usage information | Pages visited, time of visit, actions taken |
2.4 Payment data
We do not store bank account details, card numbers, or UPI PINs.
| Data type | Examples |
|---|---|
| Transaction ID | UPI payment ID, transaction reference |
3. How we use your data
3.1 Primary uses
| Purpose | Details |
|---|---|
| Registration & verification | To process your child’s registration and verify eligibility |
| Selection | To rank students and select winners based on merit |
| Communication | To send program updates, results, and prize notifications |
| Prize delivery | To ship prizes to winners |
| Program improvement | To analyse and improve the program, without using children’s data for ads |
3.2 Lawful basis for processing
| Data | Basis |
|---|---|
| Student data (under 18) | Verifiable parental consent (DPDPA, including Section 9) |
| Parent data | Contractual necessity (registration and participation) |
4. Legal basis: parental consent (children’s data)
4.1 Children’s data (under 18)
- Under DPDPA, individuals under 18 years are considered children.
- BrilMind.org does not collect, process, or store any data from minors without explicit parental consent.
- Students cannot register, pay, or upload documents themselves. Only a parent or legal guardian may do so.
4.2 How we obtain consent
During registration, parents complete a digital Parental Consent Form. The form includes specific consents for:
- Collecting data
- Uploading documents (by the parent)
- Processing data
- Communication
- Data storage
- Prize delivery
4.3 Verifiable consent
We take reasonable steps to verify the parent’s identity:
- Parent logs in with Google (authenticated email)
- Parent provides full name and contact details
- Parent provides a digital signature (typed name matching the parent’s name)
- Date of consent is captured (and, when the backend is live, IP and device details for audit)
4.4 Consent records
- All consents are stored securely.
- Records include parent name, child name, date, and the specific consents given.
- Records are retained for the duration of the program and 5 years after.
4.5 Withdrawal of consent
- Parents may withdraw consent at any time by emailing privacy@brilmind.org.
- Withdrawal will end the student’s participation.
- Data will be deleted within 30 days of withdrawal, except where the law requires longer retention (for example some payment records).
- No refund will be issued after registration, except if the program is cancelled for fewer than 1,000 signups as stated in the Terms.
5. How we share your data
5.1 Essential service providers
| Provider type | Reason | Data shared |
|---|---|---|
| Payment processors | UPI payment processing | UPI transaction ID |
| Email service | Program notifications | Parent and student email |
| Cloud storage | Storing uploaded documents | School ID, marksheet |
| Logistics partners | Prize delivery (winners only) | Student name, shipping address |
5.2 Legal requirements
- Data may be shared when required by law.
- To protect our rights or prevent fraud.
- In response to a court order or government request.
5.3 What we do not share
| Data | Policy |
|---|---|
| Student personal data | Not sold or shared for marketing |
| Student documents | Not shared with third parties except essential cloud storage |
| Parent contact details | Not sold or shared for marketing |
| Advertising | No tracking for targeted ads or behavioural advertising |
5.4 Anonymised data
Aggregate, anonymised data may be used for research or statistical purposes. This data cannot identify any individual student.
6. Data storage and security
6.1 Where data is stored
Registration data lives in Supabase Postgres in India. School ID and marksheet files are stored in a private Supabase Storage bucket. Admin preview uses a signed-in admin session; files are not public URLs.
6.2 Security measures
| Measure | Details |
|---|---|
| Encryption | SSL/TLS for data in transit; encrypted storage when the backend is live |
| Access control | Restricted access to authorised personnel only |
| Authentication | Secure authentication for admin access |
| Audit logs | Data access is logged and monitored once the database is connected |
6.3 Data retention
| Data type | Retention period |
|---|---|
| Registration data | 5 years after program completion |
| Consent records | 5 years after program completion |
| Documents | 5 years after program completion |
| Payment data | 5 years after program completion |
6.4 Data deletion requests
- Parents can request data deletion by emailing privacy@brilmind.org.
- We aim to delete eligible data within 30 days.
- Deletion will end the student’s participation.
7. Your rights
7.1 Rights of parents (for children’s data)
| Right | How to exercise |
|---|---|
| Access | Request a copy of your child’s data |
| Correction | Request correction of inaccurate data |
| Deletion | Request deletion of your child’s data |
| Withdraw consent | Withdraw consent at any time |
| Object | Object to data processing |
7.2 Rights of adults (parents)
| Right | How to exercise |
|---|---|
| Access | Request a copy of your own data |
| Correction | Request correction of inaccurate data |
| Deletion | Request deletion of your own data |
7.3 How to exercise your rights
- Email privacy@brilmind.org with the subject “Data Request”.
- We aim to respond within 30 days.
8. Children’s data (DPDPA compliance)
8.1 Age verification
- BrilMind.org is for students aged 15–18 in Class 12 Computer Science.
- All participants under 18 require parental consent.
- Parents confirm the child’s date of birth on the consent form.
8.2 No tracking or profiling of children
- We do not track, monitor, or profile children for advertising.
- We do not use children’s data for behavioural monitoring.
- We do not target ads to children.
8.3 Parental oversight
- Parents receive program communications (the student may also receive updates you authorised).
- Parents can access, correct, or request deletion of their child’s data.
- Parents are notified of significant program changes.
8.4 Legal compliance
BrilMind.org is designed to comply with DPDPA 2023 requirements on processing children’s data, including verifiable parental consent. This policy is not a substitute for legal advice.
9. Cookies and tracking
9.1 Cookies we use
| Cookie type | Purpose |
|---|---|
| Essential | Google OAuth and session management (when login is enabled) |
| Analytics | Optional anonymised analytics (for example Google Analytics), if enabled |
9.2 No behavioural advertising cookies
We do not use cookies for behavioural tracking or targeted advertising, and we do not track children for advertising.
9.3 Cookie preferences
You can disable cookies in browser settings. Disabling essential cookies may affect sign-in and registration.
10. Changes to this policy
10.1 Updates
- We may update this Privacy Policy from time to time.
- Significant changes will be communicated by email to the parent where practical.
- The “Last updated” date on this page will be revised.
10.2 Re-consent
If significant changes affect children’s data, parents will be asked to re-consent.
11. Contact information
| Channel | Details |
|---|---|
| Privacy email | privacy@brilmind.org |
| Support email | support@brilmind.org |
| +91 9940366135 | |
| Response time | Within 24 hours (weekdays) |
12. Grievance Officer
As required under DPDPA 2023, a Grievance Officer is available for data-related concerns, including access, correction, or deletion requests.
| Officer | Details |
|---|---|
| Name | Suresh Umapathy |
| privacy@brilmind.org | |
| Response time | Within 48 hours |
13. Consent
By completing the Parental Consent Form and registering your child on BrilMind.org, you acknowledge that you have read, understood, and agree to this Privacy Policy.