Privacy Policy

Gradopus Labs is an India-based brand offering practical, project-based software development internships and technology learning. It is not a university, college, government body or accredited institution, and it is not incorporated as a company.

Gradopus Labs is a sole proprietorship based in Maharashtra, India. Its proprietor decides how and why personal data is processed for Gradopus Labs. In this policy, "we", "us" and "our" mean Gradopus Labs and its operator, and "you" means anyone who uses our website or takes part in our programs.

How to contact us about privacy: email support.gradopuslabs@gmail.com, or use the contact form on our website.

This policy covers personal data we process when you:

• visit the Gradopus Labs website;
• create an account and sign in;
• enrol in, pay for and take part in a program;
• submit work for review;
• receive, download or have someone verify a certificate;
• contact us.

It does not cover other websites or services you use during a program, such as GitHub or a hosting provider. They have their own privacy policies (see section 19).

• We collect your name, email address and password when you create an account. Your password is stored only as a secure hash.
• We record your enrolments, payments, progress and submitted work, and the feedback reviewers give you.
• We do not ask for your phone number, date of birth, address, college details, identity documents, or information about your religion, caste, health or finances.
• Certificates can be verified publicly. A search by certificate ID shows your initials; the link in a certificate's QR code shows your full name (section 10).
• We use only the cookies needed to keep you signed in securely. We do not use analytics or advertising cookies.
• We do not sell your personal data or send marketing emails.
• Payments are handled by Razorpay, and emails are sent by Resend, when those services are switched on.

4.1 Account information

When you register, we collect:

• your full name, which also appears on any certificate you earn;
• your email address, used to sign in and to contact you;
• your password, which is stored only as a one-way hash (Argon2id) and never in readable form.

We also record your account role (student or administrator), your account status (for example active or suspended), when you accepted our terms, when you last signed in, and when your account was created and updated.

We do not currently verify email addresses. You can change your name on your profile page; to change your email address, contact us (section 14).

4.2 Applications and educational information

The website does not currently have an application form, and it does not ask for educational information such as your college, course or year of study.

All programs are currently open enrolment, so no application information is collected. If we ever introduce applications, this policy will be updated first to say exactly what will be asked and why.

4.3 Enrolments and payments

• Enrolments: the programs you join, enrolment status and dates, how you enrolled (online payment, or a manual enrolment by our team) and the amount paid.
• Payments: the amount and currency, the payment status, Razorpay's order and payment references, any failure code, and timestamps.
• We do not receive or store your card number, CVV, UPI ID, UPI PIN, bank details or OTPs. You enter those directly into Razorpay's checkout.

4.4 Learning progress, submissions and assessment records

• which modules you have marked as read and your progress through each program;
• each submission attempt: text answers (up to 10,000 characters) or a project link (for example a GitHub repository or a live deployment URL), and when you submitted it;
• review results: the outcome ("Accepted", "Changes requested" or "Rejected"), the reviewer's written feedback, any score and when it was reviewed.

All attempts and their feedback are kept, so you and your reviewer can see the history of your work. File uploads are not available on the website.

We never ask for your GitHub password or the password of any other external account. If a task asks you to give a reviewer access to a private repository, you do this through the code host's own sharing settings (for example GitHub's collaborator invitations). We will then see the repository and your account name on that code host.

4.5 Certificate records

For each certificate: the certificate ID, your name and the program title as they were when it was issued, the completion and issue dates, the certificate's status (valid, revoked or replaced), who issued it, and any correction or revocation details, including the reason. A verification code is stored in protected form so that the certificate's QR code can be checked.

4.6 Notifications and emails

• In-app notifications about your account and program, such as review results and certificates.
• Email records: the type of email, its status and the email provider's message reference. The email address itself is looked up when the email is sent, not stored with the record.

4.7 Messages you send us

When you use the contact form, we collect your name, email address, subject and message. The message is sent by email (through Resend, see section 11) to our support inbox, with your email address set as the reply address so we can answer you. It is not stored on the website.

Messages that reach our support inbox, whether through the form or by email, are kept for 1 year after the matter is resolved (section 13).

4.8 Technical information

• Security and rate limiting: to stop abuse such as password guessing or contact-form spam, the website counts requests from each IP address and, for sign-in and password reset, each email address. These counts are stored only as a one-way hash and are deleted automatically within about one hour.
• Records of administrative actions: we keep an internal record of significant actions taken by our team, such as reviewing work, issuing or revoking a certificate, or suspending an account. These records identify the team member and the affected record. They do not include IP addresses or browser details.
• Hosting: the company that hosts our website may automatically record technical information about requests, such as IP address, browser type and the pages requested. To be confirmed: hosting provider and what request logs it keeps, and for how long
• Cookies: see section 16.

• From you: when you register, edit your profile, enrol, pay, submit work or contact us.
• From our team: reviewers' feedback and decisions, certificate records, and actions such as manual enrolment or account suspension.
• From Razorpay: confirmation of whether a payment succeeded, with its references and amount.
• Automatically: sign-in and security information described in section 4.8.

• To run your account: to create it, keep it secure and let you sign in.
• To deliver programs: to give you access to programs you enrol in and to track your progress.
• To process payments: to take enrolment fees through Razorpay and keep payment records.
• To review your work: to assess submissions against published criteria and give you feedback.
• To issue and verify certificates: to issue a certificate when you meet the completion requirements and to let others check that it is genuine.
• To communicate with you: to send service messages such as password resets, payment and enrolment confirmations, review results and certificate notices.
• To keep the platform secure: to prevent fraud and misuse and to investigate problems.
• To meet legal obligations: for example keeping financial records where the law requires it.

We do not use your personal data for advertising, and we do not make decisions about you using automated profiling. Reviews and certificate decisions are made by people.

India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are being brought into force in stages. We intend to handle personal data in line with them as their provisions take effect, and in line with any other law that applies.

• Where the law requires your consent to process personal data, we ask for it, and we tell you what it covers.
• Some processing may be allowed without consent where the law permits, for example to meet a legal obligation.
• When you register, you are asked to confirm that you agree to the Student Terms & Conditions and this Privacy Policy. Agreeing to the terms of a service is not, by itself, consent to every use of your data. Where the law requires separate or specific consent for a purpose, we will ask for it in the way the law requires.
• Where you have given consent, you can withdraw it (section 14). Withdrawing consent does not affect processing that took place before, and we may not be able to continue providing a service that depends on it.

• We collect only the information listed in section 4. We do not ask for phone numbers, dates of birth, addresses, identity documents or sensitive information to run programs.
• We do not ask for identity documents, such as Aadhaar, PAN or a college ID card. Please do not send them to us.
• If you ask for an accommodation, you only need to share what is needed to arrange it.
• You can correct your name on your profile page at any time. Ask us to correct anything else that is wrong.
• Do not include personal information, about yourself or anyone else, in submissions beyond what a task needs.

Most of your information is private and is seen only by you and our team (section 11). Only the following can be seen by the public:

• Certificate verification details, described in section 10.
• Anything you publish yourself, such as a public GitHub repository or a live deployment. Anyone can see a public repository or website. Gradopus Labs does not make your submissions public.

We do not publish your name, submissions, photograph, testimonial or project on our website or in marketing without your separate, specific permission (see the Intellectual Property & Code of Conduct). Refusing permission will not affect your assessment or certificate.

When we issue a certificate, it gets a certificate ID (for example GL-2026-000001) and a QR code linking to a private verification page. Anyone can check a certificate in two ways:

1. By certificate ID on the website's verification page. This shows:
   • the certificate ID and its status;
   • for a valid certificate: the holder's initials only, the program title and the completion and issue dates;
   • for a revoked certificate: the program title and the date it was revoked;
   • for a replaced certificate: the program title, the date it was replaced and, where the replacement is valid, the replacement's certificate ID.
2. By the QR code link printed on the certificate. This shows the same details, but with the holder's full name. This page asks search engines not to index it. Only people who have the certificate or its link can open it.

Verification never shows your email address, account details, submissions, feedback, scores, payment details or the reason for a revocation or correction. We do not keep a record of who checks a certificate. Requests are counted only for rate limiting (section 4.8).

Certificate IDs follow a predictable pattern, so anyone could try IDs on the verification page. This is why a search by ID shows only initials.

The certificate PDF itself is not public. Only you, while signed in, and our team can download it.

More detail is in the Certificate Issuance & Verification Policy.

• You can see your own account, enrolments, payments, progress, submissions, feedback, notifications and certificates. Other students cannot see your records.
• Our team (administrators and reviewers) can see what they need to run programs: students' names and email addresses, enrolments, payments, submissions and feedback, certificate records, email status and the record of administrative actions. Currently, only the proprietor has administrator access.

We share personal data with the following service providers, only as needed for them to provide their service to us:

• Razorpay (payments), only when online payment is switched on. When you choose to pay, Razorpay's checkout opens in your browser with your name and email address filled in, and you enter your payment details directly into it. We send Razorpay the amount, an internal payment reference and the program's identifier. Razorpay processes your payment under its own terms and privacy policy.
• Resend (email delivery), only when email sending is switched on. For each email, we send Resend your email address and the email's content, which can include your name, program and task titles, review feedback, certificate IDs, payment references and links. Contact-form messages are also delivered through Resend, including your name, email address, subject and message.
• Database hosting: our database runs on MongoDB Atlas, on Amazon Web Services (AWS) infrastructure in a single region. To be confirmed: the AWS region
• Website hosting: the website at gradopuslabs.online is hosted by To be confirmed: hosting provider.

We may also disclose personal data where the law requires it, for example in response to a lawful request from an authority. We do not sell personal data.

Some of our service providers may store or process data outside India:

• Database: stored in one AWS region. To be confirmed: the AWS region and its country
• Website hosting and email delivery: To be confirmed: the countries or regions where the hosting provider and Resend store or process data

Some data is deleted automatically today:

• Password reset links: expire after 30 minutes and are then deleted.
• Rate-limiting counts: deleted within about one hour.
• Email records: deleted 180 days after they are created.
• In-app notifications: deleted 365 days after they are created.

For everything else, we keep personal data for these periods:

• Your account, enrolments, progress, submissions and feedback: while your account is active, and then for 1 year after you last sign in. After that, they are deleted.
• Certificate records: with no fixed end, so that anyone checking a certificate keeps getting an accurate answer. Your certificate stays verifiable even after your account is deleted, but you will no longer be able to download the PDF, so please keep a copy.
• Payment records: for as long as tax and accounting law requires.
• Emails and messages you send us: 1 year after the matter is resolved.
• Records of administrative actions: 3 years.

We may keep a record for longer where it is needed to handle an open dispute, to prevent fraud or to keep our platforms secure, and only for as long as that need lasts.

Deleting inactive accounts and old records is currently done by our team, not automatically.

Subject to applicable law, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or update inaccurate or incomplete data (you can change your name yourself on your profile page);
• delete your personal data or close your account;
• withdraw consent you have given;
• nominate someone to exercise your rights if you die or become unable to do so, where the law provides for this.

How to make a request: email support.gradopuslabs@gmail.com from the email address on your account. We may ask you to confirm your identity before acting on a request, using only what is needed for that.

What to expect:

• We will acknowledge your request within 3 working days, and respond in full within To be confirmed: full response time.
• There is no self-service deletion or download feature yet; requests are handled by our team.
• We may not be able to delete everything. For example, certificate records may need to be kept so that verification stays accurate, payment records may need to be kept by law, and records may be needed for a dispute. If we keep something, we will tell you what and why.
• Closing your account means you can no longer use the programs you enrolled in.

We use reasonable measures to protect personal data. On the website today these include:

• passwords stored only as one-way Argon2id hashes;
• password reset links that are random, single-use, stored only as a hash and valid for 30 minutes;
• certificate verification codes stored as a hash, with an encrypted copy for regenerating QR codes;
• sign-in sessions that can be ended by the server, for example when you change your password;
• access checks so that students can see only their own records and only administrators can see others';
• limits on repeated attempts to sign in, reset passwords and verify certificates.

To be confirmed: hosting security, including HTTPS, and any database encryption and backups, for the live website

No system is completely secure, and we cannot guarantee absolute security. Please keep your password private and tell us straight away if you think your account has been misused.

If a data breach happens, the proprietor is responsible for handling it. We will:

1. contain the problem;
2. work out what was affected and whose data was involved;
3. change any exposed passwords, keys or other secrets;
4. tell affected students by email, and inform any authority, as the law requires.

The website uses only the cookies needed for signing in securely:

• Session cookie (authjs.session-token): keeps you signed in, for up to 7 days.
• Security cookie (authjs.csrf-token): protects sign-in forms against cross-site request forgery.
• Redirect cookie (authjs.callback-url): remembers where to send you after signing in.

These cookies cannot be read by scripts on the page, and they are needed for the website to work, so there is no option to turn them off while signed in.

We do not use analytics, advertising or social-media tracking cookies, and the website does not use other browser storage. When you choose to pay, Razorpay's checkout script is loaded from Razorpay and may use its own cookies or similar technologies under Razorpay's privacy policy.

If we add analytics or any other tracking in future, we will update this policy first and ask for consent where the law requires it.

You must be 18 or older to create an account or enrol in a Gradopus Labs program. We do not knowingly collect personal data from anyone under 18.

The website does not ask for your date of birth. If we learn that someone under 18 has created an account, we will close it and delete their personal data, except anything the law requires us to keep.

We do not send marketing or promotional emails. The emails we send are service messages about your account and programs: welcome, password reset, payment confirmation, enrolment confirmation, review results and certificate notices.

If we ever want to send marketing messages, we will ask for your consent first, and you will be able to withdraw it at any time.

• Links to other websites, including your GitHub repositories and live deployments, are governed by those websites' own terms and privacy policies.
• The website does not open or fetch the project links you submit. Reviewers open them in their own browsers.
• If you deploy a project that collects personal data from its visitors, you are responsible for handling that data properly. Do not collect real personal data in a task unless the task requires it.

If you have a concern about how we handle your personal data:

1. Write to support.gradopuslabs@gmail.com, describing your concern and what you would like us to do.
2. We will acknowledge your complaint within 3 working days, and respond in writing within To be confirmed: full response time.
3. If you are not satisfied, you can ask for the decision to be reviewed, as described in the Student Terms & Conditions.

Using this process does not affect any right you have to complain to a competent authority under applicable law.

We will update this policy when the way we handle personal data changes, for example before collecting new types of data or using a new service provider. When we do:

• the new version will be published here with its version number and effective date;
• if a change materially affects you, we will tell you by email or on the website before it takes effect;
• where a change requires your consent, we will ask for it.

• Student Terms & Conditions
• Internship Policy
• Project Submission & Assessment Policy
• Certificate Issuance & Verification Policy
• Payment, Refund & Stipend Policy
• Intellectual Property & Code of Conduct

• Version 1.3, 23 October 2026: The contact form now delivers messages by email (through Resend) to the support inbox without storing them on the website.
• Version 1.2, 23 October 2026: Added: open enrolment only (no application data), no identity documents, minimum age 18, proprietor as sole administrator, MongoDB Atlas on AWS, retention periods, 3-working-day acknowledgement of privacy requests and complaints, and the breach-response process.
• Version 1.1, 23 October 2026: Added the operator's location and the official support email address (support.gradopuslabs@gmail.com). Effective date still to be set after legal review.
• Version 1.0, 21 October 2026: First published version. Effective date to be set after legal review.