Privacy Policy

What we collect

• Account: your email address, and a display name if you provide one. If you set a password, we keep only a scrambled (hashed) form of it, never the password itself. We also keep a record that you confirmed you are 18 or older, with the date and the version of the Terms you accepted.
• Sign-in: one-time login links (they work for 15 minutes, once) and a session that keeps you signed in for up to 30 days or until you log out.
• Purchases: whether you've bought Full Access, when it was purchased and when it expires, the amount, and Razorpay's order and payment references. Payments are handled by Razorpay — we do not receive or store your full card, UPI or bank details.
• Learning: course progress, lessons completed, quiz scores, streaks, certificates earned, which steps of a project's AI build guide you have marked done, and the private notes you write. We also keep a simple log of what you do on the site (for example, that you finished a lesson), tied to your account, so we can show your progress and see which parts of the site are used. It is not shared or used for advertising.
• Submissions: the projects you submit — title, description, who it’s for, tech stack, links, files you upload, the optional AI log (the prompts you used and what you changed, shown with the project on your portfolio), and any feedback or ratings exchanged. Comments and ratings you post on other people's projects are shown publicly with your name.
• Resume: if you upload one, the file and its name, so recruiters can download it from your public portfolio page.
• AI Sunday workshop: if you register, your name (as you give it, which is printed on your certificate and checked against your photo ID at the door), the email you registered with, your phone/WhatsApp number, whether you agreed to promotional emails (and when), the batch date you booked, and the answers you give on the “knowing you” form — your background, AI familiarity, what you want to build or learn, what you are stuck on, whether you bring a laptop, and any dietary preference. The dietary answer is optional and used only to order lunch. We use these only to plan and run the day and to follow up with you. Registration status and the coupon you used are recorded too. If that coupon was given to a reseller (someone who shares our coupons), we also record which reseller, so we can credit them for the booking; the report we may share with that reseller shows only your first name and last initial, the cohort and the amount, never your email address or phone number. At the door we look at a valid photo ID to check it matches your registered name; we do not photograph, copy or store it.
• Reseller agreement: if you act as a reseller and sign our reseller agreement, we keep a record of that signature: the name you typed, your email address and mobile number, the date and time, the exact text of the agreement you were shown (and a fingerprint of it), which acknowledgements you ticked, the commission rate shown to you, and your IP address and browser details. We use it only to prove that you agreed to the agreement and to run the reseller programme, and we email a signed copy to you and to ourselves. We keep it for as long as it may be needed as evidence of that agreement, which is longer than your other records. If the agreement is later ended, we also keep a record of that: the date, who ended it, a private note of ours, and the notice we emailed to you.
• Help call bookings: if you book one of your two free AI Sunday help calls, the name and email you give, the time you pick and what you tell us you are stuck on. The booking is made through Cal.com, which holds these details and sends you the confirmation. We keep a record of the booking so we can check it is allowed and count your two calls.
• WhatsApp messages: if you message our WhatsApp number, your phone number and what you write, and our automatic reply. If you book AI Sunday, the number you gave at checkout is also used to send you booking messages (see "Why we use it"). We keep the text of these messages for 90 days.
• Enquiries: what you enter in our forms — feedback (and your email, only if you give it), a company project brief (contact name, work email and company), and a recruiter's message to a student (the recruiter's name, company, email and message, which we store and forward to that student).
• Technical: a single essential session cookie to keep you signed in, basic server logs, and short-lived counters used to stop abuse, which can include your IP address or email and are deleted within about two days.

Why we use it

• To create your account and sign you in.
• To track your course progress and, once you buy Full Access, to unlock the rest of each course, project submission, certificates and challenges.
• To review and publish your portfolio work and send you feedback. Your portfolio page becomes public only once you publish a project or join the leaderboard.
• To send transactional emails — login links, purchase receipts, workshop confirmations and a reminder the day before your workshop.
• Weekly progress digest: if you stop partway through a course, we may email you once a week to pick it up again. It is on by default for account holders; turn it off with the one-click link in the email, or from your account page.
• After-workshop check-ins: if you attend AI Sunday, four short weekly emails with a practice challenge. Every one has a one-click link to stop them.
• To answer questions you send us on WhatsApp with an automatic reply (a person takes over when the reply cannot help), and, if you book AI Sunday, to send your booking confirmation and a reminder the day before on WhatsApp as well as by email. These are service messages only, never marketing. Reply STOP to any of our WhatsApp messages and we stop sending them; booking emails continue.
• To contact you at the email you registered with about your booking, your handouts and future correspondence about the workshop.
• To keep the site safe from automated abuse. Sign-in, payment and the forms anyone can submit run a bot check (Vercel BotID) that looks at signals from your browser to tell a person from a script. We keep only the result (person or not, and which form) in our own analytics, not the signals, and we do not use it to profile you.
• Promotional emails: if you tick the separate, optional box at checkout, we may send you occasional emails about AI Praveen workshops and courses. This is your free choice and booking does not depend on it. You can unsubscribe at any time, by the link at the bottom of those emails or by writing to pravendalal@gmail.com, and we then stop. We keep your address on a short do-not-email list so that we never send you promotional email again; that list is used for nothing else, and you will still receive emails about things you have booked or bought. The same unsubscribe link also stops the weekly digest and the after-workshop check-ins.
• Optional analytics: anonymous page-view counts, and counts of which upgrade prompts in a course were shown, closed or pressed (with the course code only, never your name, email or IP address), only if you allow analytics in the cookie banner (see the Cookie Policy).
• To respond to your enquiries and to operate, secure and improve the Platform.

Most of this is data you give us so that we can provide something you asked for — an account, a course, a workshop seat, a reply — and we use it only for that. Promotional emails and optional analytics are based on your consent, which you can withdraw at any time, as easily as you gave it: by the unsubscribe link, the cookie settings link in the site footer, or by writing to us. Withdrawing consent does not affect what we did before you withdrew it. We also keep some records because the law requires it (for example, payment and tax records).

Who we share it with

We do not sell your personal data. We share the minimum necessary with service providers who process it for us, only to run the Platform:

• Supabase — our database, hosted in Mumbai, India. All the records described above are stored here.
• Vercel — hosts the website and its server code, and runs the bot check on sign-in, payment and forms. Files you upload (resumes and project files) are stored with Vercel Blob.
• Cloudflare R2 — stores the workshop documents we share with attendees. It holds our files, not your details.
• Razorpay — payment processing for Full Access and AI Sunday workshop seats. It receives your name, email and phone number with the order.
• MSG91 — delivers our emails (login links, receipts, workshop and follow-up emails) and connects our website to WhatsApp.
• WhatsApp (Meta) — when you message our WhatsApp number, or when we send you a booking message, the message and your phone number pass through WhatsApp, under WhatsApp's own terms and privacy policy. We use them only to answer you and to send your booking messages.
• Cal.com — scheduling provider for the help calls. It receives the name, email and answers you give when you book, under its own terms and privacy policy.
• Google Maps — only if you press "Show map" on the AI Sunday page, when your browser loads the venue map directly from Google. Nothing is sent to Google before you press it.

Your published portfolio projects are, by design, publicly visible on your shareable portfolio page, along with your name, your resume if you uploaded one, and a form recruiters can use to contact you; if you opt in, your name also appears on the leaderboard. Feedback and unpublished work remain private to you. A recruiter who writes to you through that form gets your reply only if you choose to reply.

Where your data is stored

Our database is in Mumbai, India, and we host the website in India where our hosting plan allows it. Some of our providers process data outside India: Cal.com, WhatsApp (Meta) and Google Maps, and possibly Vercel and Cloudflare for uploaded files. The DPDP Act allows this, except to countries the Government of India restricts; we will not send your data to any such country, and we use only providers with their own security and privacy commitments.

How long we keep it

Personal data is deleted when it is no longer needed. A job runs every day and deletes (or blanks) anything that has passed the period below.

• Login links: work for 15 minutes and once only, and are deleted 1 day after they expire.
• Signed-in session: up to 30 days, or until you log out; deleted as soon as it ends.
• Abuse-prevention counters (which can include your IP address or email): deleted automatically within about two days.
• WhatsApp message text: deleted after 90 days. Notes that stop the bot repeating itself go after 90 days of quiet; if you asked us to stop messaging you, we keep only that.
• Your workshop phone number and “Knowing You” answers: deleted 180 days after your workshop date. Your registration itself (name, email, date, what you paid) stays with your account.
• Waitlist entries: deleted 180 days after that Sunday has passed.
• Help-call booking records: deleted 1 year after the call.
• Messages from recruiters: deleted 1 year after they were sent (you also got them by email).
• Reports about a project: deleted 1 year after they are resolved.
• Product analytics (which pages and features were used): deleted after 1 year.
• Feedback messages: deleted after 2 years.
• Our activity log (who did what on the site, used to investigate problems): entries deleted after 3 years; entries about payments are kept with the payment records.
• Records of rights requests you make to us: deleted 3 years after the request was closed.
• Payment and tax records: 8 years, as Indian tax and accounting law requires, even after you delete your account (with no name or email attached once you do).
• Backups: once a month we take an encrypted copy of the whole database, kept in private storage in case data is lost, and delete each copy after 1 year. So something you delete can remain inside a backup for up to that long; it is never restored into the site except to recover from a loss, and if we ever have to do that, we delete again every account that had already been deleted.
• Do-not-email list: for as long as we send promotional email, so that we never email you again after you unsubscribe.
• Reseller agreement records: for as long as they may be needed as evidence of the agreement.
• Everything else (your account, learning record, notes, projects, workshop registration): while your account exists. Delete your account from your account page and it goes at once, apart from the records above that the law requires us to keep. Course progress is kept across access expiry so it can be restored if you renew.

Security

We use reasonable technical and organisational measures to protect your data: encrypted connections (HTTPS) everywhere, one-time login links, passwords and sign-in tokens stored only in hashed form, a database that refuses direct public access, admin pages open only to our admin account, a record of every time an admin views or downloads people’s details or opens someone’s file, and checks that stop automated abuse. Resumes and project files are kept in private storage and are opened only through our site, after a check that you may see them (your own files, or files on a portfolio its owner has made public). No system is perfectly secure, but we work to keep your information safe.

If something goes wrong: if there is a personal data breach that affects you, we will tell you, and the Data Protection Board of India, without delay, as the DPDP Act and Rules require — what happened, what it means for you, what we are doing about it, and what you can do to protect yourself.

Your rights (DPDP)

• Get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Ask us to correct, complete or update inaccurate data.
• Ask us to erase your data, subject to legal retention requirements (such as payment and tax records).
• Withdraw consent where processing is based on it.
• Nominate another person to exercise these rights for you if you die or become unable to do so.
• Raise a grievance and have it addressed.

Do it yourself, straight away: sign in and open the My data section of your account page. There you can download everything we hold about you (one file), correct your name and the phone on an upcoming workshop booking, turn promotional emails on or off, name a nominee, and delete your account. Deleting it removes your account, progress, notes, projects, uploaded files, workshop answers and the emails we hold for you, and signs you out. We keep only what the law requires or what is needed to keep our books right: payment records, and the count and price of a workshop seat (for seat numbers and any referral commission), with no name, email or phone attached.

For anything else, or if you cannot sign in, email pravendalal@gmail.com from the email address on your account (so we know the request is really from you), and say what you would like us to do. A nominee writing on your behalf should say who they are and include proof. We will reply within 30 days, and we keep a record of each request and our answer as evidence that it was handled.

Age limit (18+)

The Platform, including the AI Sunday workshop, is for people aged 18 and over only. We do not offer it to anyone under 18, and we do not knowingly collect personal data from children — the DPDP Act treats everyone under 18 as a child. We ask everyone to confirm they are 18 or older when they sign in and when they pay. If we find that we hold data about someone under 18, we will delete their account and data, other than records we are legally required to keep, such as payment and tax records. A parent or guardian who believes a child has registered can write to pravendalal@gmail.com.

Grievance officer & contact

For any privacy question, data request or complaint, contact our grievance officer, Praveen Dalal, at pravendalal@gmail.com. We will acknowledge your grievance within 7 days and resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Data Protection Board of India, after first raising it with us as described above.

Changes

We may update this policy; the “last updated” date reflects the current version. Please also see our Terms of Service, Cookie Policy and Refund & Cancellation Policy.