Privacy Policy

• Account data — full name, email, mobile number, country, address, educational institution.
• Onboarding documentation — your institutional / college ID, uploaded only after enrolment. We use it solely to confirm your active student/affiliate status and to print the right name on your offer letter and certificate. We do notcollect Aadhaar, Passport, Driving Licence, Voter ID, or any other government-issued ID.
• CV / résumé — optional, uploaded by you for mentor context.
• Programme data — your weekly submissions, project links, mentor feedback, daily logbook entries, and grievance/help-ticket history.
• Payment metadata — payment transaction ID, currency, and amount. We never see or store card numbers, CVV, UPI handles, or net-banking credentials — those are handled directly by Razorpay.
• Technical data — authentication cookies and session tokens needed to keep you logged in. With your consent, Google Analytics (anonymised IP) cookies for usage measurement.

• Create and manage your account.
• Process your internship enrolment and one-time platform fee.
• Verify your identity through your onboarding documents.
• Issue your offer letter and completion certificate.
• Send transactional emails (offer letter, enrolment confirmation, password reset, grievance updates).
• Pair you with a mentor and run the weekly review cycle.
• Respond to your help tickets and grievance requests.

We do not use your data for advertising, profile-building, or sale to third parties. We do not engage in automated decision-making that produces legal effects on you.

• Supabase Inc. — database, authentication, and file storage. Hosted on AWS. Onboarding documents are stored in an access-controlled, encrypted bucket.
• Razorpay Software Pvt. Ltd. — payment processing. Card / UPI / net-banking data is collected and held by Razorpay; we receive only an opaque transaction reference.
• Microsoft Corporation (Outlook / 365 via Microsoft Graph) — outbound transactional email from your registered HR mailbox.
• Google LLC (Google Analytics) — anonymised, IP-truncated usage measurement. Loaded only if you accept analytics cookies in the consent banner.

We do not disclose your personal data to any other third party except (a) when required by Indian law or a court order, or (b) to protect our legal rights in a dispute, or (c) with your fresh, specific consent.

• Account data — for as long as your account is active. Deleted within 30 days of an erasure request, subject to clause 8 below.
• Onboarding documents (institution ID) — for the duration of your internship and 2 years thereafter, then permanently deleted. The 2-year window exists so we can re-verify a certificate or offer letter on request.
• Programme submissions and certificates — retained indefinitely by default (so the certificate stays publicly verifiable). You may request anonymisation; the certificate ID itself remains valid but ceases to be linked to your name.
• Payment records — 8 years, as required by Indian tax and accounting law.
• Grievance / help-ticket history — 3 years from closure of the ticket.

• Right to access — download a machine-readable copy of all personal data we hold about you.
• Right to correction — edit your name, mobile, address, country, and other profile fields directly. For any field you cannot edit yourself, raise a help ticket.
• Right to erasure — request deletion of your account and personal data. Subject to clause 8.
• Right to grievance redressal — escalate any privacy concern to our Grievance Officer (clause 11). Unresolved grievances may be escalated to the Data Protection Board of India.
• Right to nominate — nominate another individual to exercise your rights in the event of your death or incapacity. Email the Grievance Officer to record a nomination.
• Right to withdraw consent — withdraw your consent at any time. Withdrawal is as easy as the original consent (one click on the Profile page) and applies prospectively; processing already done remains lawful.

We respond to all rights requests within 30 days. There is no fee for exercising these rights.

• Payment / GST / tax records — for the statutory 8 years.
• Issued offer letter and certificate metadata (cohort, track, dates, certificate number) so prior verifications remain authoritative. Your name is removed on request.
• Records of an open or recent grievance / dispute.

All other personal data is deleted within 30 days of your request.

• All traffic is served over HTTPS with TLS 1.2 or higher.
• Database access is gated by Postgres Row-Level Security policies — every query is scoped to the requesting user.
• Onboarding documents live in a private storage bucket; only authorised HR / admin staff can read them.
• Service-role credentials never leave the server; the browser only ever holds a short-lived user JWT.
• Passwords are hashed using bcrypt by Supabase Auth; we never see your plaintext password.
• Access is granted on a least-privilege basis and reviewed periodically.

1. Notify the Data Protection Board of India in the form and timeframe prescribed by the Rules.
2. Notify each affected Data Principal directly, by email, describing what happened, what data was involved, what we are doing about it, and what you can do.

If you suspect a breach involving your account, email the Grievance Officer immediately.

Per §8(9) of the DPDP Act, our Grievance Officer is your single point of contact for any privacy-related question, complaint, or rights request:

If you are not satisfied with our response, you may complain to the Data Protection Board of India through the channels published on its website.

• Strictly necessary — first-party authentication cookies set by Supabase to keep you logged in. These cannot be turned off as the platform will not function without them.
• Analytics (optional) — Google Analytics (gtag.js, measurement IDG-QF3KB9R9XH) loaded with IP anonymisation enabled. We use this only to understand aggregate usage patterns. These cookies are never set unless you accept them in the consent banner. You can change your decision later by clearing site data.

We do not set advertising, social-media tracking, or cross-site cookies of any kind.

ApexDevs operates an AI-powered chat assistant on its public website. Before using the assistant, you are asked to provide your name, email address, and mobile number, and to explicitly consent to this section. Providing these details and ticking the consent checkbox is required to start a conversation.

What we collect

• Your name, email address, and mobile number, entered in the pre-chat form.
• The full text of your conversation with the AI assistant, including all messages you send and all AI-generated replies.
• The timestamp of each message and the date you started the session.

Why we collect it and legal basis

We collect this data on the basis of your explicit, freely given consent, provided by ticking the checkbox before starting the chat. The purposes are:

• To allow the AI assistant to answer your questions accurately and in context.
• To follow up with you about internship opportunities that match your expressed interests.
• To improve the quality of the AI assistant by reviewing conversations internally — no conversation content is used to train third-party AI models.
• To generate business leads and understand prospective user needs.

AI model and data processor

The AI responses are generated by Anthropic, PBC (Claude) or OpenAI, LLC (ChatGPT), depending on platform configuration. Your messages are transmitted to the active provider solely to generate a reply; neither provider retains your messages for their own model training under our current data-processing agreements.

Retention

Chat conversations are retained for 12 months from the date of the session, after which they are permanently deleted. If you create an account and enrol in an internship, the conversation is linked to your profile and deleted when your account is deleted, subject to the retention rules in clause 6.

Withdrawing consent

You may request deletion of your chat data at any time by emailing grievance@apexdevs.io with the email address you used in the chat form. We will delete the record within 30 days.