Privacy Policy

1. Introduction

Skilfo is a learner portfolio platform designed for children aged 6–18 in India, owned and operated by Orbisight Labs LLP ("we", "us", "our"). We are committed to protecting the privacy of all users, especially children, in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and its Rules, 2025. This policy explains how we collect, use, store, and protect personal data.

2. Data Fiduciary

Orbisight Labs LLP (LLP Identification No. ACY-2411, registered in India) is the Data Fiduciary under Section 2(i) of the DPDP Act, 2023 for all personal data processed through the Skilfo platform.

Grievance Officer: Vaibhav Nigam
Email: grievance@skilfo.com
Response timeline: Acknowledgement within 24 hours · Resolution within 15 days
Portal: skilfo.com/dashboard/grievance

3. Data We Collect

• Account data: Name, email address, mobile number, hashed password, user role (parent/student/coach/teacher/school admin)
• Profile data: Display name, avatar, a child's date of birth, grade and school, city, state (city/state are never shown publicly)
• Portfolio content: Achievements, certificates, projects, artwork, photos, videos and documents (such as certificate PDFs) uploaded by users or by the child's academy
• Academy records: Attendance, progress and test reports, class bookings, events and badges, kept by the child's academy on Skilfo
• Messages: Messages from academies delivered in the app, conversations with the AI Career Counsellor, reviews you write, and grievances you file
• Voice recordings: When a coach speaks a remark for a report instead of typing it, the recording is turned into text by a transcription service and then discarded; only the text is kept
• Payment records: Fee and subscription payments and receipts. Card, UPI and bank details are entered on Razorpay's payment page and never reach Skilfo
• Approximate location: Only if you allow it when searching for academies near you: your device works out the city name and only that city is sent to Skilfo, never your exact position
• Device data: A notification token and device type, so we can send app notifications you have allowed
• Technical data: IP address, browser or app version, access timestamps (for security and compliance)

4. Children's Data — Special Protections

Under Section 9 of the DPDP Act, processing children's data requires verifiable parental consent. We implement the following safeguards:

• A child's account is created by their parent, or as a record by their academy, which the parent can then claim
• All child content defaults to PRIVATE visibility
• Parents control privacy settings (Family / Link Only / Public)
• No behavioral tracking or targeted advertising for children
• No data is sold or shared with third-party advertisers
• AI features receive only the data they need. The AI Career Counsellor's reports and chats are saved with the child's account so the parent can come back to them, and are deleted with it. AI providers process the data only to return a result to Skilfo
• AI-generated content is labelled, on the website and in the app, and can be reported from the screen where it appears
• Location and other hidden data (EXIF, including GPS position) are removed from photos when they are uploaded. Photos uploaded before October 2026 are being cleaned the same way
• Any content can be reported from the screen where it appears; reports go to our grievance team

5. Purpose of Processing

We process personal data solely for:

• Creating and managing learner portfolios
• Issuing and verifying digital badges
• Generating AI-assisted skill mapping and progress reports (HPC)
• Enabling data sharing between academies and schools (with explicit parental consent)
• Sending notifications about account activity, approvals, and events
• Content moderation for child safety

6. Data Sharing

We share data only in the following circumstances:

• Academy → School: Only with explicit parental consent via our Data Sharing Consent system
• Public portfolios: Only items explicitly made public by the parent/student
• Badge verification: Badge verify pages show badge name, issuer, and recipient handle
• Your academy: The academy your child belongs to sees the records it keeps and the content shared with it
• Legal obligations: When required by law, court order, or regulatory authority

We do not sell, rent, or trade personal data to any third party.

Service providers who process data for us

These companies process personal data only on our instructions, to run Skilfo. They may not use it for their own purposes. Some of them process data outside India.

Website analytics: an academy may switch on its own Google Analytics or Meta Pixel for its public home page on Skilfo, to measure visits and its own advertising. They run only on that public page, which shows a cookie notice; never on signed-in pages. The Skilfo app contains no advertising, analytics or tracking tools.

7. Data Storage & Security

• All data Skilfo keeps is stored on servers located in India; some service providers listed in section 6 process data outside India to deliver their service
• Passwords are hashed using bcrypt (never stored in plaintext)
• OTP codes are bcrypt-hashed with automatic expiry and attempt lockout
• HTTPS encryption for all data in transit
• Helmet.js security headers enabled
• JWT tokens with short expiry and refresh rotation
• Application logs retained for 180 days per CERT-In requirements

8. Your Rights Under DPDP Act

As a Data Principal, you have the right to:

• Access: Request a copy of all your personal data
• Correction: Update or correct your personal data through your profile settings
• Erasure: Delete your account and all associated data yourself, from Profile → Privacy & data. The account is locked at once and erased 3 days later; you can keep it by signing in within those 3 days. Academies keep attendance and fee records with the name replaced by “Deleted student”. To delete only some data (a single portfolio item, your AI chat, a photo or a phone number) without deleting your account, see Delete some of your data.
• Withdraw Consent: Revoke data sharing consents at any time
• Grievance Redressal: File a complaint through our Grievance Portal
• Nominate: Nominate another person to exercise your rights in case of death or incapacity

To exercise these rights, visit your account settings or contact our Grievance Officer.

9. Data Retention

• Active accounts: data retained while account is active
• Deleted family accounts: locked at once and erased 3 days after the request. Encrypted backups roll over automatically, so the data also leaves them within 30 days. Academies keep attendance and fee records with the name replaced by “Deleted student”, as they are required to
• Academy and school accounts: closed by Skilfo on request (in the app under Data & privacy, or by writing to hello@skilfo.com), because they hold records other families rely on
• AI Career Counsellor reports and chats: kept until you delete them or your account
• Voice recordings: not kept; only the transcribed text is saved
• Expired OTPs: automatically purged
• Application logs (which can include the city used in a nearby-academy search): retained for 180 days per CERT-In Directions 2022
• Consent records: retained for audit purposes even after revocation

10. Data Breach Notification

In the event of a personal data breach, we will:

• Report to CERT-In within 6 hours as required by CERT-In Directions 2022
• Notify the Data Protection Board of India as required under DPDP Act
• Inform affected users via email and in-app notification
• Document the breach, impact, and remedial actions taken

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email and in-app notification at least 30 days before taking effect. Continued use of Skilfo after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related queries, contact our Grievance Officer:

Orbisight Labs LLP
Grievance Officer: Vaibhav Nigam
Email: grievance@skilfo.com
Portal: skilfo.com/dashboard/grievance