Privacy Policy

Who we are and scope

CodeLangs AI is operated by Dattatray Sabne in India. For personal data processed through this website, the operator decides why and how that data is used and is the primary privacy and grievance contact.

This Policy applies to public pages, accounts, course purchases, learner features, certificates, support, referrals and other website interactions. It does not control a third party’s independent website, app or service.

This Policy is intended to work with applicable Indian privacy, information-technology and consumer law as their provisions come into force. It does not reduce any right that applicable law gives you.

Personal data we collect

The exact data depends on what you use. We may collect:

• Account and identity — username, full name, email, country, password hash, email-verification status and account status.
• Profile details — mobile number, date of birth, gender, role, experience, skill level, goals, technologies, language, referral source and profile image when you provide them.
• Orders and payment evidence — course, amount, currency, access duration, accepted refund-policy snapshot, consent time, transaction reference, payment date, mobile number, uploaded proof, review status and refund record.
• Learning activity — course access, chapter progress and visits, bookmarks, notes, practice activity, feedback, certificate records, downloads and learner-feature usage.
• Content you provide — resume-builder information, support messages, feedback, uploaded files and launch-alert or marketing choices.
• Security and technical data — IP address, user agent, session state, sign-in and sign-up attempts, security events, referral attribution and necessary cookie or browser-storage identifiers.

Please do not put unnecessary sensitive information in free-text notes, resumes, feedback or support messages.

How data is collected

We collect data directly from you when you register, complete your profile, buy a course, upload payment proof, learn, create a resume, request support or choose communications. We also generate records when the service verifies access, records progress, secures a session, issues a certificate or logs an administrative action.

Limited data may also come from your browser, a referral link, an analytics provider, a video provider, an email-delivery service or a bank/payment app when needed to confirm a transaction or operate the feature.

How and why we use personal data

• Create, verify, secure and support your account.
• Display courses, free previews and learner features; grant access; save progress; and issue or verify certificates.
• Record purchase consent, verify manual payments, manage orders, refunds, access periods and financial records.
• Prevent fraud, credential sharing, abuse and security incidents; enforce personal course licences; and maintain audit records.
• Reply to requests, provide service notices and meet legal, tax, accounting, grievance and dispute obligations.
• Measure public-site and purchase-journey performance using privacy-filtered analytics, and send promotional updates only when you choose them.

Depending on the context and law in force, processing is based on your request or consent, performance of the service you purchase, compliance with law, protection from fraud and security threats, or another lawful use recognized by applicable law.

Payments, orders and financial records

Payments are made using the method shown at checkout, outside any request for your UPI PIN or banking password. We collect the transaction reference and evidence you submit so an administrator can verify the payment. Payment proof may contain information visible in the image you upload; redact unrelated balances or transactions where possible.

We keep the price, duration, refund policy and consent version accepted for an order so the transaction can be proved and handled fairly. Order, payment, consent, refund and related audit records may be retained after account closure when needed for legal, tax, accounting, fraud-prevention or dispute purposes.

Learning data and content protection

We record access and progress so you can continue learning and so the platform can enforce the course and device rules attached to your purchase. Your private learner notes and resumes are account-scoped features and are not published as course content.

For paid learner videos, a visible moving watermark may contain your username, full account email, full profile mobile number, account/course/chapter identifiers, a stable trace and the current time. It stays inside the protected video player and is used to deter and investigate unauthorized recording or redistribution; it is not sent to marketing analytics. Public and administrator previews use different non-learner labels.

A certificate verification page may display certificate details needed to establish authenticity. Do not share a certificate or verification link publicly unless you are comfortable with that verification information being viewed.

Cookies, local storage and analytics

Necessary cookies and similar storage keep your session secure, remember the selected website language and support core preferences. Disabling them may prevent sign-in or other essential features.

We use Google Analytics 4 on eligible public and learner pages to understand campaign traffic, page and course views, previews, registration, checkout, payment submission and confirmed purchases. Google uses pseudonymous browser identifiers and cookies. We do not intentionally send names, email addresses, telephone numbers, passwords, free-text search or payment references to Analytics. Admin and partner areas are excluded.

We use the Meta Pixel on eligible public and learner pages to record a PageView for advertising measurement and attribution. Meta may use cookies and pseudonymous browser or device identifiers and receive the page URL. We disable automatic configuration and do not intentionally send names, email addresses, telephone numbers, passwords, form or search text, payment references or custom purchase data to Meta. Pages containing recovery tokens, private workflow identifiers or unapproved query values, and all admin and partner areas, are excluded.

Your browser may keep checkout and order markers for up to 90 days to avoid repeating analytics events and detect a later payment approval. If server-side purchase measurement is enabled, protected private files may hold a checkout reference and Google’s pseudonymous browser/session identifiers until delivery or expiry; undelivered context is eligible for removal after 180 days. These files do not contain your name, email, telephone number or payment reference.

You can block optional analytics through browser controls or clear browser storage, although measurement may then be incomplete. This is separate from your marketing-email choice.

When data is shared

We do not sell or rent personal data. We disclose only what is reasonably necessary in these situations:

• Service providers: hosting, email delivery, analytics, video delivery and other processors that help operate the website.
• Payments: banks or payment apps involved in a transaction, and administrators authorized to verify submitted evidence.
• Legal and safety: when required by law, legal process, a competent authority, or reasonably necessary to protect users, rights, property or platform security.
• Business change: as part of a genuine reorganization, acquisition or transfer, subject to appropriate confidentiality and applicable law.

Some providers, including analytics and video services, may process data outside India. Where applicable, we use providers subject to their published safeguards and handle transfers according to restrictions imposed by Indian law.

Security

We use measures appropriate to the service, including password hashing, secure session controls, CSRF protection, rate limits, access checks, validated uploads, protected storage, administrative audit trails and encrypted authenticated backups. Access is limited according to role and operational need.

No website, transmission or storage method is completely secure. You should use a unique password, protect verification codes, sign out on shared devices and contact us promptly if you suspect compromise.

Retention and deletion

We keep personal data only as long as reasonably needed for the purposes above, an active account or course, and legal, security, tax, accounting and dispute requirements. Retention differs by record.

• Current operational defaults remove old sign-in and sign-up attempt records after about 90 days, used or expired verification records after a short grace period, and read learner or administrator notifications after about 180 days.
• Never-verified accounts may be removed after the configured short retention period, currently seven days, when they have no protected order or consent record.
• Learner profile, progress, saved resume and similar account-scoped data can be removed when an account is permanently deleted, subject to system and legal safeguards.
• Orders, payment reviews, accepted purchase terms, refunds, financial attribution, certificates and audit records may need longer retention for proof, fraud prevention, accounting, tax, legal claims or public verification.

Backups and logs may retain protected copies for a limited recovery cycle before they are overwritten or expire. When deletion is not legally or technically immediate, we restrict further use to the retained purpose.

Your choices and rights

You can update many profile fields from your account. Marketing communication is optional and separate from essential account, security, payment and course notices. You may withdraw a marketing choice without losing purchased access.

Subject to applicable law and identity verification, you may ask for information about our processing, access or correction of your data, deletion of data no longer needed, withdrawal of consent where consent is the basis, and grievance redressal. Some requests may be limited where records must be kept for legal, financial, security, fraud-prevention, certificate-verification or dispute purposes.

To protect you, we may ask you to send a request from the registered email and provide enough information to locate the account. We will never ask for your password, verification code, UPI PIN or banking password.

Children and younger learners

The service is not directed to children who cannot lawfully consent for themselves. A person under 18 should use it only with a parent or lawful guardian’s involvement and permission. If you believe a child provided personal data without appropriate authorization, contact us so we can review and take suitable action.

Changes to this Policy

We may update this Policy when data practices, services or law change. We will revise the effective date and provide additional notice when a change is material or law requires it. Earlier processing remains governed by the policy and transaction records applicable at that time.