Privacy Policy

CATclub Education Private Limited ("CATclub", "we", "our", or "us") operates the website catclub.in and related mobile applications (collectively, the "Platform"). We are incorporated under the Companies Act, 2013 and are based in India.

This Privacy Policy describes how CATclub collects, uses, stores, discloses, and otherwise processes personal data of users ("you" or "User") of our Platform. By accessing or using our Platform you agree to this Privacy Policy.

This Policy is compliant with the Information Technology Act, 2000; Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

We collect the following categories of personal data:

We use your personal data to:

• Create and manage your account and provide Platform services.
• Personalise your learning experience, generate performance insights, and power the AI Mentor.
• Send updates, notifications, and response communications related to your study progress and account activity.
• Send transactional emails (OTPs, password resets, exam reminders).
• Send promotional communications — only with your consent or where permitted by law; you can opt out at any time.
• Improve and develop Platform features through analytics and aggregate research.
• Detect, prevent, and respond to fraud, security incidents, and abuse.
• Comply with legal obligations and enforce our Terms of Service.

We process your personal data under the following lawful bases (as applicable under the DPDP Act, 2023, and SPDI Rules, 2011):

• Consent: You have given clear consent for us to process your data for a specific purpose (e.g., marketing emails).
• Contract: Processing is necessary to perform our contract with you (delivering the education services you requested).
• Legal Obligation: Processing is required to comply with applicable Indian law (e.g., tax records, court orders).
• Legitimate Interests: Processing is necessary for our legitimate interests, such as fraud prevention and platform security, provided those interests are not overridden by your rights.

We do not sell your personal data. We share information only in the following circumstances:

• Service Providers: Cloud hosting (AWS/GCP), email delivery (SendGrid), and analytics tools — bound by data-processing agreements.
• AI Services: Anonymised or pseudonymised query data may be processed by our AI partners (Google Gemini API) to power the AI Mentor feature.
• Legal Disclosure: When required by law, court order, or government authority in India.
• Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity subject to equivalent privacy protections.
• With Your Consent: For any other purpose with your explicit consent.

All third-party processors are contractually bound to maintain the confidentiality and security of your data and may not use it for their own purposes.

We retain your personal data for as long as your account is active or as necessary to provide our services and comply with legal obligations:

• Account Data: Retained for the lifetime of your account plus 3 years after deletion, as required for tax and legal compliance.
• Performance & Study Data: Retained for the duration of your active account usage and up to 1 year after.
• Financial Records: Not applicable, as the Platform is offered free of charge and no payments are collected.
• Log Data: Automatically purged after 90 days.

When data is no longer required, we securely delete or anonymise it.

Subject to applicable law, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data where we no longer have a legitimate reason to retain it.
• Right to Withdraw Consent: Withdraw consent for marketing communications or any processing based on consent at any time, without affecting the lawfulness of prior processing.
• Right to Grievance Redressal: Raise a complaint with our Grievance Officer (see Section 13) or with the Data Protection Board of India once constituted.
• Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity (as provided under the DPDP Act, 2023).

To exercise any of these rights, email us at adminteamcatclub@gmail.com. We will respond within 30 days.

We use cookies and similar tracking technologies (pixels, local storage) to:

• Strictly Necessary Cookies: Authenticate your session, maintain security tokens, and remember your preferences. These cannot be disabled.
• Analytics Cookies: Understand how users navigate our Platform (e.g., Google Analytics with IP anonymisation enabled).
• Functional Cookies: Remember your settings (dark mode, language) across sessions.

You may control non-essential cookies via your browser settings. Note that disabling cookies may impact Platform functionality.

We implement industry-standard technical and organisational measures to protect your personal data, including:

• TLS/HTTPS encryption for all data in transit.
• AES-256 encryption for sensitive data at rest.
• Role-based access controls limiting employee access to personal data.
• Regular security audits and vulnerability assessments.
• Incident response procedures with notification obligations under applicable law.

Despite these measures, no transmission over the internet is 100% secure. You use the Platform at your own risk and should maintain the confidentiality of your password.

Our Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If you are a parent or guardian and believe your child has provided us personal data, please contact us at adminteamcatclub@gmail.com and we will promptly delete such data.

Our Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (at the address registered with us) and/or by a prominent notice on the Platform at least 15 days before the changes take effect. The "Effective Date" at the top of this page will always reflect the current version.

Continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy.

In accordance with Rule 5(9) of the SPDI Rules, 2011 and the DPDP Act, 2023, we have designated a Grievance Officer to address complaints and queries regarding the processing of personal data:

For any privacy-related queries, data requests, or concerns, please contact: