Privacy

When you place an order: your name, and either a phone number or an email address — whichever you prefer we use. Both are optional individually; one of the two is required, because otherwise we cannot reach you. Plus the kit you chose, the total agreed at that moment, any discount code, and anything you type into the note field.

When you send an enquiry: your name and email address, and optionally your college, your deadline and whatever you tell us about your requirement.

We do not ask for your date of birth, your enrolment number, your address, or your government ID, and you should not send them.

When you browse, and only if you say yes: we ask on your first visit whether we may use Google Analytics to see which pages are visited and how people find the site. Until you accept, it is not loaded at all and no analytics cookies are set. If you accept, it sets first-party cookies (named _ga) that recognise a returning browser, and it records the pages you view, your device and browser type, and an approximate location that Google derives from your IP address. It is not given your name, email address, phone number or anything you type into our forms.

The admin panel does not load Google Analytics. We run no advertising pixels, no social widgets and no other trackers. You can change your answer at any time with "Cookie settings" at the foot of every page; withdrawing clears the analytics cookies. Your choice is remembered in your own browser, not on our servers, and the site works exactly the same whichever you pick.

Everything you send travels over HTTPS. Your name, phone number, email address, college and message are then encrypted with AES-256-GCM before they are written to our database, and decrypted only when we open the admin panel to read them.

That is a separate layer from the disk encryption our database provider applies, and the key is held outside the database. A stolen database dump, a misconfigured network rule or a compromised hosting account yields ciphertext, not a list of students and their phone numbers.

If that encryption key is ever unavailable, the site refuses to save your details rather than storing them in the clear.

The admin panel is password-protected, kept out of search engines, and reachable only with a signed session. No one outside our team has an account.

No system is perfectly secure, and we will not pretend otherwise. What we can tell you is what we do, which is the list above. If we ever discover a breach affecting your data, we will tell you and the Data Protection Board, as the law requires.

To answer your question, scope your project, agree a price, deliver your files and support you during your support window. That is the whole list.

We do not build marketing profiles, we do not run ads, and we do not add you to a mailing list because you asked a question.

Only the people working on your project. We do not sell, rent, trade or share personal data with anyone — not with advertisers, not with data brokers, not with other customers, and not with your college.

Two service providers hold data on our behalf because the site cannot run without them: our hosting provider, and MongoDB Atlas, where the encrypted records live. They act on our instructions and cannot use your data for their own purposes.

If you accept analytics, Google receives the browsing data described above through Google Analytics, and handles it under Google's own privacy policy. We use it only as aggregate traffic statistics, and it never contains the details you send us through a form.

One thing worth being plain about: payment is arranged over WhatsApp. If you message us there, that conversation is carried by WhatsApp and governed by their privacy terms, not ours. If you would rather not use it, tell us and we will arrange payment by email instead.

Enquiries and orders that do not go ahead are deleted after twelve months. Completed order records are kept for as long as tax and accounting law requires, then deleted.

You can ask us to delete yours sooner at any time, and we will confirm once it is done.

Under the Digital Personal Data Protection Act 2023 you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, and ask who we have shared it with. You can also nominate someone to exercise these rights on your behalf if you are unable to.

You do not need a reason, and exercising any of them costs nothing and will never affect the service you get.

Write to privacy@collegeproject.tech from the address or number you contacted us with, and we will respond within 30 days.

If you are unhappy with how we have handled your data or your request, our Data Grievance Officer is the first point of contact: privacy@collegeproject.tech.

If we do not resolve it to your satisfaction, you have the right to complain directly to the Data Protection Board of India.

This service is intended for university students aged 18 or over. The law requires a parent or guardian's verifiable consent before we can process a child's personal data, and we are not set up to obtain it.

If you are under 18, please have a parent or guardian contact us on your behalf. If we learn we have collected data from someone under 18 without that consent, we will delete it.

If we change what we collect or how we protect it, we will update the date at the top of this page. Material changes will be flagged to anyone with an open order.