Privacy Policy

1. Who We Are

oStaran, withArijit and AIwithArijit is an AI education platform operated by Star Analytix Pvt Ltd, a company incorporated in India (our registered office is at Mira Road East, Mumbai, Maharashtra, India — 401107). This Privacy Policy applies to all services offered at www.ostaran.com, www.witharijit.com and www.aiwitharijit.com (collectively, "the Platform"), and to everyone whose data we process — students, learners and their parents/guardians, AI Partners and sub-partners, mentors and co-mentors, recruiters, and job-seeking candidates.

Star Analytix Pvt Ltd is the "Data Fiduciary" for your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). For any privacy query or to exercise your rights, contact our Grievance Officer at grievance@ostaran.com (see Section 12).

2. Information We Collect

Depending on how you use the Platform, we collect the following categories of personal data:

• Identity data: Full name, date of birth / age, and — for learners under 18 — the identity of a parent or guardian
• Contact data: Email address, mobile number, WhatsApp number, postal address
• Payment data: Transaction ID, amount, payment method, GST details. We never store card numbers or CVV — payments are handled entirely by Razorpay
• Session recordings & transcripts: Live classes and webinars are conducted and recorded and transcribed on Microsoft Teams. Recordings and transcripts may capture your name, voice, image (if your camera is on), and chat messages, and are stored and re-shared with enrolled learners and used to generate learning materials (see Sections 3 and 5)
• Partner / mentor data: For AI Partners and mentors — PAN, bank/UPI details, GSTIN, occupation and network/commission data, needed for payouts and tax compliance
• Recruiter / candidate data: For the recruiter portal — résumés, career history and job-search preferences you choose to submit
• Usage data: Pages visited, course progress, session attendance, device type, IP address, browser type
• Communications: Emails, WhatsApp messages and support tickets exchanged with our team
• Referral data: Partner / referral codes used during registration

3. How We Use Your Information

We use your personal data for the following purposes, each tied to a specific lawful basis (Section 4):

• Creating and managing your account
• Delivering course content, live sessions, recordings, transcripts and study materials — including re-sharing session recordings with your cohort and generating AI-assisted summaries, notes and learning aids from transcripts
• Processing payments, issuing GST invoices, and calculating partner commissions / mentor revenue shares and payouts (including PAN/TDS compliance)
• Sending you transactional messages (session reminders, joining links, receipts) by email and WhatsApp
• Sending you marketing / promotional messages (new courses, offers) by email and WhatsApp only where you have opted in, and never to a child
• Issuing certificates, providing support, and improving the Platform
• Complying with legal obligations under Indian law

4. Lawful Basis for Processing

Under the DPDP Act, 2023 we process your personal data on the following bases:

• Consent: For marketing communications, session recording where consent is required, and any processing not covered below. You may withdraw consent at any time, as easily as you gave it (Section 7)
• Performance of your contract / certain legitimate uses (s.7): Delivering the course you enrolled in, and providing a service you voluntarily requested
• Legal obligation: GST invoicing, TDS on partner/mentor payouts, financial record-keeping

Before we collect your data we provide a notice describing what we collect and why, so your consent is free, specific, informed and unambiguous.

5. Data Sharing and Processors

We do not sell your personal data. We share it only with the following processors and recipients, under contract and only as needed:

• Razorpay: Payment processing (PCI-DSS compliant)
• Microsoft (Teams, OneDrive/SharePoint): Hosting, recording and transcribing live sessions and storing the resulting recordings and transcripts. This may involve processing on servers outside India
• AiSensy / WhatsApp Business API (Meta): Session reminders and (where you opted in) course communications
• Email providers (Hostinger / Brevo / Resend): Transactional and (opted-in) marketing emails
• Supabase: Secure cloud database hosting (data stored in encrypted form)
• Partners / Referrers: We share only limited data needed to attribute an enrolment (e.g. that a referral converted) — never your sensitive personal details without your consent
• Legal authorities: When required by law, court order, or government authority

6. Children's Data

Some of our programmes are designed for school students and children under the age of 18. Where a learner is under 18:

• The account must be created, and the course purchased, by a parent or legal guardian, who enters into the contract on the child's behalf;
• We process the child's data only after obtaining verifiable consent of the parent or guardian, as required by Section 9 of the DPDP Act, 2023;
• We do not undertake behavioural tracking, profiling, or targeted advertising directed at children, and we do not send marketing messages to a child. Communications relating to a child's learning are sent to the parent/guardian;
• A parent/guardian may withdraw consent and request deletion of the child's data at any time via our Grievance Officer.

7. Marketing Communications & Your Choices

We send promotional messages on WhatsApp and email only with your prior opt-in consent. Every marketing email carries a one-click unsubscribe link, and you can stop WhatsApp marketing by replying STOP or by contacting us. Withdrawing marketing consent will not affect essential transactional messages about a course you are enrolled in.

8. Data Retention

We retain your personal data for as long as your account is active and for up to 7 years after account closure for financial and legal compliance. Session recordings and transcripts are retained for the lifetime of the course batch and the associated library access. You may request deletion of your data (subject to legal retention requirements) via our Grievance Officer.

9. Your Rights

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you
• Correct, complete, update or erase your personal data
• Withdraw consent (including for marketing) at any time
• Nominate another individual to exercise your rights in the event of death or incapacity
• Grievance redressal (Section 12), and to escalate to the Data Protection Board of India if unsatisfied

To exercise any right, email our Grievance Officer at grievance@ostaran.com.

10. Cookies

We use essential cookies for session management and authentication, and anonymised analytics cookies to understand platform usage. Where required, we ask for your consent to non-essential cookies and you may accept or reject them. We do not use non-essential cookies or tracking for accounts identified as belonging to a child.

11. Security & Breach Notification

We implement industry-standard security measures including HTTPS/TLS encryption, access controls, and secure cloud infrastructure. Payment data is handled entirely by Razorpay and is never stored on our servers. In the event of a personal-data breach, we will notify the Data Protection Board and affected users as required under the DPDP Act.

12. Grievance Officer & Contact

In accordance with the DPDP Act, 2023 and the Information Technology Rules, you may contact our Grievance Officer for any privacy concern or to exercise your rights. We will acknowledge within 48 hours and resolve within 30 days.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform. Continued use after changes constitutes acceptance of the updated policy.