Privacy Notice
How CodeMetrix collects, uses, shares and retains your personal data — and the rights you have over it under the Digital Personal Data Protection Act, 2023.
This notice is written to be read, not to be survived. If anything in it is unclear, or you disagree with something we do, write to codemetrix1@gmail.com and a person will answer you.
1. Who is responsible for your data
CodeMetrix is the Data Fiduciary for the personal data described here. That means we decide why and how it is processed, and we are accountable for it under the Digital Personal Data Protection Act, 2023 (“the Act”).
- Address: Patia, Bhubaneswar
- MSME registration: Udyam-OD-19-0162791
- General contact: codemetrix1@gmail.com
You are the Data Principal — the person the data is about. Sections 6 and 8 below set out what you can require of us.
2. What we collect, and why
We collect only what a stated purpose needs. Some of this is asked for once; some depends on what you use the platform for. If a row does not apply to you, we do not hold it.
Everyone with an account
| What | Why |
|---|---|
| Email address | To create and identify your account, and to send you messages about it — enrolment confirmations, password resets, and similar. |
| Password | To secure your account. It is stored only as a one-way hash; we cannot read it. |
| Name | To address you, and to print on certificates you earn. |
| Phone number | To reach you about an application, a payment, or a scheduled session. |
| Date of birth | Asked when you sign up, to confirm you meet the age requirement in section 5. For mentors, also checked against the identity documents below. |
| Gender | You may choose “Prefer not to say”. Used only for anonymous, aggregate statistics on how learners of different genders do, so we can improve our programmes — never to make a decision about you. |
| Profile photo | Optional. Shown to you and, for mentors, on your public mentor page. |
| Sign-in records — the date and time, IP address and browser each time you sign in, and any failed attempts | To protect your account against someone guessing your password, and to investigate misuse. |
| If you sign in with Google or LinkedIn: the name and email address they share with us, and an identifier for your account with them | To let you sign in without a password. They share this under their own privacy policies; we never receive your password for them. |
Students
Who sees this inside CodeMetrix. Once you are enrolled and a mentor is assigned to you, that mentor can see the details below — your name, contact details, college and education history — and can download the CV and internship reports you upload. They need them to supervise you. Only the mentor assigned to you can see them: not other mentors, not other students. Our admin team can also see them. Nobody else, and nothing is public.
| What | Why |
|---|---|
| Institution, degree, field of study, year | To check eligibility for an internship and to match you to a suitable stream and mentor. |
| Education records and certificates | To verify the qualifications an internship requires. |
| CV / résumé, if you upload one | To let the mentor reviewing your application assess it. |
| Course and lesson progress | To resume where you left off, and to establish that you completed the work a certificate attests to. |
| Internship reports you submit | To be reviewed and graded by your mentor and by us. |
| Internship attendance — whether you attended each scheduled session, as marked by your mentor | To track participation, which completing an internship depends on. |
| Your rating and comment on a mentor, if you leave one | Shown on the mentor’s page, to signed-in users, with your first name and last initial. |
| Postal address | Where a certificate or other material has to be posted to you. |
Mentors
| What | Why |
|---|---|
| Qualifications, experience, current role, biography | To assess your application to mentor, and — for the parts you choose — to show on your public mentor page. |
| Education certificates | To verify the qualifications you state. |
| Aadhaar number and a scan of the card | To verify your identity before you are approved to mentor students, several of whom we are responsible to. Once your identity is verified we delete the full number and keep only its last four digits. |
| PAN number and a scan of the card | To verify identity and to meet our tax obligations on payments made to you. |
| Postal address | For payment and statutory records. |
About your Aadhaar and PAN. These are the most sensitive things we hold. We ask for them only to verify that a person applying to mentor students is who they say they are. They are never shown on your public page, never shared with students, and never used for anything else. Both numbers are stored encrypted. In the administrative interface staff see only the last four digits; the few staff who verify identity documents can see a number in full, and every time they do it is logged. If you would rather not provide them, you cannot be approved as a mentor — but you can still hold a student account.
If you pay us
| What | Why |
|---|---|
| Amount, currency, date, status | To give you access to what you paid for, to issue receipts, and to keep the accounting records the law requires. |
| Payment reference numbers, and the details our payment gateway reports back about a payment — the method, the last four digits of a card or your UPI ID, the bank, and the email and phone you gave the gateway | To reconcile your payment, issue refunds, and investigate it if something goes wrong. |
We never see or store your card number, UPI PIN, CVV or bank credentials. Those go directly to our payment gateway (section 3).
If you contact us without an account
| What | Why |
|---|---|
| Name, email, phone, your message | To answer you. |
| Course or internship you asked about, your education level | To answer you usefully rather than generically. |
| IP address and browser user-agent | To detect and block automated abuse of our public forms. Nothing else. |
If you subscribe to our newsletter
| What | Why |
|---|---|
| Email address, name if you give one | To send you the newsletter, until you tell us to stop. |
| IP address | To block automated sign-ups. Nothing else. |
3. Who else processes your data
We use a small number of service providers to run the platform. They act on our instructions and for no purpose of their own. We do not sell your personal data, and we do not share it for anyone else's advertising.
| Provider | What they handle | Where |
|---|---|---|
| Amazon Web Services | Hosting and storage of uploaded files — documents, certificates, images. | Mumbai, India |
| Razorpay | Card, UPI and netbanking payments. They receive your payment credentials directly; we receive only the outcome. | India |
| Google Analytics | Aggregate statistics about how the site is used — which pages are visited, and for how long. Only if you allow analytics cookies (section 4); if you do not, nothing reaches Google. | Outside India |
| Our email provider | Delivering the messages we send you. | Varies |
| AI model providers | Helping mentors draft course material. Course topics and outlines only — no student or mentor personal data is sent to them. | Typically outside India |
We also disclose personal data where the law requires it — a court order, a statutory demand, or a lawful request from a public authority.
If you sign in with Google or LinkedIn, they tell us your name and email address. They are not our service providers: they act under their own privacy policies, and we share nothing with them.
Public certificate verification
Every certificate we issue carries a certificate number, and anyone holding that number can check it at our certificate verification page without an account. A certificate is worth nothing if an employer cannot confirm it, so this is part of the credential itself rather than an optional extra.
The verification page shows only the name on the certificate, what was completed, the dates, and whether the certificate is still valid. It never shows your email address, phone number, postal address, college, date of birth, academic records, or anything about what you paid. There is no way to search by name, and no way to list certificates — the number is the only way in, and you decide who you give it to.
Data leaving India
Your account data and uploaded files are stored in India. Analytics and AI processing described above take place outside India. Section 16 of the Act permits this except to countries the Central Government restricts; we will stop using any provider that becomes restricted.
4. Analytics and cookies
We use cookies that are necessary for the site to function — keeping you signed in, and protecting forms against cross-site request forgery. These cannot be turned off without breaking the site.
We would also like to use Google Analytics on our public pages, to understand which parts of the site are useful. It sets its own identifiers and sends usage data to Google. That one is your choice, and we ask before it loads.
What "we ask first" actually means here. On your first visit a banner asks whether analytics is alright. Until you answer, and if you answer no, the Google Analytics script is never requested by your browser at all — it is not loaded and then told to stay quiet. The decision is made on our server before the page is built. You can change your mind whenever you like from Cookie settings in the footer, and withdrawing takes one click, exactly like giving it.
Our Cookie Policy lists every cookie by name, what each one does and how long it lasts.
Browser-level tracking protection, private browsing and blocking extensions all work on this site, and we do not try to detect or defeat them.
5. Age requirement
CodeMetrix is for people aged 18 and over. Our courses and internships are built for undergraduate, postgraduate and research students, and our accounts are not intended for children.
Section 9 of the Act places strict duties on anyone processing a child's personal data, including a requirement for verified parental consent and a prohibition on tracking children. We meet those duties by not offering accounts to under-18s rather than by attempting to obtain parental consent.
We ask for your date of birth when you create an account and do not create accounts for anyone under 18. Accounts made before we asked are asked once, the next time they sign in.
If you are under 18, please do not create an account. If you believe a child holds an account with us, tell us at codemetrix1@gmail.com and we will delete it.
6. Your rights
The Act gives you the following rights. Most of them you can use yourself on your privacy page (Dashboard → Privacy & Data): download a copy of your data, stop marketing email, name a nominee, or delete your account. For anything else, write to codemetrix1@gmail.com from the email address on your account, or raise a request under “Privacy and your data” in Help & Support. We may need to confirm your identity first — so that we do not act on a request made by someone pretending to be you.
If you never had an account — you contacted us or subscribed to the newsletter — write to us and we will send you what we hold, or erase it.
- To know what we hold (s. 11)
- A summary of the personal data we process about you, what we do with it, and who else we have shared it with. Download it any time from your privacy page.
- To correct it (s. 12)
- To have inaccurate or misleading data corrected, incomplete data completed, and out-of-date data updated. Most of this you can do yourself in your profile.
- To have it erased (s. 12)
- To have your personal data deleted. Deleting your account from your privacy page closes it at once and erases it 30 days later, so you can change your mind. Some records we must keep — see section 7.
- To withdraw consent (s. 6)
- To withdraw consent at any time, as easily as you gave it. We keep a record of every consent you give and every one you withdraw — including which version of this notice was on screen at the time — so you can ask us exactly what you agreed to and when. Marketing email can be stopped from the link in any email we send or from your privacy page, and analytics from Cookie settings. Withdrawing does not undo what was lawfully done beforehand, and may mean we can no longer provide part of the service.
- To complain (s. 13)
- To raise a grievance with us and get an answer — see section 9.
- To nominate someone (s. 14)
- To nominate another person to exercise these rights on your behalf if you die or become unable to act for yourself. Name them on your privacy page. When a nominee contacts us, we ask for proof of the death or incapacity, and of who they are, before acting.
We will answer within 30 working days. If a request is complex enough to need longer, we will tell you why and when to expect an answer.
Your duties
Section 15 of the Act also asks something of you: give us accurate information, do not impersonate someone else, and do not file false or frivolous grievances. Certificates we issue rest on the accuracy of what you tell us.
7. How long we keep things
We keep personal data only while it serves the purpose you gave it for, or while the law requires us to hold it — whichever is longer. Our schedule is:
| What | Kept for | Why that long |
|---|---|---|
| Your account and profile | While your account is open. When you delete it, it closes at once and is erased 30 days later | The 30 days let you change your mind about deleting it. |
| Course and internship progress | 3 years after completion | So a certificate can be verified if an employer or university asks. |
| Certificates issued — the name on it, what was completed, and the dates | 8 years, even if you delete your account | An academic credential has to remain verifiable well after it is earned — see the note on public verification in section 3. Ask us if you would rather have a certificate revoked and deleted. |
| Mentor KYC documents | 8 years after the mentor leaves | Statutory record-keeping for identity verification and payments. |
| Payment and accounting records | 8 years | Required by tax and company law. |
| Unsuccessful applications and CVs | 1 year after the decision | To handle a query or a re-application, then no longer needed. |
| Contact and enquiry forms | 2 years | To follow up on an enquiry and keep a record of what we told you. |
| Support tickets, and anything attached to them | 3 years after the ticket is closed | So a later query about the same problem — a refund, a certificate correction — can be answered against what was actually agreed. |
| Newsletter subscription | Until you unsubscribe, then 30 days. A sign-up that is never confirmed: 30 days | Consent is what makes it lawful; withdrawing it ends the purpose. |
| IP addresses on public forms | 90 days | Long enough to investigate abuse, no longer. |
| Sign-in records, our server’s access logs (IP address, page requested, browser), and our log of staff access to personal documents | 1 year (sign-in records and the staff-access log: 13 months) | The Data Protection Rules require security logs to be kept for a year, so that misuse can be detected and investigated. |
| Your nominee | While your account is open | So they can act for you if they need to. |
| Our record of your consents and of requests you make under this notice | 3 years after the data they relate to is deleted | So we can show that we handled your data lawfully, if we are ever asked. |
Where we are required to keep something you have asked us to delete — a tax record, for example — we keep only that record, and only for as long as the law requires.
8. How we protect it
Concretely, and without overstating it:
- The site is served over HTTPS, with HTTP Strict Transport Security.
- Passwords are stored as one-way hashes and cannot be read by anyone, including us.
- Identity documents, education certificates, CVs and internship reports are held in private storage under unguessable paths, separate from public files, and are released only after we check who is asking.
- Aadhaar and PAN numbers are encrypted in our database, with the key held separately from it. Staff see them masked to the last four digits; only staff who verify identity can see a full number, and each such view is logged.
- Every time a member of staff or a mentor opens someone else’s document, it is logged. Access to the administrative interface is restricted to staff accounts.
- Deleted mentors' documents move to a separate archive with a retention clock, and are destroyed when it expires.
No system is perfectly secure. If a breach occurs that affects your personal data, we will notify you and the Data Protection Board of India as section 8(6) of the Act requires.
9. Questions and grievances
Data-protection questions and grievances are handled by our Grievance Officer.
- Email: codemetrix1@gmail.com
- Phone:
- Post: CodeMetrix, Patia, Bhubaneswar
- Online: raise a request under “Privacy and your data” in Help & Support, which gives you a reference number and a record of our reply
Tell us what happened and what you would like done. We will acknowledge you and answer within 30 working days.
If we do not resolve it, you may complain to the Data Protection Board of India. You are entitled to go to the Board whether or not you come to us first — but we would rather have the chance to put it right.
10. Changes to this notice
When we change how we handle personal data, we change this notice and raise its version number. The current version and its effective date are at the top of this page, and every version is kept so it can be shown later what a notice said at a given time.
For a change that materially affects you — a new purpose, a new recipient, a longer retention period — we will tell you directly rather than relying on you to re-read this page: the next time you sign in, we show you what changed and ask you to confirm.
11. Languages
This notice is published in English. Rule 3 of the Digital Personal Data Protection Rules, 2025 requires it also to be available in each language listed in the Eighth Schedule to the Constitution, and those translations are being prepared. If you would like this notice in another language before then, write to codemetrix1@gmail.com and we will arrange it.