Your data, handled with care.

The Institute of Higher and Digital Learning ("IHDL," "we," "us," or "our") operates a learning and professional-networking platform available as a website (ihdl.org, scholarnet.in, chintan.live) and as a mobile application (the "Service"). The Service is provided by the organisation operating the IHDL platform.

This Privacy Policy describes how we collect, use, disclose, and protect personal information when you create an account, use the Service, or interact with its features — including courses, jobs, mentorship, chat, video interviews, and payments. It applies to all user types: students, faculty, mentors, companies, skill-development centres, private institutes, government departments, NGOs, universities, colleges, and platform administrators.

By creating an account or using the Service, you agree to the practices described here. If you do not agree, do not use the Service.

The organisation operating the IHDL platform is the data controller for the personal information you submit through the Service.

Where a third party processes data on our behalf (for example, payment or video-conferencing providers), they act as processors under our instructions, and we describe them in Section 7.

Information you give us directly

We collect the information you provide when you register and use the Service. The fields vary by account type.

Information generated as you use the Service

• Learning activity: courses enrolled in, chapter and exam progress, mock tests and final exams attempted, certificates earned, assignments submitted.
• Professional activity: job postings, job applications, saved jobs, interviews, offer letters, technical assignments, candidate shortlists and pipeline stages, AI candidate scores.
• Social and communication: posts, comments, likes, media, chat messages and reactions, friend connections, mentor booking requests, mentor sessions, study plans, progress reports, reviews.
• Financial: payment records for mentor bookings, subscriptions, course purchases, and creator payouts (bank and UPI details where you elect to receive payouts).

Information collected automatically

• Authentication tokens and session identifiers (see Section 6).
• Technical logs: approximate device type, browser/ app version, IP address, access times, and request metadata used for security, rate-limiting, and troubleshooting.
• Profile and uploaded media stored against your account.

• To provide the Service: create and manage your account, deliver courses and exams, process applications and bookings, and connect you with mentors, employers, and peers.
• To verify identity and eligibility: approve faculty, mentors, colleges, and institutional accounts, and confirm you meet the requirements for a role.
• To communicate: send service notifications, security alerts, mentor and job updates, and administrative messages.
• To process payments: charge and verify payments for bookings, subscriptions, and courses, and process payouts to creators and mentors.
• To secure the platform: authenticate requests, enforce rate limits, detect and prevent fraud, abuse, and unauthorised access.
• To improve and develop: analyse aggregated, de-identified usage to improve features, recommendations, and matching.
• To comply with law: meet legal obligations and respond to lawful requests from authorities.

We process your information on the legal bases of providing a service you requested, fulfilling our contract with you, complying with legal obligations, and our legitimate interests in operating and securing the Service.

How we store passwords

Your password is never stored in plain text. When you set or reset a password, we hash it using BCrypt, a one-way adaptive hashing function, before storing it. We can only verify a password by comparing a new entry to the stored hash — we cannot retrieve or reverse your original password.

How we protect data

• All traffic between the app/website and our servers is encrypted with HTTPS / TLS.
• Authentication uses signed JSON Web Tokens (JWT) with a limited lifetime; sensitive session detail is held in an HttpOnly cookie that JavaScript cannot read.
• Access to features and data is gated by role-based permissions so a user can only reach what their account type permits.
• We apply automated rate limiting to authentication endpoints to resist brute-force attacks.
• Databases and file storage are access-controlled and run on infrastructure we manage.

The Service uses essential authentication mechanisms only. We do not use advertising or cross-site tracking cookies.

• Session token (essential): a signed JWT stored in an HttpOnly, Secure cookie so you stay signed in across requests. It expires automatically and cannot be read by scripts on the page.
• Local storage (app): the app may keep a short-lived reference to your sign-in so it can show your signed-in state and attach the token to API requests. This stays on your device and is cleared when you log out.
• Preferences: lightweight settings such as your colour-theme choice, stored locally on your device.

Because these mechanisms are strictly necessary for the Service to function, they are not optional; you can clear them at any time through your browser or device settings, which will sign you out.

We rely on the following third parties to deliver specific features. Each has its own privacy policy governing how it handles data, and we link to it where available.

Payment processing is handled by Razorpay under its terms; we do not store full card numbers. When you use a third-party feature, that provider may set its own cookies or collect data according to its own policy.

We keep your information for as long as your account is active and for a reasonable period afterward to meet legal, accounting, or reporting requirements.

• Active accounts: retained while you use the Service.
• After deletion: we remove or anonymise your personal data, except where we must retain records to comply with law, resolve disputes, or enforce agreements (for example, financial records of payouts).
• Verification documents: kept for the duration needed to verify and audit eligibility, then removed on a defined schedule.

Security and audit logs are retained for a limited period consistent with security best practice, then deleted.

Depending on where you live, you may have the following rights over your personal information:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate or incomplete information.
• Deletion: ask us to delete your account and associated data (see Section 10).
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent: withdraw consent for processing that relies on it; this may limit some features.
• Object or restrict: object to, or ask us to restrict, certain processing.

To exercise any right, contact us through the support channel provided in the Service. We respond within the period required by applicable law and may need to verify your identity before acting on a request.

You can request deletion of your account and personal data at any time. You can do this in two ways:

1. In the app or website: from your account settings, use the data-deletion / account-removal option, where available.
2. By request: contact us through the Service's support channel from the email registered on your account, asking us to delete your account.

When we process a deletion request, we remove your profile and personal data from the active Service. We may retain limited records where required by law or to finalise outstanding transactions, and we will tell you if that applies.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. The Service includes professional, employment, and mentorship content (including a mental-health mentorship category) that is intended for older users.

If you believe a child under 13 has registered or provided personal data, contact us and we will delete that information. Where local law sets a higher age of digital consent, that age applies.

Your information may be processed in countries other than your own, including where our servers or third-party providers are located. Where this happens, we apply safeguards appropriate to the transfer, such as standard contractual clauses or equivalent measures, to protect your data in line with this policy.

We may update this Privacy Policy as the Service evolves. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the Service. Continued use after a change takes effect means you accept the updated policy.