Privacy Policy

Last updated 10 July 2026

This policy explains what personal data Committed Achievers Academy (a sole proprietorship of Rajalakshmi Ramesh) collects when you use committedachievers.com, why we collect it, and who else sees it. We are the data fiduciary for that data.

1. The disclosure that matters most

2. What we collect

You give us

• Account data, name, email address, the level and subjects you are preparing for, and your age declaration.
• Parental consent confirmation, where the student is under 18.
• Answer scripts and uploads, images or PDFs of your handwritten answers, and anything written in them.
• Messages you send us, including questions asked of the in-app assistant.

We generate

• Performance data - MCQ attempts and scores, papers attempted, marks and comments awarded by the AI evaluator.
• Entitlements, which subjects you have paid for, and when.

Collected automatically

• A session cookie so you stay logged in. It is strictly necessary and cannot be turned off while you use the Platform.
• Basic server logs - IP address, browser type, pages requested, timestamps, kept for security and debugging.

We never collect

Card numbers, CVV, UPI PINs or net-banking credentials. Those go straight to Razorpay. We only ever see a payment identifier and whether the payment succeeded.

3. Why we use it

• To give you access to the subjects you paid for, and to evaluate what you submit.
• To show you your own performance history.
• To take payment and to keep the records that tax and accounting law requires of us.
• To answer your questions and handle grievances.
• To keep the Platform secure and to fix faults.
• To improve the Platform using anonymised, aggregated data that does not identify you.

We do not sell your personal data. We do not use it for advertising, and we do not track you across other websites.

4. Who we share it with

We also disclose data where the law compels us to, or to establish or defend a legal claim. We do not otherwise share it with anyone.

5. Students under 18

A candidate for the CA Foundation is often 17. The Digital Personal Data Protection Act, 2023 requires verifiable parental consent before a child's personal data is processed, and forbids behavioural tracking and targeted advertising directed at children.

We do not conduct behavioural tracking or targeted advertising of any user, child or adult.

How we obtain and verify parental consent. At registration every student declares a date of birth. If that makes the student a minor, we ask for the parent or guardian's name and their own email address, which must differ from the student's. We then:

• Send the consent request to the guardian's own inbox, not to the student. The student cannot complete consent on the guardian's behalf, because they do not control that mailbox.
• Restrict the account until the guardian clicks through and confirms. Until then the student may use only the free chapters. They cannot upload an answer script, the only processing that sends personal data outside India - and they cannot buy a subject.
• Require any payment to be made by the guardian, from their own payment instrument. A card, bank account or UPI ID belongs to an adult, which is itself a check that the consenting person is one.
• Record the evidence, the guardian's name and email, the exact time they confirmed, and the network address they confirmed from.

The contract is with the parent or guardian, in their name, on the student's behalf.

We want to be exact about the limits of this. Out-of-band email confirmation plus an adult payment instrument is a genuine verification step, and far stronger than a box the student ticks themselves. It is not the identity-token method (for example, DigiLocker) that the DPDP Rules contemplate for the strongest form of verifiable consent. We will adopt that method as the Rules are brought into force and the mechanism becomes available to a business of our size.

A parent or guardian may write to us at any time to see, correct, or delete their child's data, or to withdraw consent, and we will act on it.

6. How long we keep it

• Uploaded answer scripts and evaluation reports, while your account is open, so you can revisit them. Deleted within 90 days of account closure.
• Account and performance data, until you close your account.
• Payment and invoice records, for eight years, as tax law requires. We cannot delete these on request.
• Server logs, up to 12 months.

7. Your rights

Under the DPDP Act you may:

• ask what personal data of yours we hold, and how we have processed it;
• have inaccurate or incomplete data corrected, and have data erased where we no longer need it;
• withdraw consent, though we may then be unable to give you the service;
• nominate another person to exercise these rights if you die or become incapacitated;
• complain to the Data Protection Board of India if we do not resolve your grievance.

To exercise any of these, write to help@committedachievers.com. We respond within 30 days.

8. Security

Traffic is encrypted in transit over HTTPS. Passwords are stored hashed, never in plain text. Access to the production database is restricted. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data we will notify you and the Data Protection Board as the law requires.

9. Changes

We will update this page when our practice changes, particularly if we change AI providers, and revise the date at the top. Material changes will be notified by email or in the Platform.

10. Contact and grievances