Legal

Privacy Policy

Last updated: 27 October 2026

This Privacy Policy (this “Policy”) sets out how Tau Square Academy, a sole proprietorship of Niranjana Jayaraman registered in Secunderabad, Telangana, India (GSTIN 36AFGPJ8624L1Z2) (“Tau Square Academy”, “we”, “us” or “our”), acting as a Data Fiduciary, collects, uses, Processes, stores, discloses and otherwise handles Personal Data in connection with the Services.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made thereunder, and, where applicable, the General Data Protection Regulation (EU) 2016/679. By accessing or using the Services, you acknowledge that you have read and understood this Policy and, where Processing is based on consent, you consent to the Processing of your Personal Data as described herein.

Capitalised terms are defined in Section 1.

1. Definitions

In this Policy, unless the context otherwise requires, the following capitalised terms shall have the meanings set out below:

→
“Applicable Law” means the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made thereunder, the Information Technology Act, 2000 and the rules made thereunder, and, to the extent applicable to you, the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), each as amended from time to time.
→
“Personal Data” means any data about an individual who is identifiable by or in relation to such data.
→
“Data Principal”, “you” or “your” means the individual to whom the Personal Data relates, including a visitor, lead, learner or customer.
→
“Data Fiduciary” means Tau Square Academy, which alone or in conjunction with others determines the purpose and means of Processing of Personal Data.
→
“Data Processor” means any person who Processes Personal Data on behalf of the Data Fiduciary.
→
“Processing” means a wholly or partly automated operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
→
“Services” means the website at tausquareacademy.com, the Tau Square Academy mobile application, the WhatsApp messaging service operated by us, and all courses, lessons, programmes, mentoring and related services made available through any of them.
→
“Board” means the Data Protection Board of India established under the DPDP Act.

2. Scope and Applicability

This Policy applies to all Personal Data Processed by us in connection with the Services, whether collected online, through the mobile application, through WhatsApp or by email. It does not apply to third-party websites, platforms or services that may be linked to or embedded in the Services, each of which is governed by its own privacy policy.

Where you provide Personal Data about another individual (for example, when sharing the Services with a colleague), you represent and warrant that you are authorised to do so.

3. Personal Data We Collect

3.1 Personal Data you provide to us

→
Registration and lead data: when you sign up to access free content, your name, email address, WhatsApp number, whether you are a medical student or a researcher and, if you are a medical student, your year of study.
→
Account data: when you create or access an account, your email address and name. If you choose to sign in with Google, we receive your name and email address from Google. If you set a password in the mobile application, it is stored by our authentication provider in hashed form and is not accessible to us.
→
Course and learning data: your feedback and ratings, the questions and context you submit through Doubt Tokens, the phases you complete, your token balance and, where applicable, your cohort details.
→
Communications data: the messages you send to us on WhatsApp, including your answers to our automated questions (such as your research goals, stage of study, timeline and prior experience), the date and time of any call you book with us, and any correspondence you send to us by email.
→
Transaction data: the programme or add-on purchased, the amount paid and the order and payment identifiers returned to us by our payment processor. We do not receive, store or have access to your card number, UPI credentials or bank account details.

3.2 Personal Data collected automatically

→
Lesson engagement data: the lessons you open, how far into each lesson you watch, whether you complete it and when, linked to the email address you provided or to your account.
→
Technical and device data: your IP address, browser type, device information and access times, which are recorded in server logs by our hosting provider. Where you book a call directly through the website, we also record the IP address used, solely to prevent fraudulent or abusive bookings.
→
Account security data: when you sign in to a paid programme, an identifier stored on your device, characteristics of your device and browser, your IP address and the approximate location derived from it (city, region and country), and the times at which you sign in and use your account.
→
Acceptance records: when you accept our Terms of Use and policies, the version you accepted, a cryptographic fingerprint of its text, the statement you agreed to, the date and time, your IP address and the approximate location derived from it, your browser, and, for a purchase, the order identifier.
→
Cookies and similar technologies: as described in Section 9 of this Policy.

3.3 Personal Data received from third parties

We may receive Personal Data from Google (where you sign in with Google), from Meta Platforms (in connection with the delivery of WhatsApp messages) and from our payment processor (confirmation of the status of a payment).

4. Purposes of Processing

We Process Personal Data only for specified, clear and lawful purposes, namely:

•
to register you, provide you with access to the Services and administer your account;
•
to process payments, confirm enrolment and grant, extend or record access to programmes and add-ons;
•
to deliver course content, record your progress, unlock subsequent phases and provide mentoring and responses to Doubt Tokens;
•
to communicate with you, including by WhatsApp and email, regarding your enquiry, your account, a call you have booked or content you have requested;
•
to analyse how the Services are used, including where learners stop or experience difficulty, in order to maintain, evaluate and improve the Services;
•
to measure the effectiveness of our advertising and, where you have not objected, to send you information about our programmes;
•
to secure the Services and accounts, to enforce device and session limits, to verify sign-ins, and to detect, prevent and respond to account sharing, fraud, abuse, security incidents and violations of our Terms of Use;
•
to keep a tamper-evident record of your acceptance of our Terms of Use and policies, as evidence of our agreement with you; and
•
to comply with Applicable Law, respond to lawful requests of public authorities and establish, exercise or defend legal claims.

5. Lawful Basis for Processing

We Process your Personal Data on the basis of your consent, given when you provide it to us for the purposes stated at the point of collection, and for such legitimate uses as are permitted under Section 7 of the DPDP Act, including where you have voluntarily provided your Personal Data for a specified purpose and have not indicated that you do not consent to its use, and where Processing is necessary for compliance with any law.

Where the GDPR or the UK GDPR applies to you, the lawful bases we rely on for each purpose are set out in Section 21.

7. Disclosure of Personal Data

We do not sell, rent or trade your Personal Data. We disclose Personal Data only as set out below, and in each case only to the extent necessary for the relevant purpose:

7.1 Data Processors

We engage the following service providers, who Process Personal Data on our behalf and in accordance with our instructions:

→
Supabase: database hosting and user authentication, including the delivery of sign-in codes by email.
→
Vercel: hosting of the website and of the server functions that power it, including server logs.
→
Razorpay: processing of payments, under its own PCI-DSS compliant security controls.
→
Resend: delivery of the emails we send you, such as your welcome email, tax invoices and credit notes.
→
Meta Platforms: delivery of messages through the WhatsApp Business Platform, governed by the WhatsApp Privacy Policy.

7.2 Third-party services you interact with

→
Meta Pixel: on our public pages only, not on pages available to signed-in learners, never for visitors in Europe, and only after you accept advertising cookies on our cookie banner, we use the Meta Pixel to measure how visitors find us and how our advertising performs. It uses cookies and shares interaction events (such as page views, sign-ups and call bookings) with Meta under Meta’s Privacy Policy.
→
YouTube: course lessons are embedded from YouTube in privacy-enhanced mode. When you play a lesson, Google may collect information in accordance with Google’s Privacy Policy.
→
Google: if you choose to sign in with Google, and for the delivery of web fonts used on the website.

7.3 Legal and other disclosures

→
where required by Applicable Law, regulation, legal process or a lawful request of a court, tribunal, regulator or other public authority;
→
where necessary to protect the rights, property or safety of Tau Square Academy, our learners or others, or to prevent fraud;
→
in connection with any reorganisation, transfer or sale of all or part of our business, subject to the recipient being bound by obligations no less protective than this Policy; and
→
with your consent or at your direction.

8. Cross-Border Transfers

Our Data Processors may store or Process Personal Data on servers located outside India. Any such transfer is made in accordance with Section 16 of the DPDP Act and shall not be made to any country or territory restricted by notification of the Central Government. Where the GDPR applies, we rely on appropriate safeguards recognised under the GDPR for transfers of Personal Data outside the European Economic Area.

9. Cookies and Similar Technologies

We use the following technologies:

→
Strictly necessary storage: your browser’s local storage is used to keep you signed in, to remember your progress through free lessons and to remember that you have completed a form. These are required for the Services to function.
→
Advertising measurement: with your consent, given by accepting advertising cookies on our cookie banner, the Meta Pixel sets cookies on our public pages, as described in Section 7.2. It is not loaded for visitors in Europe, and it is not loaded at all if you choose necessary cookies only. You may change your choice at any time through “Cookie settings” at the foot of every public page.
→
Embedded content: the YouTube player may set cookies when you play a lesson.

You may block or delete cookies and local storage through your browser settings. Blocking strictly necessary storage may prevent parts of the Services from working.

10. Data Retention

We retain Personal Data only for so long as is reasonably necessary to fulfil the purposes for which it was collected, or as required under Applicable Law. Without limitation:

→
account, course and learning data are retained for so long as your account remains active, and are erased upon a verified request for deletion in accordance with Section 12;
→
registration and lead data, lesson engagement data and communications data are retained until you withdraw your consent or request erasure, or until they are no longer necessary for the purposes stated in this Policy, whichever is earlier;
→
transaction data are retained for such period as is required under applicable tax, accounting and other laws;
→
account security data are retained for so long as your account remains active and for up to one year after access ends, so that we can enforce our Terms and establish, exercise or defend legal claims;
→
acceptance records are retained for so long as your account remains active and thereafter for so long as the tax records of your purchases are retained, as evidence of our agreement with you; acceptance records made when you sign up for free content are retained for so long as your registration data; and
→
server logs are retained by our hosting provider in accordance with its standard retention periods.

Upon the expiry of the applicable retention period, we shall erase the Personal Data, or cause it to be erased by our Data Processors, unless its retention is required for compliance with any law.

11. Your Rights

Subject to Applicable Law, you have the right:

→
to obtain a summary of the Personal Data we Process about you, the Processing activities undertaken and the identities of those with whom it has been shared;
→
to the correction, completion and updating of inaccurate or incomplete Personal Data;
→
to the erasure of Personal Data that is no longer necessary for the purpose for which it was Processed, unless its retention is required by law;
→
to withdraw your consent at any time, as described in Section 6;
→
to have readily available means of grievance redressal, as described in Section 19; and
→
to nominate another individual to exercise your rights in the event of your death or incapacity.

Where the GDPR applies to you, you additionally have the right to data portability, the right to object to or restrict certain Processing, and the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, write to us at privacy@tausquareacademy.com from the email address associated with your Personal Data. We may need to verify your identity before acting on a request, and we shall respond within the period prescribed under Applicable Law.

In exercising your rights, you are required under Section 15 of the DPDP Act to comply with Applicable Law, to provide information that is authentic, not to impersonate another person and not to register false or frivolous grievances.

12. Account Deletion

You may permanently delete your Tau Square Academy account and its associated Personal Data at any time, by either of the following means:

→
In the mobile application: open Account, then Danger Zone, then Delete My Account. Deletion is immediate and permanent.
→
By email: send a request to privacy@tausquareacademy.com from the email address on your account, and we shall delete your account within seven (7) days.

Deletion removes your sign-in credentials and profile data. Records that we are required by law to retain, such as tax records of past purchases, may be retained for the period mandated by law, and records of your acceptance of our Terms for a purchase are retained for the period stated in Section 10. Where we no longer need the personal details in an acceptance record, we remove them and keep only its fingerprint.

13. Children’s Personal Data

The Services are intended for individuals who have attained the age of eighteen (18) years. An individual below that age may use the Services only with the verifiable consent of a parent or lawful guardian. We do not knowingly Process the Personal Data of a child without such consent, and we do not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. If you believe that we have collected the Personal Data of a child without such consent, please contact us and we shall erase it without delay.

14. Security Safeguards

We implement reasonable security safeguards, including technical and organisational measures, to protect Personal Data in our possession or under our control against unauthorised access, use, disclosure, alteration and loss, and to prevent personal data breaches. These include encryption of data in transit, access controls that restrict each user to their own records, server-side handling of payment credentials, and the security programmes of our Data Processors.

No method of transmission over the internet or of electronic storage is completely secure. While we strive to protect your Personal Data, we cannot guarantee its absolute security.

15. Personal Data Breach

In the event of a personal data breach, we shall take appropriate measures to contain and remedy it and shall notify the Board and each affected Data Principal in the form and manner prescribed under Applicable Law.

16. WhatsApp Communications

Our WhatsApp service operates on the WhatsApp Business Platform provided by Meta Platforms. When you message us, your message and phone number are Processed by Meta in accordance with the WhatsApp Privacy Policy. We message you on WhatsApp only in response to your contact or with information you have requested, including where you have provided your WhatsApp number to access free content. You may stop receiving messages from us at any time by replying “STOP”.

17. Third-Party Links and Embedded Content

The Services may contain links to, or content embedded from, third-party websites and services, including YouTube, WhatsApp and social media platforms. We are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies.

18. Changes to this Policy

We may amend this Policy from time to time. The revised Policy shall be posted on this page with an updated “Last updated” date. Where the changes are material, we shall take reasonable steps to notify you. Your continued use of the Services after the revised Policy takes effect shall constitute your acknowledgement of it.

19. Grievance Officer and Contact

If you have any question, concern or grievance regarding this Policy or the Processing of your Personal Data, or wish to exercise any of your rights, please contact our Grievance Officer:

J. Niranjana, Grievance Officer, Tau Square Academy

Email: jniranjana@tausquareacademy.com

Address: 37-116/5, Road Number 3, The Church of Living God, Neredmet, Secunderabad, Medchal Malkajgiri, Telangana 500056, India

We shall acknowledge your grievance within 48 hours and resolve it within one month of receipt, or within any shorter period prescribed under Applicable Law. If you are not satisfied with our response, you may, upon exhausting this grievance redressal mechanism, file a complaint with the Data Protection Board of India in accordance with the DPDP Act.

20. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Subject to any non-excludable rights you may have under the laws of your place of residence, any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Hyderabad, Telangana. Nothing in this Section limits your rights under the GDPR or the UK GDPR, including your right to complain to a supervisory authority and to bring proceedings in your country of residence.