Manch is designed to support privacy-conscious education delivery, tenant separation, and responsible data handling. We do not sell learner personal data as a business model. We process information to operate, secure, support, and improve the platform, subject to this Policy, applicable law, and the configuration of the relevant services.
01.Scope & Data Protection Framework
This Privacy Policy applies to personal data processed through Manch, including its academy storefronts, learner and instructor dashboards, administrative tools, course delivery features, payment integrations, and related services.
In this Policy, “Manch,” “we,” “us,” and “our” refer to the Manch platform operated by Nausha Technologies. “Academy” or “Tenant” means an educator, coaching centre, institution, or other customer using Manch to deliver educational services. “Learner” means a person who accesses an academy's courses or learning services.
We seek to handle personal data responsibly and in accordance with applicable Indian law, including relevant provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable rules, to the extent in force and applicable to the relevant processing activity.
This Policy is not a certification or blanket declaration of statutory compliance. Applicable obligations and commencement dates may depend on the relevant legal provisions, notifications, and the nature of the service.
02.Data Fiduciary and Data Processor Roles
Responsibility for personal data depends on who determines the purpose and means of a particular processing activity:
An academy generally determines how it operates its educational services and why it collects learner information—for example, for admissions, enrolments, attendance, assessments, course communications, and learner support.
Where the academy determines those purposes and means, it may act as the Data Fiduciary under the DPDP Act or as the relevant controller under other applicable privacy laws. The academy is responsible for its own legal obligations, including providing appropriate notices, establishing a valid basis for processing, managing learner requests, and configuring optional services appropriately.
Manch processes learner information to provide and maintain the platform, host academy storefronts, authenticate users, deliver course content, maintain records, provide support, and implement security controls.
For processing carried out on an academy's documented instructions, Manch may act as a Data Processor or equivalent service provider. However, Manch may act independently as a Data Fiduciary or controller for certain activities where it determines the purposes and means—such as account administration, platform security, billing, legal compliance, and handling service grievances.
Manch does not use learner records to build a marketplace for cross-selling competing academies' courses. Where a third-party integration or optional feature is enabled, its separate processing practices may also apply.
03.Categories of Personal Data
The information processed depends on the features used, the academy's configuration, and the information provided by users:
A. Academy and Administrative Account Data
- Name, business email address, phone number, and account credentials.
- Academy or business name, account settings, and custom-domain configuration.
- Subscription plan, invoices, billing records, support requests, and administrative activity.
- Authentication information, such as OTP verification status, where enabled.
If an academy configures its own payment gateway credentials, Manch may process the relevant gateway identifiers and encrypted credential values needed to enable that integration. The gateway's public Key ID is distinct from its secret key. Credentials should not be included in support messages.
B. Learner, Course and Classroom Data
- Learner name, phone number, and email address.
- Password hashes and authentication/session records.
- Course enrolments, lesson progress, completion records, and assessment submissions.
- Batch attendance, instructor interactions, and course-related communications.
- AI tutor conversations or prompts submitted through an enabled AI feature.
- Certificates, course-related documents, and other records generated through the platform.
Learners should contact the relevant academy for questions about information the academy collects for its own educational purposes. Manch may assist the academy in responding to such requests where the information is held through Manch.
C. Technical, Device and Security Data
We may process technical information needed to operate and secure the service, including IP address, browser user-agent, operating system information, session identifiers, access timestamps, diagnostic logs, and streaming activity.
Where single-session or anti-sharing controls are implemented, session and device-related signals may be used to enforce those controls. We do not represent this information as a unique or infallible identification of a physical device.
D. Payment and Settlement Information
- Bring Your Own Gateway (BYOG): The academy connects its own payment gateway account. Payments are processed by the academy's gateway provider. Manch processes transaction references, order status, and enrollment mappings.
- Razorpay Route: Where Route is used through Manch's setup, relevant order, transfer, settlement, refund, dispute, and linked-account information may be processed to facilitate payments to the academy.
- Bank Account Information: Where required for linked-account onboarding, bank details are transmitted to the payment provider. Manch retains selected account identifiers and masked bank details rather than intentionally storing the full bank account number in its application database.
E. Information from Third-Party and Optional Features
If an academy enables SMS, WhatsApp, AI, live-class, analytics, or other integrations, relevant information may be sent to the provider operating that feature. Academies should review the relevant provider's terms and privacy documentation before enabling a feature that involves learner data.
04.Purposes and Grounds for Processing
We process personal data only for purposes relevant to providing, securing, administering, or supporting the platform, subject to applicable law:
- Creating and maintaining academy storefronts, dashboards, and enrolments.
- Authenticating users, managing sessions, and protecting accounts.
- Delivering videos, course materials, assessments, and attendance tracking.
- Supporting payment processing, linked accounts, refunds, disputes, and settlements.
- Sending service communications: OTPs, account notices, and batch reminders.
- Operating AI tutor assistance features when enabled by the academy.
- Detecting misuse, investigating security incidents, and enforcing platform policies.
- Meeting applicable legal, regulatory, tax, accounting, and compliance requirements.
05.Video Watermarking and Anti-Piracy
Manch may use technical measures intended to discourage unauthorised copying or redistribution of academy course content. Where dynamic video watermarking is enabled, a video player may display a visible or semi-transparent overlay containing selected account or session information, such as a learner identifier, a masked contact identifier, an IP address, or a timestamp.
Watermarking is a deterrence and investigation measure; it does not guarantee that screen recording, copying, or redistribution can be prevented. An overlay may also be captured in a recording made by another device.
06.Data Use, Monetization and Tenant Control
No Sale of Learner Personal Data
Manch does not sell learner personal data, phone numbers, email addresses, enrolment records, or learning histories to data brokers or competing academies as a business model. We disclose information only to infrastructure partners, payment processors, and communications providers when reasonably necessary to operate requested features or comply with law.
No Cross-Selling of Competing Academies
Manch is designed to support each academy's own educational service rather than operate a marketplace that cross-promotes competing academies to its enrolled learners. We do not use one academy's learner database to promote another academy's courses as a standard platform practice.
Advertising and Analytics
Manch does not intentionally monetise learner records through advertising networks. If an academy adds third-party analytics, advertising, or marketing tools to its storefront, those tools collect information under their own configuration. The academy is responsible for assessing the legality and transparency of those additions.
Academy Access, Control and Export
Academies can access and manage the learner information made available through their authorised dashboards and supported export tools. An academy's ability to export data does not remove its obligations to protect learner information. Manch may retain certain records where required for security, dispute resolution, billing, fraud prevention, or legal compliance.
07.Security, Encryption and Tenant Isolation
Manch uses technical and organisational safeguards intended to protect information against unauthorised access, loss, misuse, alteration, or disclosure:
Manch is designed as a multi-tenant platform. Authorised access to academy data is restricted according to tenant and user permissions. Tenant-scoped application logic and access controls are intended to prevent one academy from accessing another academy's private records.
Manch uses encryption and secret-management mechanisms. For academy payment gateway integrations, secret credentials are encrypted at rest and decrypted only when executing gateway requests. Secret values are never exposed in dashboard API responses or application logs.
Where supported, Manch uses signed, time-limited playback tokens, single-session heartbeats, and DRM mechanisms to restrict unauthorized video access and deter concurrent credential sharing.
Manch relies on SOC-2 compliant third-party infrastructure for database hosting, Cloudflare R2 file storage, and payment processing. If a security incident involving personal data occurs, we assess and handle it in accordance with applicable legal obligations.
08.Data Retention and Account Deletion
We retain personal data for the period reasonably necessary for the purposes described in this Policy, subject to the academy's instructions, service configuration, applicable law, security requirements, and legitimate recordkeeping needs.
During an active subscription or permitted sandbox period, academy and learner records remain available to support course delivery, progress tracking, assessments, and certifications.
An academy may request account closure or deletion through the dashboard or by contacting us. Where appropriate, a request may trigger a recovery period of up to 30 days before eligible data is scheduled for deletion. Some records may remain in backups, logs, or archives where retention is required by law.
Manch may operate inactivity-based cleanup for free sandbox environments after 90 consecutive calendar days without activity, following prior reminder notices.
If an academy is suspended or has an expired add-on, access to features may be restricted. Where a retention or quarantine period applies (e.g. 30 days storage grace + 15 days quarantine), we follow the relevant service terms before permanent deletion.
Payment transactions, invoices, refunds, chargebacks, settlement references, certificates, and audit logs are retained for statutory tax, accounting, dispute-resolution, and legal compliance purposes.
09.Learner and Tenant Data Rights
Depending on applicable law, individuals may have rights concerning their personal data, including requesting information about processing, seeking correction of inaccurate information, requesting erasure where applicable, withdrawing consent, and raising a grievance:
Learners should generally contact their academy first for requests relating to enrolment, attendance, assessments, course progress, and other information the academy controls. The academy can coordinate with Manch where technical assistance is needed. Learners may contact Manch directly if their concern relates to Manch's own processing, platform security, or a request the academy was unable to resolve.
Academy administrators may request access to, correction of, or export of supported account and learner records through available tools or by contacting us. Requests remain subject to identity and authority verification, other individuals' rights, and applicable retention obligations.
10.Privacy Contact and Grievance Redressal
For privacy questions, personal-data requests, security concerns, or grievances about Manch's processing, contact:
Please include enough information to identify the relevant account or academy and describe the concern. Do not send passwords, full payment-card details, gateway secrets, or other sensitive credentials by email or WhatsApp. We will review privacy-related requests and grievances and respond in accordance with applicable law.
Changes to This Policy
We may update this Policy to reflect changes in Manch's features, infrastructure, service providers, or legal requirements. The updated version will be published on the relevant Manch website or legal page with a revised effective date.