Privacy Policy

1. Who is responsible for your data

Minds of Aspirants, a an enterprise registered under the MSMED Act, 2006 trading as Minds of Aspirants, at New No. 107, Old No. AB 9, Second Avenue Road, Anna Nagar, Chennai, Tamil Nadu 600040, is the data fiduciary for personal data collected through this site. In DPDP language, you are the data principal and we decide why and how your data is processed.

The person answerable for it is J. Sivarajarajendran, Founder, at support@cortexdesk.in. We name a person rather than a desk because a role address is not a person who can be held to an answer, and the Act asks for one who can.

2. The law this is written to

• The Information Technology Act 2000, s.43A, and the SPDI Rules 2011. In force today. They govern sensitive personal data — passwords, financial information, health — and require a grievance officer who answers within one month.
• The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified on 13 November 2025. The notice, consent and security provisions take effect on 13 May 2027. We are writing this policy to them now rather than waiting, because a notice written late is a notice written under pressure.
• The Consumer Protection (E-Commerce) Rules 2020, which is why the seller, the grievance officer and the redressal window are named on this site at all.

3. What we collect

Itemised, in the way the DPDP Act asks for — not a general phrase about usage data. This is the whole list.

Identity, from Clerk

Your name, your verified email address, your avatar if you have one, and the method you signed in with. Clerk holds your password and your sign-in sessions; we never see your password.

Billing details, when you buy

Your name, email address, telephone number and the Indian State you are in. The State is collected because a seller of an online service must record the place of supply of the order.

Minds of Aspirants is not registered under GST. No GST is charged, and the price shown is the whole price — the State is recorded so the order record is complete, and for nothing else.

Payment references only

An order reference, a payment reference, the amount, the status, and the method in words (“UPI”, “card”). We never see and never store a card number, a CVV, a UPI PIN or a bank credential. Those are typed into Razorpay’s own form and held by Razorpay; they do not reach our servers.

Learning records

Which lessons you completed and when, your drill answers and the marks they were given, the passages you highlighted, the notes you took on a video, your XP and your daily streak. If you sign in while reading the Constitution, the article you stopped at and any bookmarks you made in that book.

Lecture viewing, said plainly

Watching a lecture is measured, and it has to be, because the seat you bought allows a stated number of views per lecture. For every lecture you open we record:

• how many of your allowed views you have used;
• each playback session — when it began, which device and browser began it, and when it last checked in;
• a heartbeat every few seconds while the lecture is playing, and the coverage we compute from those heartbeats: how much of the lecture was actually watched;
• where you stopped, so the lecture can offer to resume.

The one-device rule is enforced from those sessions: starting a lecture on a second device ends the session on the first. Institute staff can see, for each student and each lecture, how many views were used and how much of the lecture was watched. If that is not something you are willing to have recorded, do not watch the lectures — there is no way to use them without it. Staff previews of a lecture are never counted and never tracked, so the institute’s own viewing does not appear in these figures.

Clips of a class in Chat

When Chat plays a few minutes of a recorded class under an answer, we record which minutes of which class it showed you, because that is what keeps anybody from rebuilding a whole lecture out of clips. When you press play we also record how many seconds you watched, how far into the clip you got, and whether you went to the part the clip marks as where your question is answered. The institute sees this as numbers of students, never by name, so we can tell whether the clips help. A clip is not a view: it never uses one of a lecture’s allowed views.

Mentoring

The mentor you chose, the time you asked for, what you wrote about what you would like to go over, the state of the request, and the meeting link the mentor gives. The mentor you asked sees all of it.

Technical data

Your IP address, your browser and your device, as our hosting and our video delivery record them in their own logs, and error reports when something on the site breaks.

How you use the site, only if you say yes

The first time you visit, a bar asks whether we may count how the site is used. Nothing below is collected before you answer, and you can change your answer at any time with Privacy choices at the foot of every page.

• If you accept: the pages you open, what you press on them, and recordings of the screen while you use the site, kept with a random identifier in a cookie. In a recording every word on the screen and everything you type is hidden, so a recording shows where you scrolled and pressed, never your name, an answer or a message. Checkout, your purchases, your account, the Inbox, Chat, mentoring, highlights, saved stories and the survey are never recorded. Signed in, the identifier is your account’s random sign-in id, never your name, email or telephone number.
• With a yes, PostHog also records your browser and device, and the country and city your connection points to.
• If you decline: nothing is sent and no cookie is set.

The institute’s own staff, mentors and bots are never counted.

4. Cookies and local storage

• Clerk’s session cookie — keeps you signed in. Strictly necessary; without it there is no account.
• The theme cookie — remembers whether you chose Day or Night. It is read on the server so the page does not flash the wrong colour before it paints.
• A Grid or List preference for the course catalogue, kept in your browser’s local storage and never sent to us.
• Your lecture player settings — speed, captions, volume and the data saver — kept in your browser’s local storage under moa.player.prefs, and not sent to us.
• A random identifier for this browser, kept under moa.player.device. This one is sent to us, with every lecture you start. It is how reloading a page is not counted as switching device, and it is what the institute sees when a lecture has been watched from more than one place. It is a random string we generate; it is not your name, your account or anything that identifies the machine itself, and clearing your site data replaces it with a new one.
• Your privacy choice, in the cookie moa-consent, for a year: whether you accepted or declined, so the bar does not ask on every page.
• PostHog’s cookie, only if you accepted: a random identifier and the current visit, so pages and recordings can be put together in order. Declining, or taking your answer back under Privacy choices, removes it.

There is no advertising cookie and no cross-site tracking cookie on this site. That is true today and it is a choice, not an oversight. If it ever changes, this page changes first.

5. Why we hold it, and on what basis

We use the data above to:

• give you the account, and the seat you paid for;
• mark your drills and answer your questions;
• enforce the per-lecture view allowance and the one-device rule, which is the only thing that makes a stated allowance mean anything;
• send the four emails an order produces;
• keep the order records a seller is required to keep;
• keep the site up, and investigate abuse of it;
• see which parts of the site students use and come back to, so we can improve them and build more of what helps. This is counted once a day from the data above, and, if you accept, from how pages are used (section 3, “How you use the site”). The institute sees it as numbers of students and as recordings with every word hidden, never by name. For the same purpose each question you ask in Chat is sorted by our AI provider into the part of the syllabus it is about; we keep only that and a gist of a few words with nothing personal in it, never the question itself in this count, and the institute sees what was asked about a part only once ten or more students have asked there. A question you delete leaves the count within a week.

The basis for most of it is the consent you give when you create the account and when you place an order. The rest rests on the certain legitimate uses the DPDP Act allows where you have given data voluntarily for a purpose you plainly expect, and on the statutory duty to keep records of a sale.

We do not train any model on your data. Where text is sent to our AI provider so a model can answer — your question, and the passage or the drill it concerns — we send what the answer needs and no more, and we do not send your name or your email with it. We do not sell personal data, and we do not use it for advertising.

6. Who else sees it

We run this site on other companies’ infrastructure. Each one below is a processor acting on our instructions, and each is named with what actually reaches it:

• Clerk — authentication. Your name, email address, avatar and sign-in events. Clerk, not we, holds your password.
• Convex — our database and file storage. Everything in section 3 that we store, stores there.
• Vercel — hosting. Request logs: IP address, the page requested, the browser.
• Bunny Stream — video delivery. The video requests your player makes and the address the signed link was issued to. No marks, no notes, no lesson text.
• OpenRouter — the AI Mentor, Chat and the current-affairs deep dives. The text of your question and the passage it is about. Not your name, not your email. When you press Internet on Chat, the question is sent with live web search. Once a week each Chat question is sent again, to sort it by the part of the syllabus it is about (section 5).
• Razorpay — payments. Your name, email, telephone number and the amount, plus the payment credentials you type into Razorpay’s form, which we never see.
• PostHog — analytics, on servers in the United States, and only if you accepted (section 3): the pages opened, what was pressed, recordings with every word hidden, your browser and device and the city your connection points to. Not your name, email or telephone number.
• Resend — transactional email. Your email address and the text of the four order messages.

That is the entire list. We do not share your data with an advertiser, a data broker or another coaching institute. We disclose it to a court, a regulator or the police only where the law requires it, and we will tell you when we are allowed to.

7. Data that leaves India

Some of the processors above store or process data on servers outside India. The DPDP Act permits transfer to any country the Central Government has not restricted by notification. If a restriction is notified that affects one of them, we will move that processing or replace the processor.

8. How long we keep it

• Order records, invoices and payment references — for the period the tax law requires of a seller. These survive the closing of an account, because keeping them is not our choice.
• Learning records — lessons, drills, highlights, video notes, XP, streak, and a signed-in place in the Constitution ebook — for as long as the account is live. They are deleted with the account.
• Playback sessions — pruned by a job that runs every day. The per-lecture view count outlives them, because that count is the allowance you bought.
• Analytics — screen recordings for 30 days, and page and press counts for a year, after which PostHog deletes them.
• Correspondence about a complaint — for as long as we need it to show how the complaint was handled.

9. How we protect it, and the honest limit

• Everything travels over an encrypted connection.
• A lecture plays on a signed link with a short life, so a copied video URL stops working quickly — about five minutes on most browsers. On an iPhone it is longer, up to forty minutes, because there the operating system fetches the video itself and the link cannot be refreshed while it plays.
• The institute’s console is gated by role, and the administrator comes from an allowlist of verified email addresses checked on every single call — so editing the database cannot make somebody an administrator.
• Sensitive actions taken in the console are written to an audit log.
• Your payment credentials never reach our servers at all.

The honest limit: no system is perfectly secure, and a policy that promised your data could never be exposed would be lying. What we can tell you is what we actually do, which is above.

If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Rules require — what happened, what was affected, what we have done and what you should do.

10. Your rights, and exactly how to use each

• To know what we hold. Write to the officer below and ask for a copy. We will send what we hold and the list of processors it has been shared with.
• To correct it. Your name, email address and avatar are edited in your own account, which is Clerk. For anything else — a billing detail, a mark you believe is wrong — write to us and say what is wrong and what it should be.
• To have it erased. Ask, and we will close the account and delete the learning records with it. Order records stay, because the law requires us to keep them; nothing else does.
• To withdraw consent. You may withdraw it at any time. In practice this ends the account, because the account cannot run without the data that makes it work, and we will say so before we act on it.
• To nominate someone. The DPDP Act lets you nominate a person to exercise these rights for you if you die or become unable to. Write to the officer with their name and how to reach them.
• To complain. To the officer first, and to the Data Protection Board of India after that.

How to exercise any of them: write to support@cortexdesk.in from the email address on the account, so we know it is you. If you cannot write from that address, we will ask you one question only the account holder could answer rather than ask you to send us a document we would then have to store.

11. Children

This service is for people aged 18 and over, and we do not knowingly collect a child’s personal data. Section 9 of the DPDP Act requires verifiable parental consent before a child’s data may be processed, and forbids tracking and behavioural advertising directed at children. Rather than build a consent mechanism we could not actually verify, we do not enrol anyone under 18.

If you believe a child holds an account here, write to the officer below and we will close it and delete the records.

12. The officer, and the two clocks

• J. Sivarajarajendran, Founder
• Email: support@cortexdesk.in
• Telephone: +91 73056 05638 (10:00 to 18:00)
• Post: New No. 107, Old No. AB 9, Second Avenue Road, Anna Nagar, Chennai, Tamil Nadu 600040

Two periods apply, and we work to whichever is shorter:

• One month to redress a grievance, under the SPDI Rules 2011.
• 90 days to answer a grievance about your personal data, under the DPDP Rules 2025.

If our answer does not satisfy you, you may complain to the Data Protection Board of India. For anything to do with an order rather than your data, the National Consumer Helpline on 1915 and e-daakhil at edaakhil.nic.in are open to you, and our grievance clause says how that works.

13. Changes to this policy

When this policy changes, the new version is published here and the date at the top of the page changes with it. We do not reduce your rights with retrospective effect, and where a change is material we will say so on the page rather than leave you to find it.

The terms this policy forms part of are at /terms.