Privacy Policy

1. Who we are

TCL Academy ("TCL", "we", "us") operates this website and the related training platform (the "Service") at academy.thecyberledger.in. This policy explains what we collect, why, and what choices you have about it.

2. What we collect

• Account info: name, email, password (stored as a salted hash, never in plain text)
• Learning activity: course/room/certification enrollments, lesson and section progress, quiz and Final Check attempts and scores, CTF flag submissions, and badges earned
• Payment records: amount, status, and Razorpay transaction references (we do not store your card or bank details — Razorpay handles that directly)
• Certificates and credentials issued to you, and their public verification codes
• For certifications with a hands-on practical component: which environments you started, objective completions, and any evidence (screenshots, notes, submitted answers) you provide for manual-review objectives
• Basic usage logs (e.g. login events, IP address) for security and troubleshooting

3. What we deliberately don't collect

Rooms' Terminal and HTTP activities run in a simulated sandbox on your device — typing a command into a Terminal block, or reading through an HTTP block's request/response, never makes a real network call or executes a real command on our servers or yours. We don't log the commands you try, and there's no live traffic to capture, because none is generated. The only thing submitted for grading is the answer or flag you explicitly type into a task.

4. How we use it

To provide the Service (content access, progress tracking, grading, certificates and badges), process payments, send transactional emails (enrollment confirmations, receipts, certificate and badge notifications), and maintain platform security and integrity (including quiz anti-cheat monitoring — see Section 7).

5. What we don't do

We don't sell your personal data. We don't show ads. We don't share your data with third parties except service providers necessary to run the platform (payment processing via Razorpay, email delivery via our email provider, and — only for certifications that use one — the specific external lab platform you choose to launch).

6. Certificates and credentials are public

A certificate or credential's verification page shows your name, the title, and the issue date to anyone with the verification code — this is by design, so employers can confirm it's genuine. It does not show your email or any other account details.

7. Quiz and exam integrity monitoring

During timed quizzes, Final Checks, and certification knowledge exams, we log tab-switch and window-focus events for academic integrity review. This is used only to flag attempts for manual review — it does not automatically fail an attempt, and it is not used for any purpose outside the assessment session.

8. External and downloadable lab environments

Some Rooms and certification practical environments link out to a third-party platform (e.g. TryHackMe, Hack The Box) or offer a downloadable lab package (VM/OVA/ZIP). Once you leave our site for an external lab, that platform's own privacy policy applies — we only receive the flag you choose to submit back to us, nothing else about your activity there.

9. Data retention and deletion

You can delete your account at any time from your Profile page. Deleting your account disables login and scrubs your name/email from our systems, but we retain your enrollment, payment, certificate, and credential records: certificates and credentials must remain verifiable to keep their value to you and to employers who've already seen them, and payment records are retained for financial and legal record-keeping. If you need a full erasure of these retained records, contact us at ra.aenosh@thecyberledger.in and we'll evaluate the request against our legal retention obligations.

10. Security

Passwords are hashed with bcrypt. Sessions use short-lived access tokens plus an httpOnly refresh cookie inaccessible to JavaScript. Payments are verified server-side against Razorpay's cryptographic signature before any access is granted. Flags and expected answers for graded content are hashed and never sent to your browser before you submit.

11. Your rights

You can access, correct, or request deletion of your personal data at any time by writing to ra.aenosh@thecyberledger.in. If you're in the EU/EEA or UK, you have the additional rights afforded under GDPR/UK GDPR (data portability, restriction of processing, and the right to lodge a complaint with your local supervisory authority).

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, the contact details of the Grievance Officer are:

[Grievance Officer name]
TCL Academy
Email: ra.aenosh@thecyberledger.in
[Registered address]

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above; continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact

Questions about this policy or your data: ra.aenosh@thecyberledger.in.