Minds of Aspirantspowered by Cortex Desk

Not ready to publish

These pages are a draft. The facts below are not yet known, and everywhere one of them belongs the page prints [TO BE SUPPLIED] rather than a guess — an invented address or registration number on a page that governs a sale is a false record, not a placeholder.

  • Principal place of business
  • Customer-care telephone
  • Telephone hours
  • Grievance officer's name
  • Grievance officer's designation
  • City of jurisdiction

Fill them in src/lib/institute.ts — each one reads from a NEXT_PUBLIC_INSTITUTE_* environment variable, and this notice removes itself when the last is set.

Policies

Privacy Policy

This policy explains what personal data mindsofaspirants.com collects about you, why we hold it, who else sees it, and what you can make us do about it.

Last updated 20 September 2026.

1. Who is responsible for your data

Minds of Aspirants, a an enterprise registered under the MSMED Act, 2006 trading as Minds of Aspirants, at [TO BE SUPPLIED], is the data fiduciary for personal data collected through this site. In DPDP language, you are the data principal and we decide why and how your data is processed.

The person answerable for it is [TO BE SUPPLIED], [TO BE SUPPLIED], at brahmanprabha@gmail.com. We name a person rather than a desk because a role address is not a person who can be held to an answer, and the Act asks for one who can.

2. The law this is written to

  • The Information Technology Act 2000, s.43A, and the SPDI Rules 2011. In force today. They govern sensitive personal data — passwords, financial information, health — and require a grievance officer who answers within one month.
  • The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified on 13 November 2025. The notice, consent and security provisions take effect on 13 May 2027. We are writing this policy to them now rather than waiting, because a notice written late is a notice written under pressure.
  • The Consumer Protection (E-Commerce) Rules 2020, which is why the seller, the grievance officer and the redressal window are named on this site at all.

3. What we collect

Itemised, in the way the DPDP Act asks for — not a general phrase about usage data. This is the whole list.

Identity, from Clerk

Your name, your verified email address, your avatar if you have one, and the method you signed in with. Clerk holds your password and your sign-in sessions; we never see your password.

Billing details, when you buy

Your name, email address, telephone number and the Indian State you are in. The State is collected because a seller of an online service must record the place of supply of the order.

Minds of Aspirants is not registered under GST. No GST is charged, and the price shown is the whole price — the State is recorded so the order record is complete, and for nothing else.

Payment references only

An order reference, a payment reference, the amount, the status, and the method in words (“UPI”, “card”). We never see and never store a card number, a CVV, a UPI PIN or a bank credential. Those are typed into Razorpay’s own form and held by Razorpay; they do not reach our servers.

Learning records

Which lessons you completed and when, your drill answers and the marks they were given, the passages you highlighted, the notes you took on a video, your XP and your daily streak.

Lecture viewing, said plainly

Watching a lecture is measured, and it has to be, because the seat you bought allows a stated number of views per lecture. For every lecture you open we record:

  • how many of your allowed views you have used;
  • each playback session — when it began, which device and browser began it, and when it last checked in;
  • a heartbeat every few seconds while the lecture is playing, and the coverage we compute from those heartbeats: how much of the lecture was actually watched;
  • where you stopped, so the lecture can offer to resume.

The one-device rule is enforced from those sessions: starting a lecture on a second device ends the session on the first. Institute staff can see, for each student and each lecture, how many views were used and how much of the lecture was watched. If that is not something you are willing to have recorded, do not watch the lectures — there is no way to use them without it. Staff previews of a lecture are never counted and never tracked, so the institute’s own viewing does not appear in these figures.

Mentoring

The mentor you chose, the time you asked for, what you wrote about what you would like to go over, the state of the request, and the meeting link the mentor gives. The mentor you asked sees all of it.

Technical data

Your IP address, your browser and your device, as our hosting and our video delivery record them in their own logs, and error reports when something on the site breaks.

4. Cookies and local storage

  • Clerk’s session cookie — keeps you signed in. Strictly necessary; without it there is no account.
  • The theme cookie — remembers whether you chose Day or Night. It is read on the server so the page does not flash the wrong colour before it paints.
  • A Grid or List preference for the course catalogue, kept in your browser’s local storage and never sent to us.
  • Your lecture player settings — speed, captions, volume and the data saver — kept in your browser’s local storage under moa.player.prefs, and not sent to us.
  • A random identifier for this browser, kept under moa.player.device. This one is sent to us, with every lecture you start. It is how reloading a page is not counted as switching device, and it is what the institute sees when a lecture has been watched from more than one place. It is a random string we generate; it is not your name, your account or anything that identifies the machine itself, and clearing your site data replaces it with a new one.

There is no advertising cookie and no cross-site tracking cookie on this site. That is true today and it is a choice, not an oversight. If it ever changes, this page changes first.

5. Why we hold it, and on what basis

We use the data above to:

  • give you the account, and the seat you paid for;
  • mark your drills and answer your questions;
  • enforce the per-lecture view allowance and the one-device rule, which is the only thing that makes a stated allowance mean anything;
  • send the four emails an order produces;
  • keep the order records a seller is required to keep;
  • keep the site up, and investigate abuse of it.

The basis for most of it is the consent you give when you create the account and when you place an order. The rest rests on the certain legitimate uses the DPDP Act allows where you have given data voluntarily for a purpose you plainly expect, and on the statutory duty to keep records of a sale.

We do not train any model on your data. Where text is sent to our AI provider so a model can answer — your question, and the passage or the drill it concerns — we send what the answer needs and no more, and we do not send your name or your email with it. We do not sell personal data, and we do not use it for advertising.

6. Who else sees it

We run this site on other companies’ infrastructure. Each one below is a processor acting on our instructions, and each is named with what actually reaches it:

  • Clerk — authentication. Your name, email address, avatar and sign-in events. Clerk, not we, holds your password.
  • Convex — our database and file storage. Everything in section 3 that we store, stores there.
  • Vercel — hosting. Request logs: IP address, the page requested, the browser.
  • Bunny Stream — video delivery. The video requests your player makes and the address the signed link was issued to. No marks, no notes, no lesson text.
  • OpenRouter — the AI Mentor, the Constitution desk and the current-affairs deep dives. The text of your question and the passage it is about. Not your name, not your email.
  • Razorpay — payments. Your name, email, telephone number and the amount, plus the payment credentials you type into Razorpay’s form, which we never see.
  • Resend — transactional email. Your email address and the text of the four order messages.

That is the entire list. We do not share your data with an advertiser, a data broker or another coaching institute. We disclose it to a court, a regulator or the police only where the law requires it, and we will tell you when we are allowed to.

7. Data that leaves India

Some of the processors above store or process data on servers outside India. The DPDP Act permits transfer to any country the Central Government has not restricted by notification. If a restriction is notified that affects one of them, we will move that processing or replace the processor.

8. How long we keep it

  • Order records, invoices and payment references — for the period the tax law requires of a seller. These survive the closing of an account, because keeping them is not our choice.
  • Learning records — lessons, drills, highlights, video notes, XP, streak — for as long as the account is live. They are deleted with the account.
  • Playback sessions — pruned by a job that runs every day. The per-lecture view count outlives them, because that count is the allowance you bought.
  • Correspondence about a complaint — for as long as we need it to show how the complaint was handled.

9. How we protect it, and the honest limit

  • Everything travels over an encrypted connection.
  • A lecture plays on a signed link with a short life, so a copied video URL stops working quickly — about five minutes on most browsers. On an iPhone it is longer, up to forty minutes, because there the operating system fetches the video itself and the link cannot be refreshed while it plays.
  • The institute’s console is gated by role, and the administrator comes from an allowlist of verified email addresses checked on every single call — so editing the database cannot make somebody an administrator.
  • Sensitive actions taken in the console are written to an audit log.
  • Your payment credentials never reach our servers at all.

The honest limit: no system is perfectly secure, and a policy that promised your data could never be exposed would be lying. What we can tell you is what we actually do, which is above.

If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Rules require — what happened, what was affected, what we have done and what you should do.

10. Your rights, and exactly how to use each

  • To know what we hold. Write to the officer below and ask for a copy. We will send what we hold and the list of processors it has been shared with.
  • To correct it. Your name, email address and avatar are edited in your own account, which is Clerk. For anything else — a billing detail, a mark you believe is wrong — write to us and say what is wrong and what it should be.
  • To have it erased. Ask, and we will close the account and delete the learning records with it. Order records stay, because the law requires us to keep them; nothing else does.
  • To withdraw consent. You may withdraw it at any time. In practice this ends the account, because the account cannot run without the data that makes it work, and we will say so before we act on it.
  • To nominate someone. The DPDP Act lets you nominate a person to exercise these rights for you if you die or become unable to. Write to the officer with their name and how to reach them.
  • To complain. To the officer first, and to the Data Protection Board of India after that.

How to exercise any of them: write to brahmanprabha@gmail.com from the email address on the account, so we know it is you. If you cannot write from that address, we will ask you one question only the account holder could answer rather than ask you to send us a document we would then have to store.

11. Children

This service is for people aged 18 and over, and we do not knowingly collect a child’s personal data. Section 9 of the DPDP Act requires verifiable parental consent before a child’s data may be processed, and forbids tracking and behavioural advertising directed at children. Rather than build a consent mechanism we could not actually verify, we do not enrol anyone under 18.

If you believe a child holds an account here, write to the officer below and we will close it and delete the records.

12. The officer, and the two clocks

  • [TO BE SUPPLIED], [TO BE SUPPLIED]
  • Email: brahmanprabha@gmail.com
  • Telephone: [TO BE SUPPLIED] ([TO BE SUPPLIED])
  • Post: [TO BE SUPPLIED]

Two periods apply, and we work to whichever is shorter:

  • One month to redress a grievance, under the SPDI Rules 2011.
  • 90 days to answer a grievance about your personal data, under the DPDP Rules 2025.

If our answer does not satisfy you, you may complain to the Data Protection Board of India. For anything to do with an order rather than your data, the National Consumer Helpline on 1915 and e-daakhil at edaakhil.nic.in are open to you, and our grievance clause says how that works.

13. Changes to this policy

When this policy changes, the new version is published here and the date at the top of the page changes with it. We do not reduce your rights with retrospective effect, and where a change is material we will say so on the page rather than leave you to find it.

The terms this policy forms part of are at /terms.