Privacy policy
Version 2.1 · Last updated 20 October 2026. What we collect, why, who sees it, how long we keep it, and how you stay in control. Plain language first; the detail follows.
The short version
- We collect only what we need to run your enrolment, answer you, and (only if you tick the box) send you updates.
- We never sell your personal data, and we don’t use it to train AI models.
- We never see or store your card or bank details, payments happen on the payment provider’s own page.
- Analytics and advertising cookies stay off until you switch them on, and you can switch them off again any time.
- You can ask us to show, correct or delete your data, withdraw consent, or complain, see §11–12.
1. Who is responsible for your data
EdgeBefore (“we”, “us”, “our”) provides AI education, live Buildathons, workshops and programs, and advisory services. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described here, and you are the Data Principal. Registered name: EdgeBefore, India. Email: info@edgebefore.com.
Contact and Grievance Officer. Grievance Officer: grievance@edgebefore.com. You can also write to info@edgebefore.com or use the contact page (choose “Privacy request or grievance”).
2. The laws this policy is written around
This policy is written to align with the DPDP Act and the Digital Personal Data Protection Rules, 2025 (as their provisions are brought into force in phases: the Data Protection Board is already operational, with the remaining obligations phasing in by 13 May 2027); the Information Technology Act, 2000 and, for as long as it remains in force, Section 43A and the Reasonable Security Practices and Sensitive Personal Data or Information Rules, 2011; the Consumer Protection (E-Commerce) Rules, 2020; and the CERT-In Directions of 28 April 2022. Where a law gives you a stronger right than this page, the law prevails. If you are in the EU or UK, we treat the GDPR rights described in §11 as available to you as well, and our legal bases are your consent (newsletter, optional cookies), performance of a contract (enrolments) and legitimate interests (site security). You may also complain to your local data protection authority.
3. What we collect, why, and on what basis
| Data | When we collect it | Purpose | Basis under the DPDP Act |
|---|---|---|---|
| Name, email, phone/WhatsApp number | You enrol, join a waitlist, subscribe, add workshops, or contact us | Process your enrolment; send joining details and reminders; reply to you | Your consent, and “legitimate use” where you voluntarily give us data for a stated purpose |
| Role, goals, the build or workshop you’re interested in, messages you write | Forms you fill in | Place you in the right session; answer your request | Your consent |
| Marketing preferences (daily/weekly briefing, topics) | The newsletter and interest forms | Send The Edge Brief and event updates, only if you tick consent | Your consent (withdraw any time) |
| Payment confirmation (reference, amount, status) | After you pay on our payment provider’s page | Confirm your seat; issue receipts; keep tax and accounting records | Performance of what you asked for; compliance with law |
| Session recordings (your audio, video and chat if you share them) | Live sessions | Replays for attendees | Your consent, given when you enrol; keep camera/mic off to stay out of recordings |
| Technical and security logs (IP address, browser, pages, timestamps) | Whenever you use the site (kept by our host / security layer) | Keep the site secure, detect abuse, meet legal log-keeping duties | Compliance with law; security of the service |
| Analytics and advertising identifiers (cookies) | Only if you accept them | Understand traffic; measure our ads | Your consent, see the Cookie Policy |
Payment card and bank details are “sensitive personal data” under the IT Act's SPDI Rules, 2011; they are collected and secured by our payment processors, never by us. We do not knowingly collect other sensitive categories of data (such as health, biometrics, or government ID numbers) and ask you not to send them. We don’t carry out automated decision-making that has legal or similarly significant effects on you.
4. Consent, how it works
- We ask for consent separately and for a stated purpose: an unticked box beside each purpose. Nothing is pre-ticked, and marketing is never a condition of buying something.
- This policy and the notice beside each form are available in English; on request we will provide them in any language listed in the Eighth Schedule to the Constitution.
- You can withdraw consent as easily as you gave it: use the unsubscribe link, reply “STOP” on WhatsApp, change your cookie choices, or write to us. Withdrawal doesn’t affect processing already done, and we may still send essential service messages about something you paid for.
- Newsletter (The Edge Brief) uses double opt-in. After you sign up we send one email with a confirm link; you are added only after you click it. Every newsletter carries a one-click unsubscribe link, and we stop sending as soon as you use it. We send it from an edgebefore.com address, our email delivery provider processes your address only to send it, and unconfirmed sign-ups are deleted.
- We keep a record of when and how you consented so that we can show it if asked.
5. Who we share data with
We share personal data only with service providers (“Data Processors”) that help us run EdgeBefore, under terms that require them to protect it and use it only on our instructions. Right now these are:
- Razorpay (India): payments in INR. It collects your card, UPI or bank details directly; we receive only the payment reference, amount, status and the contact details you enter.
- PayPal: payments from international buyers, on PayPal's own pages.
- Cloudflare: website hosting, security, and storage of newsletter sign-ups and email forwarding for edgebefore.com addresses.
- Resend: sending our confirmation and newsletter emails.
- Google Workspace / Gmail: our inbox, where emails you send us are received.
- Video-meeting tools used to run live sessions, named in your joining email.
- Google Analytics and Meta Pixel: not in use today. If we switch them on, they load only after you accept them in the cookie banner.
We may also disclose data where the law requires (for example to a court, regulator or law-enforcement agency acting under legal authority) or to protect our legal rights. We do not sell personal data and we do not share it for others' marketing.
6. Transfers outside India
Some of our processors (for example global hosting, messaging or analytics providers) may process data on servers outside India. The DPDP Act permits this except to countries the Central Government restricts. We choose providers that commit to appropriate safeguards and we limit what we send them to what they need.
7. Cookies and similar technologies
We use a small number of cookies and browser-storage items. Strictly necessary ones are always on; analytics and advertising ones are off until you opt in. We load fonts from our own servers (not from Google), and third-party embeds such as X (Twitter) load only if you click to load them. Full details and a table of every item are in the Cookie Policy.
8. Community channels (WhatsApp and Telegram)
Joining our WhatsApp or Telegram channels and groups is optional. These services are run by their own providers under their own privacy terms. In groups, other members can see your display name and, on WhatsApp, your phone number. Please don’t post sensitive, confidential or client information. We don’t add you to anything without your action, and we may remove members who break the group rules.
9. How long we keep data
We keep personal data only as long as the purpose lasts, or as long as the law requires, and then erase or anonymise it. Our current periods:
| Data | Kept for |
|---|---|
| Enrolment, payment and invoice records | As long as tax, accounting and company law require (up to 8 years) |
| Newsletter and event-update subscribers | Until you withdraw consent, or 24 months without any engagement, whichever is sooner |
| Enquiries and support messages | 24 months after the matter closes |
| Interest-list and waitlist entries | Until the launch you signed up for plus 12 months, or until you withdraw consent |
| Session recordings | 12 months after the session, unless you ask us to remove your part sooner |
| Security and access logs | For the minimum period required by applicable law (including CERT-In directions and the DPDP Rules), then deleted |
| Consent records | For as long as we process data on that consent, plus the period needed to defend a claim |
10. How we protect your data
We use reasonable security safeguards, including: encrypted connections (HTTPS) with strict transport security; hardened security headers and a restrictive content-security policy on the site; validation, size limits and rate limiting on our forms; least-privilege access to the systems that hold your data; vendor agreements with security obligations; and no storage of card or bank details on our systems. No system is perfectly secure. If a personal-data breach occurs, we will tell affected people without delay, in plain language, what happened, the likely impact, what we are doing and what you can do, and we will report it to the Data Protection Board of India within the time the DPDP Rules require (including a detailed report within 72 hours), and report applicable cyber incidents to CERT-In within the time it prescribes.
11. Your rights as a Data Principal
- Access a summary of the personal data we process about you, and the identities of the processors and other fiduciaries we have shared it with.
- Correct, complete or update data that is inaccurate or incomplete.
- Erase your data when it is no longer needed for the purpose, or when you withdraw consent, unless the law requires us to keep it.
- Withdraw consent at any time (see §4).
- Grievance redressal: raise a complaint with us first (see §12).
- Nominate another person to exercise your rights if you die or become incapacitated.
- If the GDPR applies to you: object to or restrict processing, and port your data, as the GDPR provides.
How to exercise a right: use the contact page (topic “Privacy request or grievance”) or email us from the address you registered with. We may ask for details to verify it is you. We acknowledge requests within 48 hours and aim to resolve them within 30 days, and in any case within the maximum period the law prescribes.
12. Grievances and complaints
If you’re unhappy about how we handle your data, write to our Grievance Officer (see §1). We acknowledge within 48 hours and resolve within one month, in line with the Consumer Protection (E-Commerce) Rules, 2020. If you remain dissatisfied after using our process, you may complain to the Data Protection Board of India in the manner the DPDP Act and Rules provide. (The Act expects you to use the fiduciary’s grievance process first.) You can also approach the consumer forums available to you under Indian law.
13. Children and age
EdgeBefore is meant for people aged 18 and over. We don’t knowingly collect data from anyone under 18, and we don’t track or send targeted advertising to children. The DPDP Act requires verifiable parental or guardian consent for a child’s data; we don’t offer that route, so if you are under 18 please don’t submit your details. When you enrol or sign up, you confirm you are 18 or older. If we learn we hold a child’s data without verifiable parental consent, we will delete it.
14. AI and your data
We don’t use the personal data you give us to train AI models. During our sessions, we ask everyone to use sample or synthetic data only and never to upload confidential or client information to AI tools. Where we use AI-powered tools in our own operations (for example to summarise a recording), we choose providers under contract and avoid sending more personal data than necessary.
15. Third-party links
Our pages link to services we don’t control: payment pages, WhatsApp, Telegram, X, and the news sources on our Track pages. Their privacy practices are theirs; please read their policies. We aren’t responsible for them.
16. Changes to this policy
We’ll update this policy as the DPDP Rules phase in and as our practices change. The current version and its date are always at the top of this page; if a change materially affects how we use your data, we’ll tell you and, where the law requires, ask for your consent again.