Privacy Policy

“We”, “us” and “our” mean Brute Info Edutech Private Limited, a company incorporated in India with its registered office at Unit 402, 4th Floor, Vantage Business Hub, Balewadi High Street, Baner, Pune, Maharashtra 411045, India. We are the data fiduciary responsible for deciding how and why your personal data is processed on the Brute Info platform.

This policy covers the website at bruteinfo.in and every feature reached through it — browsing the catalogue, creating an account, enrolling, using the classroom, the cart and checkout, orders, certificates and support correspondence. It does not cover third-party sites we link to, which have their own policies.

It sits alongside the Terms of Use and the Cookie & Local Storage Policy. Where a term is defined in the Terms of Use, it has the same meaning here.

We collect only what the product needs to work. In practice that is four categories.

a. Account data

• your full name, as you enter it at sign-up or edit it later;
• your email address, which is also your sign-in identifier;
• a password, which is never stored in readable form — see section 10;
• the initials derived from your name, used to draw your avatar; and
• the timestamps of account creation, sign-in and password reset.

b. Learning data

• which courses and tiers you are enrolled in;
• which lectures you have marked viewed, and when;
• the progress percentage computed per course, and your streak and weekly-goal counters;
• notes you write against a lecture; and
• certificates issued to you, with their serial numbers.

c. Commercial data

• the contents of your cart, including the tier selected for each course;
• every order you place, whether it succeeds, fails or is a complimentary preview, with its invoice number, itemised amounts, GST component and failure reason; and
• coupon codes you attempt to redeem.

We do not collect payment instrument data. No card number, UPI handle, bank account, CVV or OTP is captured, transmitted or stored anywhere on the Platform, because no payment gateway is connected. Every payment attempt fails before any instrument is requested.

d. Preferences and technical data

• your appearance and learning preferences — theme, accent colour, density, text size, playback speed, autoplay, captions, reduced motion, high contrast, language, keyboard shortcuts, notification choices and profile visibility;
• the technical information every web server necessarily receives in order to serve a page: your IP address, user-agent string, referring page and the time of the request. On our current static hosting these appear only in the host's transient server logs; we do not aggregate, profile or resell them.

We do not operate advertising networks, behavioural profiling, cross-site tracking pixels or third-party analytics on the Platform. We do not knowingly collect sensitive personal data such as caste, religion, health, biometric or financial information, and you should not send it to us.

Each category of data is used for a specific, stated purpose, and for nothing else:

We never sell your personal data, and we never rent, trade or share it with data brokers. We do not use your data or your notes to train machine-learning models.

We do not take automated decisions that produce legal or similarly significant effects about you.

The practical consequences are worth spelling out:

• Only you and anyone with access to that browser profile can read it. We cannot see it, and neither can any other learner.
• It does not follow you. Signing in on a different browser, a different device or a private window gives you a fresh, empty record.
• Clearing site data erases it permanently. Browsers also evict local storage on their own in low-storage or privacy-hardened configurations.
• We cannot restore it. There is no server-side copy and therefore no backup to recover from. This is a genuine limitation, not a policy choice, and we would rather tell you now than after you lose a month of progress.

If we later introduce server-side synchronisation, we will update this policy, tell you before it starts and give you the choice of whether your existing local record is uploaded.

The complete list of keys, and what each one holds, is published in the Cookie & Local Storage Policy. You can inspect every value yourself in your browser's developer tools, and erase all of them from Settings.

The Platform is intended for adults and for senior students preparing for university and placement examinations. It is not directed at children.

• You must be 18 or older to open an account in your own name.
• A person aged 13 to 17 may learn on the Platform only through an account opened and operated by a parent or legal guardian, who is the account holder for all purposes.
• We do not knowingly collect personal data from anyone under 13, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children — activities that are in any case prohibited under section 9 of the Digital Personal Data Protection Act, 2023.

If you believe a child has given us personal data, write to privacy@bruteinfo.in. We will verify the request and delete the data within 7 working days.

Brute Info sets no advertising cookies, no analytics cookies and no cross-site tracking cookies. We use the browser's local storage instead of cookies for almost everything, which means the data stays on your device and is never attached to a network request.

A single value — your resolved light or dark theme — is read before the page paints so that you never see a flash of the wrong colour scheme. Everything else is read after the page has loaded.

The full category-by-category breakdown, the key names, their purpose, their lifetime and a panel where you can change your choices is in the Cookie & Local Storage Policy.

We keep the number of third parties deliberately small. These are all of them.

Authentication. The Platform ships with authentication running entirely in your own browser: accounts, password verifiers and sessions are held in local storage and no credential is transmitted anywhere. When Firebase Authentication is enabled by us instead, your email address and display name are processed by Google LLC under its own terms and Brute Info receives only the identifier, email address, display name and sign-in timestamps that Firebase returns. We will state clearly on the sign-in page which mode is active.

We have no advertising, analytics, tag-manager, chat-widget, heat-map, A/B-testing or session-replay provider. There is no fourth item on that list, and we will amend this policy before adding one.

Beyond the processors listed above, we disclose personal data only in these circumstances:

1. Where you ask us to — for example, when you make your learner profile public, or ask us to verify your certificate to an employer.
2. Where the law requires it — in response to a valid, written order from a court, tribunal or authorised government agency in India. We satisfy ourselves that the request is lawful and proportionate, and we tell you unless we are legally barred from doing so.
3. To protect people — where disclosure is strictly necessary to prevent serious harm, fraud, or a threat to the security of the Platform.
4. On a business transfer — if the company is merged, acquired or restructured, data may transfer to the successor entity under the same commitments. You will be notified before your data becomes subject to a different policy.

We do not share your data with employers, colleges, recruiters or other learners without your explicit instruction.

Where a statutory retention period applies, we keep the record for that period even if you ask us to erase it, and we tell you which obligation we are relying on.

We take reasonable security safeguards proportionate to the data we hold:

• the Platform is served over HTTPS, and all third-party resources are loaded over HTTPS from a short, explicit list of hosts;
• passwords are never stored in readable form — a salted, irreversible verifier is stored instead, and password comparison is done against that verifier;
• no payment instrument data exists anywhere in the system, so it cannot be breached;
• because the learning record is held only in your browser, there is no central store of learner progress to compromise;
• access to any administrative tooling is limited to the small number of staff who need it, and is reviewed periodically.

No system is perfectly secure. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required under section 8(6) of the Digital Personal Data Protection Act, 2023, without undue delay.

Protect your own account too: use a unique password, sign out on shared machines, and remember that anyone who can use your browser profile can read your learning record.

Brute Info is an Indian company and processes personal data in India. However, some of the processors listed in section 7 operate globally distributed infrastructure, so limited data may be processed outside India:

• GitHub Pages serves the Platform from a content delivery network with points of presence worldwide; the request logs are held by GitHub, Inc. in the United States.
• Google Fonts serves font files from Google's global network.
• Firebase Authentication, where enabled, processes authentication data on Google infrastructure that may be located outside India.

Such transfers are made in accordance with section 16 of the Digital Personal Data Protection Act, 2023, and only to countries that the Central Government has not restricted. We rely on the contractual commitments in each provider's data processing terms to keep the protection travelling with the data.

Your learning record is not transferred anywhere at all — it never leaves your device.

Under the Digital Personal Data Protection Act, 2023 you have the following rights over your personal data. Most of them you can exercise yourself, immediately, without asking us.

Right to access

Obtain a summary of the personal data we process about you and the processors it has been shared with. Your learning record can be read directly in your browser; write to us for anything held outside it.

Right to correction

Correct inaccurate or incomplete data. Your name and profile details are editable on the profile page.

Right to erasure

Ask us to delete your personal data where it is no longer needed for the purpose it was collected. You can erase your account and its entire local record from Settings. Statutory retention periods in section 9 are the only exception.

Right to withdraw consent

Where processing rests on your consent — marketing email, profile visibility, stored preferences — you can withdraw it at any time in Settings or on the cookie preferences panel. Withdrawal does not affect processing already carried out.

Right to grievance redressal

Have a complaint about our handling of your data considered by our grievance officer. See section 13.

Right to nominate

Nominate another individual to exercise your rights in the event of your death or incapacity. Write to us with the nominee's name and contact details.

To exercise a right that you cannot exercise from inside the product, write to privacy@bruteinfo.in from the email address on your account. We may ask a question or two to confirm it is really you. We respond within 30 days, and there is no charge unless a request is manifestly excessive or repetitive.

You also have duties under section 15 of the Act: do not impersonate anyone, do not suppress material information, and do not file a false or frivolous grievance.

As required under the Digital Personal Data Protection Act, 2023, rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the following officer may be contacted about any grievance relating to the processing of your personal data.

The officer acknowledges every grievance within 48 hours and disposes of it within 30 days of receipt, giving reasons for the decision reached.

If you are unhappy with how your personal data has been handled, use this escalation path.

1. Tell our support team first. Email support@bruteinfo.in or call +91 20 6971 4400 during support hours. Most issues are simply a misunderstanding about where data is stored, and are settled the same day.
2. Escalate to the grievance officer. Email privacy@bruteinfo.in with the subject line “Grievance”, describing what happened, when, and what outcome you want. Include the email address on your account so we can locate the record. You will receive an acknowledgement within 48 hours and a reasoned decision within 30 days.
3. Approach the Data Protection Board of India. If our decision does not satisfy you, you may complain to the Board established under the Digital Personal Data Protection Act, 2023, using the procedure it publishes.
4. Consumer forums. Nothing here limits your right to approach the consumer redressal machinery under the Consumer Protection Act, 2019.

We revise this policy when the product changes or the law does. The “last updated” date at the top of this page always reflects the version currently in force.

Where a change materially affects your rights — a new processor, a new category of data, or the introduction of server-side storage of your learning record — we will notify you by email to the address on your account, or by a prominent notice on the Platform, at least 15 days before the change takes effect.

Superseded versions are retained internally so that we can tell you which policy applied on a given date. Ask privacy@bruteinfo.in if you need one.