Privacy policy

Last updated: 22 August 2026

This describes what KLS Academy does with your personal data. It is written to be accurate rather than comprehensive-sounding: everything below reflects what the software actually does today.

KLS Tech Solutions, an MSME registered organisation in Bangalore, Karnataka, decides how and why your data is handled here. In the language of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary and you are the Data Principal.

The short version

• We collect what the internship needs, and not much else.
• We do not sell your data, and we do not advertise to you.
• We use Google Analytics, which sets cookies. Blocking them costs you nothing here.
• Only your name, domain, duration and issue date appear publicly, and only on a certificate verification page someone has to know the number to reach.
• You can see it, correct it, or delete it, at any time.

What we collect

Because you gave it to us

• At registration: your name, email address, phone number and date of birth.
• On your profile, if you fill it in: college, degree, branch, year of study, and your LinkedIn and GitHub links. These are optional.
• In your submissions: repository links, screenshots you upload, written explanations, and the LinkedIn post you submit for verification.
• If you write to us: whatever is in your message.

Because the system records it

• Activity log: significant actions on your account — signing in, enrolling, submitting, closing the account — with the time and the IP address the request came from. This is what lets us investigate a compromised account or a disputed submission.
• Email log: which of our emails were sent to you and whether delivery succeeded, so we can tell "never sent" from "sent, went to spam".
• Certificate verification log: when a certificate number is looked up on the public page, with the IP address and browser of whoever looked. This detects someone walking through numbers hunting for valid ones. It records the checker, not you.

Why we ask for your date of birth

Under the DPDP Act anyone below 18 is a child, and their data may only be processed with verifiable parental consent. We have no way to collect that consent, so instead of handling children's data badly we do not handle it at all — registration requires a date of birth and refuses anyone under 18. The date is stored, used for that check, and used for nothing else. It is never shown publicly and never appears on a certificate.

Why we use it

• To run your internship: creating your account, generating your offer letter, showing your tasks and notes, letting a reviewer assess your work, and issuing your certificate.
• To contact you about it: a welcome message when you register, resetting your password, and notifying you when a submission is reviewed or a certificate is issued. These are part of the service, not marketing.
• To keep the platform safe: rate limiting, detecting abuse of the verification page, and investigating account compromise.
• To understand how the site is used, in aggregate — see Analytics below.

We do not sell your data, we do not share it with advertisers, we do not build a profile of you for advertising, and we do not make automated decisions with legal effect about you. Every submission is reviewed by a person.

Your consent

You give consent by creating an account, having read this notice. You can withdraw it at any time by closing your account from your dashboard, which is as easy as giving it was. Withdrawal is not retrospective: it stops further processing but does not undo what was lawfully done before.

One consequence is worth stating plainly. If you withdraw consent, we cannot continue running your internship — there is no way to review work for someone whose account no longer exists.

What is public

One thing, and only when someone enters a valid certificate number: the certificate verification page shows the recipient's name, the internship domain, its duration, the issue date, and whether the certificate is still valid.

The page is not listed or browsable, and certificate numbers are random rather than sequential precisely so that holding one tells you nothing about any other. Your email address, phone number, date of birth, college and submissions are never public.

Who else sees your data

A small number of service providers process data on our instructions, for the purposes above and nothing else:

• Our hosting provider — where the application runs.
• Our database provider — a managed PostgreSQL service that stores your account and internship records.
• Our email provider — delivers verification, password reset and notification emails. It necessarily sees your email address and the content of those messages.
• Mixpanel — product analytics, in the limited form described below.
• Google Analytics — audience measurement. It sets cookies and sees your IP address; it is not sent your name, email or account identifier. See Analytics below.

Beyond these, we disclose personal data only where the law requires it, and we would tell you unless we were forbidden to.

Analytics

We use two analytics tools, and they work differently.

Mixpanel — product analytics

Used to count things like how many people reached the enrolment page and how many finished. It is configured so that:

• No name, email address, phone number or user identifier is sent.
• Event properties are filtered before they leave your browser, and anything resembling an email address is dropped rather than transmitted.
• IP-based geolocation is switched off.
• If the analytics key is not configured, the code does nothing at all.

The result is counts of events, not a record of a person. We cannot look up what you personally did in Mixpanel, and neither can anyone else.

Google Analytics — audience measurement

Used to understand how people find the site and which pages they read. It is a Google product and it behaves like one: unlike our Mixpanel setup, it sets cookies in your browser and processes your IP address and general location to do its job.

We do not send it your name, email address or any account identifier, so it cannot tell Google who you are on this site. We use it for totals and trends, not to follow individuals. Google's own handling of the data it collects is governed by its privacy policy, not ours.

Most browsers let you block these cookies, and extensions that block analytics work normally here — the site functions perfectly without them.

Cookies

Essential cookies. Signing in sets session cookies that hold your access and refresh tokens. They are httpOnly, so no JavaScript — ours or anyone else's — can read them, which is what stops a script on the page from stealing your session. The site cannot keep you signed in without them. Signing out clears them.

Analytics cookies. Google Analytics sets its own cookies to tell one visit from another and one visitor from another. These are not advertising cookies — we run no ads, we sell no data, and nothing here builds an advertising profile of you — but they are tracking cookies in the ordinary sense of the term, and you are entitled to refuse them. Blocking them in your browser costs you nothing on this site.

Signing in sets session cookies that hold your access and refresh tokens. They are httpOnly, so no JavaScript — ours or anyone else's — can read them, which is what stops a script on the page from stealing your session. They are essential: the site cannot keep you signed in without them. Signing out clears them.

How long we keep it

• Account and internship records: while your account is open.
• Submissions and screenshots: for the internship and afterwards as evidence behind the certificate, so a challenge to it can be answered.
• Certificate records: indefinitely, including after you close your account, so the credential stays verifiable. This is deliberate — see below.
• Password reset links: 30 minutes, and they work once.
• Activity and verification logs: retained for security investigation and audit.

What happens when you close your account

Closing your account is irreversible and takes effect immediately. It asks for your password first, so that an unattended signed-in laptop cannot do it for you.

We erase:

• Your name, phone number and date of birth.
• Your entire profile — college, degree, branch, year, LinkedIn and GitHub.
• Your password.
• Your email address, replaced with an unusable placeholder. This also frees the real address, so you can sign up again later if you want to.

Every token your account holds stops working at that moment, on every device.

One thing survives, and you should know why. Certificates already issued remain verifiable, and the certificate keeps its own copy of the name printed on it. An employer checking your certificate two years from now must not find a dead link because you closed your account — the credential you earned would become worthless at the moment you exercised a privacy right, which is the wrong trade. If you would rather the certificate were revoked as well, write to us and we will revoke it.

Your rights

Under the DPDP Act 2023 you can:

• Ask what we hold about you, and a summary of how it is processed and who it has been shared with.
• Correct anything wrong — most of it you can edit yourself on your profile; write to us for the rest.
• Erase it, by closing your account or by asking us, subject to the certificate exception above.
• Nominate someone to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
• Complain to us, and to the Data Protection Board of India if our answer does not satisfy you.

Write to klstechsolutions2025@gmail.com from your registered email address. We aim to respond within 30 days. Please check your Spam, Junk or Bin folder before assuming we have not replied.

How we protect it

• Passwords are hashed with Argon2 and are not recoverable — not by us either.
• All traffic is served over HTTPS.
• Uploaded files are stored on our own server, outside the public web root, and are validated by content rather than by what the upload claims to be. They are reachable only through a request we have authenticated — there is no link that works without signing in.
• Sign-in, registration and email-sending endpoints are rate limited against brute force.
• Administrator access is restricted by role, checked against the database on every request rather than trusted from a token.
• Resetting a password ends every existing session, so a stolen one cannot outlive the reset.

No system is perfectly secure. If a breach affects your data we will inform you and the Data Protection Board of India as the DPDP Rules require, and tell you what happened and what to do about it.

Where your data is

Data is stored on infrastructure that may be located outside India. Where that happens it remains subject to this notice and to our contracts with those providers, and to any restrictions the Government of India places on transfers under the DPDP Act.

Changes

We may update this notice. The date at the top reflects the current version. If a change materially affects how your data is used, we will email registered students before it takes effect.

Contact and grievances

For any question about this notice, to exercise a right, or to raise a grievance, write to klstechsolutions2025@gmail.com. If you are not satisfied with how we handle it, you may complain to the Data Protection Board of India.

KLS Tech Solutions · MSME registered · Bangalore, Karnataka 560027, India