Legal
Privacy Policy
How we handle your information - and, more importantly, how little we hold about your child.
Draft - pending legal review
This document describes how the site actually handles data, but it has not yet been reviewed by a qualified legal professional. It must be before launch. Remove this notice by setting IS_DRAFT to false in lib/legal.ts.
Last updated: 2026-08-04
The short version
We collect the parent's details, not the child's. From your child we store, at most, a first name and an age - enough to have a useful conversation with you, and not enough to identify or contact a minor. We never sell data, and we do not run behavioural advertising aimed at children.
Who we are
BrainLIT operates https://www.brainlit.in. We are based in Chennai, Tamil Nadu, India. For anything in this policy, contact support@brainlit.in.
What we collect, and why
| Data | Why |
|---|---|
| Parent name, email, phone | To confirm your registration, send joining details, and answer your enquiry |
| Child's first name and age (optional) | To recommend the right program and to address your child correctly in a session |
| Your message, if you send one | To answer it |
| Campaign parameters from the link you arrived on (utm_*) | To understand which of our efforts actually reach parents |
| IP address and request logs | Security, abuse prevention and rate limiting. Retained briefly. |
| Analytics data | Only if you consent. See Cookies below. |
Children's data
India's Digital Personal Data Protection Act 2023 treats anyone under 18 as a child and requires verifiable parental consent before processing their personal data. It also prohibits tracking and behavioural advertising directed at children.
Our approach is to collect as little as possible:
- The parent or guardian is our point of contact for everything. We do not ask a child for an email address or phone number.
- We store a child's first name and age only, and only if you choose to provide them.
- We do not run advertising targeted at children, and we do not build advertising profiles of them.
- We publish a child's work or name only where a parent has given specific written consent, which we record. That consent can be withdrawn at any time and we will remove the material.
Who else sees your data
We use the following service providers. We do not sell your data to anyone, and we do not share it for anyone else's marketing.
| Provider | Purpose | What they receive |
|---|---|---|
| Supabase | Database and authentication | Name, email, phone, enquiry details |
| Vercel | Website hosting and delivery | IP address, request logs |
| Resend | Transactional email | Name, email address |
| Zoom | Live session delivery | Name, email address |
| Google Analytics & Google Tag Manager | Website analytics | Usage data, device and approximate location - only with consent |
| Meta Pixel | Advertising measurement | Usage data - only with consent, and never for ads directed at children |
| WhatsApp (Meta) | Parent enquiries and reminders | Phone number, message content |
Some of these providers operate servers outside India, so your data may be processed abroad under their own safeguards.
Cookies and analytics
Analytics and advertising tools load only after you consent. Decline, and they are never loaded - not merely ignored. Cookies strictly necessary to make the site work are always active.
You can change your choice at any time from the cookie banner.
How long we keep things
- Enquiries and registrations - while we are in contact with you and for a reasonable period after, so we can answer follow-up questions
- Student records - for the duration of the program and as long as required for certificates and support
- Server logs - a short period, for security
Ask us to delete your data and we will, except where we are legally required to retain it.
Your rights
Under the DPDP Act 2023 you may:
- Ask what personal data we hold about you and your child
- Ask us to correct anything inaccurate or incomplete
- Ask us to erase it
- Withdraw consent you previously gave, at any time
- Nominate someone to exercise these rights on your behalf
- Raise a grievance, and escalate to the Data Protection Board of India if we do not resolve it
To exercise any of these, email privacy@brainlit.in.
Grievance Officer
Haja Najmudeen, Grievance Officer
privacy@brainlit.in
Security
The site is served over HTTPS. Data is stored in an access- controlled database with row level security, and the keys that can read personal data are held server-side only and never sent to your browser. No system is perfectly secure, but we do not treat that as an excuse.
Changes
If we change this policy we will update the date at the top, and tell you directly where the change is significant.
Contact
support@brainlit.in - or see our contact page.