Privacy Policy

This Privacy Policy explains how SarthiLink™ (“we”, “us”) collects, uses, shares, and protects your personal data when you use our mentorship platform. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and as an intermediary under the Information Technology Act, 2000. By using SarthiLink™, you consent to the practices described here.

Identity & account data: your name, email address, optional phone number, password (hashed by our authentication provider — never stored in plain text by us), and role (student or mentor).

Mentor verification data: bio, areas of expertise, pricing, and supporting documents you submit for verification (such as an ID, rank card, marksheet, or experience letter). These are stored in restricted, non-public storage and used only for our trust & safety review.

Student profile data: optional details such as your target exam, subject, and preparation stage, used only to personalise your experience.

Booking data: session details, timing, status, notes, and the meeting link generated for a confirmed session.

Payment data: the amount, status, and gateway reference for a transaction, plus invoice records. We do not store your card, UPI, or bank details — those are handled entirely by Razorpay under its PCI-DSS compliant systems.

Communication records: transactional emails we send you, and any correspondence you have with our support or grievance team.

Google account & Calendar data (mentors only, optional): if a mentor connects Google Calendar, we receive their Google email address and a token that lets us create, update, and delete calendar events for their bookings. See section 6 and our Google API Data Usage page.

Technical logs & cookies: basic technical information such as your IP address, browser type, and actions taken in-app, used to keep the platform secure and to diagnose errors. See our Cookie Policy.

Under the DPDP Act we process your personal data on the following bases:

• To perform our contract with you — creating your account, operating bookings, processing payments, generating invoices, and enabling scheduling.
• With your consent — mentor verification, and connecting Google Calendar (given at Google's consent screen and revocable at any time).
• For our legitimate uses and legal obligations — securing the platform, preventing fraud and abuse, resolving disputes, and retaining financial records as required by Indian tax law.

We send transactional emails that are part of the service — for example, a welcome email, payment confirmation, booking confirmation, new-booking alerts to mentors, reschedule and cancellation notices, refund confirmations, mentor verification outcomes, and password-reset emails from our authentication provider. Where a mentor has connected Google Calendar, Google also sends calendar invitations and reminders for the session. We do not send promotional or marketing emails; if we introduce them in future, they will include an opt-out and this policy will be updated first.

We share data only with the service providers necessary to run SarthiLink™, and only to the extent needed:

• Supabase — database, authentication, and file storage.
• Razorpay — payment processing and refunds.
• Google — for mentors who connect Google Calendar, to create session events and Google Meet links.
• Our email provider — to deliver the transactional emails described above.

A mentor and student in a confirmed booking can see each other's name and the details needed to conduct the session, including the calendar invitation and Meet link. We do not sell your personal data to anyone, ever. We may disclose data if required by law or a valid legal process.

After a mentor gives explicit consent, SarthiLink™ may, on that mentor's calendar:

• Create calendar events for confirmed bookings.
• Update those events when a session is rescheduled.
• Delete those events when a session is cancelled.
• Generate Google Meet links for those events.

SarthiLink™ does NOT:

• Read your unrelated or existing calendar events.
• Sell Google data.
• Use Calendar information for advertising.
• Use Calendar data to train artificial-intelligence or machine-learning models.

Access is limited to the scheduling function you connected it for and can be revoked at any time from your Mentor Settings or from your Google Account. Our use of Google data complies with the Google API Services User Data Policy, including its Limited Use requirements — see our Google API Data Usage page.

SarthiLink™ integrates privacy-conscious product analytics (PostHog) and error monitoring (Sentry) to understand how the platform is used and to catch bugs. These tools are only active when configured for the environment, and are set up to avoid capturing passwords or payment details. When active, PostHog may set a first-party cookie and, using identified-only profiles, associate usage with your account; it does not track you across unrelated websites. You can ask us to clear your analytics history by contacting us.

We retain account and booking data for as long as your account is active, plus a reasonable period afterward for legal, accounting, and dispute-resolution purposes — financial and tax records are typically retained for up to 7 years as required under Indian law. Mentor verification documents are kept only as long as needed for verification and compliance. When data is no longer required, it is deleted or anonymised.

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you.
• Request correction or updating of inaccurate data.
• Request erasure of your data, subject to records we must retain by law.
• Withdraw consent (for example, disconnect Google Calendar) at any time.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Raise a grievance with us and, if unresolved, with the Data Protection Board of India.

To exercise any of these, contact us at support@sarthilink.com.

You can request deletion of your account at any time by contacting support@sarthilink.com. Deleting your account removes your profile from public view and revokes any Google Calendar connection. Booking, payment, and invoice records tied to completed transactions may be retained for the legal retention period described above.

Passwords are managed by our authentication provider and never visible to us in plain text. Sensitive credentials — payment-gateway keys, service credentials, and mentors' Google refresh tokens (encrypted with AES-256-GCM) — are stored as protected secrets, never in application code exposed to the browser. Access to production data is restricted to server-side processes and the operator. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Some of our service providers (such as Supabase, our email provider, and Google) may process or store data on servers located outside India. Where this happens, we rely on those providers' contractual and security safeguards, and such transfers are made in accordance with applicable Indian law.

SarthiLink™ is intended for users 18 years and older (or 16–18 with verifiable parental consent). We do not knowingly collect data from children in a manner inconsistent with the DPDP Act.

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, our Grievance Officer can be reached at grievance@sarthilink.com. Full details are on our Grievance Officer page.

We may update this policy as the platform evolves. Material changes will be reflected by the “Last updated” date above.