Privacy Policy | Collegepedia

Collegepedia (“we”, “us”) helps students and parents in India make college decisions on verifiable facts. This policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). We act as a Data Fiduciary in respect of the personal data we determine the purpose and means of processing.

1. Data we collect

Account data — name, email address, and password (stored only as a salted hash) when you register.
Profile & activity data — colleges you save, comparisons you run, reviews and forum posts you submit, and preferences such as your country and field of study.
Contributed content — reviews, ratings, and question/answer text you choose to publish.
Technical data — IP address, device and browser type, and pages visited, collected via cookies and similar technologies (see our Cookie Policy).

We do not knowingly collect data from children below the age of 18 without verifiable parental consent, as required by the DPDP Act.

2. Why we process your data

To create and secure your account and authenticate you.
To provide core features — search, comparison, recommendations, reviews, and the community forum.
To moderate contributed content and prevent abuse and fraud.
To improve the platform and understand which information students find useful.
To comply with applicable law and respond to lawful requests.

We process your data on the lawful bases of your consent and, where applicable, for legitimate uses permitted by the DPDP Act. You may withdraw consent at any time (see Section 5).

3. Sharing and disclosure

We do not sell your personal data. We share it only with processors (Data Processors) who host our infrastructure and send transactional email on our behalf, under contractual confidentiality and security obligations, and with authorities where required by law. Reviews and forum posts you publish are visible to other users by design.

4. Retention and security

We retain personal data only for as long as your account is active or as needed to provide the service and meet legal obligations, then delete or anonymise it. We apply reasonable security safeguards — encryption in transit, access controls, and hashed credentials — and will notify the Data Protection Board and affected users of a personal data breach as required by the DPDP Act.

5. Your rights

Under the DPDP Act you have the right to:

access a summary of the personal data we hold about you;
request correction, completion, or updating of your data;
request erasure of your data where it is no longer needed;
withdraw consent and, in some cases, nominate another person to exercise your rights;
grieve a concern and escalate to the Data Protection Board of India if unresolved.

To exercise any right, contact our Grievance Officer via our Contact page. We respond to verified requests within the timelines required by law.

6. Changes to this policy

We may update this policy as our service or the law evolves. We will revise the “Last updated” date above and, for material changes, notify registered users.