Privacy Policy
What we collect about students, parents and coaches, who we share it with, and the choices you have.
Who we are
To be completed: The legal entity operating Nexa Chess Academy, its address, and who to contact about data protection (grievance officer under India's DPDP Act, if required).
What we collect
- Your account
- Name, email, username, phone number, profile picture, time zone and your role (student, coach or admin).
- Student details
- For students: date of birth, chess rating, FIDE ID, and a parent or guardian's name, email, phone number and relationship.
- Coach details
- For coaches: bio, qualifications, FIDE details and experience; for payroll, payment details, PAN and GSTIN.
- Classes and learning
- When you joined and left each class, chat messages you sent, puzzle attempts, homework results, course progress, poll answers, and your puzzle rating and practice streak.
- Class video and recordings
- Classes run over live video and audio. A coach may record a class; recordings include the video, audio and chessboard of everyone present.
- Payments
- Orders, payments, invoices, refunds, subscriptions and your billing name and address (and GSTIN, if you give one). Card and UPI details are entered with the payment provider; we never see or store them.
- Sign-in and usage
- The devices you are signed in on (browser and IP address), when you last signed in or were active, and a record of key actions such as signing in, joining a class or watching a recording.
- Website visits and demo bookings
- On the academy website: a visitor cookie (kept for a year) and a session cookie, with your IP address, browser, device type, the page you arrived from and any campaign tags in the link. If you book a demo, the student's name and age, the parent's name, phone number and (if given) email address, and chess experience.
How we use it
To be completed: The purposes (running classes, attendance, progress, billing, coach payroll, reminders, support, security) and the legal basis or consent relied on for each, including verifiable parental consent for students under 18.
How long we keep it
- Sign-in sessions and reset links
- Removed a day after they expire.
- Website visit records
- Removed after 180 days of inactivity unless you booked a demo.
- Deleted accounts
- Can be restored for 30 days, then permanently removed — except records we must keep (below).
- Financial records
- Invoices, payments and payroll records are kept as tax law requires.
To be completed: How long class recordings, chat and learning records are kept, and the legal basis for keeping financial records.
Your choices and rights
Signed in, go to Profile → "Your data" to download a copy of everything we hold about you, and Profile → "Delete account" to ask us to delete your account. You can correct most details yourself on your profile.
To be completed: Your rights under the laws that apply (DPDP Act; GDPR for users in the EU/UK; COPPA for children in the US), how a parent exercises them for a child, and how to complain to a regulator.
Children
To be completed: How the academy obtains and records verifiable parental consent before collecting a child's data, and what a parent can see and control.
Security
Passwords are stored only as salted hashes, staff accounts can use two-factor sign-in, sessions expire, and repeated wrong passwords lock an account for 15 minutes. Invoices and payment proofs are stored privately and only open through your signed-in account.
Changes to this policy
To be completed: How users are told about changes to this policy, and the date it takes effect.