Privacy Policy
Last updated: 25 October 2026
This policy explains what personal data Comitat Co. collects, why, who sees it, how long we keep it, and how you control it. We wrote it in plain language on purpose. If something is unclear, email us and we will explain.
1. Who we are
Comitat Co. ("Comitat", "we", "us") runs this website: free software courses, career programmes with an internship, video courses, documentation, career tools and digital marketing services. For the purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the DPDP Rules, 2025, we are the Data Fiduciary. We decide why and how your data is used.
Contact and Grievance Officer: Poorna Chandra S, Comitat Co. Email: admin@comitat.co.in. You can also use the contact form.
2. What we collect
| What | Why we need it | When |
|---|---|---|
| Email and password | To create and protect your account. Passwords are stored only as a salted one-way hash. We cannot see them. | Sign-up |
| Name, date of birth | To address you, put your name on certificates, and confirm you are 18 or older. | Sign-up |
| Degree, learner or employed status, company, LinkedIn link, optional photo | To shape learning and career tools for you and to show your profile. | Sign-up, profile |
| Programme application: phone, city, background, preferred schedule and class mode | To assess your application, contact you about it, run classes and the internship, and issue certificates. | When you apply |
| Learning records: lessons opened, lectures completed, grades, certificate ID | To track progress, grade modules and let employers verify a certificate you share. | While you learn |
| Text you type into the AI tutor and career tools (questions, resume details, job descriptions) | To produce the answer you asked for. | When you use them |
| Resume files you upload to the ATS check | To read the text and report problems. The file is processed in memory and is not stored. | When you use it |
| Skill Passport (optional): your name, learning track, start date, courses and lectures completed, programmes | To create the card and LinkedIn post you choose to share. If you switch on the public link, anyone with the link can see these details; switch it off any time. | Only when you use it |
| Messages and enquiries (name, email, message, website) | To reply to you. | Contact or services form |
| Security data: IP address, sign-in times, failed sign-in attempts, request counts | To stop abuse, block password guessing and keep the site available. | Every visit |
We do not collect payment card or bank details on this website. If you pay a programme fee, the payment is handled by the bank or payment service you use, and we only record that the fee was received.
Please do not type sensitive information (health details, government ID numbers, passwords, financial details) into the AI tutor, career tools or messages. We do not need it.
3. The legal basis we rely on
- Your consent, which you give at sign-up, when you apply to a programme and when you send a message. You can withdraw it at any time (section 8). Withdrawal does not undo what was lawfully done before it.
- Legitimate uses allowed by Section 7 of the DPDP Act, for example data you give us voluntarily for a specific purpose, and data we must keep to meet a legal obligation.
- If you are in the European Union or the United Kingdom, we rely on your consent, on performing the service you asked for (contract), and on our legitimate interest in keeping the site secure.
4. Who we share it with
We never sell your data, and we do not use advertising or tracking cookies. We share data only with:
- Service providers that run the site for us, under their own data protection terms: Vercel (hosting), MongoDB Atlas (database), and Google (the Gemini API, which writes AI tutor answers and resume drafts from the text you submit). They process data on our instructions. Our team may also use Anthropic's Claude API to help draft course and documentation pages; your personal data is not sent to it.
- Companies and recruiters, only for job or reference purposes, and only when you apply through us or ask us to share your profile. We share what is needed for that request and nothing more.
- Anyone checking a certificate you gave them: the verification page shows the name, programme, grade and date on that certificate.
- Authorities, when Indian law or a valid legal order requires it.
Our providers may store data on servers outside India. We only use providers that protect it with security measures at least as strong as ours, and we do not transfer data to any country the Government of India has restricted.
5. Cookies and local storage
We use one essential cookie, named token, to keep you signed in. It is HTTP-only (scripts cannot read it), sent only to this site, and expires after 7 days.
Your light or dark mode choice is saved in your browser's local storage. There are no analytics, advertising or social media trackers on this site.
Videos play through YouTube's privacy-enhanced player or Vimeo's player; when you press play, their own policies apply.
6. How long we keep it
- Account and profile: while your account is open. When you close it, we delete it from our live database straight away.
- Programme records, grades and certificate IDs: as long as needed to run the programme and to let employers verify certificates you share, unless you ask us to delete them and no law requires us to keep them.
- Messages and enquiries: up to 2 years, then deleted.
- Security records: failed sign-in records about 30 minutes, rate-limit counters a few minutes, server logs kept by our host for a short period.
- Backups made by our database provider are overwritten on their normal schedule.
7. How we protect it
Passwords are hashed. Sign-in uses an HTTP-only, SameSite cookie over HTTPS. A password change signs out every other device. Repeated wrong passwords lock the account for 15 minutes. Requests are rate-limited, cross-site requests are blocked, uploads are size-limited and checked, and admin tools need an admin account. Paid lecture links are only given to people with access. No system is perfectly secure, but we work to keep the risk low.
If a personal data breach happens, we will inform the Data Protection Board of India and the people affected, as the DPDP Act and Rules require, with what happened, what it means for you and what we are doing about it.
8. Your rights, and how to use them
- See and correct your data: open My profile. Everything you gave us at sign-up can be edited there.
- Erase your data and withdraw consent: in My profile, use "Close my profile permanently". Or email us and we will do it for you.
- Get a summary of the data we hold about you and who we shared it with: email us.
- Stop notifications: untick them in My profile at any time.
- Nominate someone to use these rights for you if you die or cannot act yourself: email us with their name and contact.
- Complain: write to our Grievance Officer (section 1). We acknowledge within 7 days and aim to resolve within 30 days. If you are not satisfied, you can approach the Data Protection Board of India.
EU and UK visitors also have the rights to data portability and to object, and can complain to their local data protection authority.
9. Age
Accounts, programmes and career tools are for people aged 18 or older. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 18, we close it and delete the data. Parents or guardians can contact us to ask for this.
10. Changes to this policy
If we change how we use your data, we will update this page and the date at the top. For important changes we will tell you on the site or by email, and ask for fresh consent where the law requires it.