Privacy Policy

1What we collect

You give us

• Your email address, used to sign in, to send your certificate and to remind you about renewal.
• Your coaching background — sport, years coaching, city, employment type, organisation, age groups, languages you can be assessed in, and any certifications you declare.

DigiLocker gives us, with your consent

When you verify your identity we receive, from the government’s DigiLocker service via our partner Setu, only:

• Your name as recorded on Aadhaar
• Your date of birth and gender
• The last four digits of your Aadhaar number

The assessment produces

• Voice recordings of your spoken answers, and their transcripts.
• Competency outcomes and the evaluation behind them.

We generate

• Payment records — amount, reference, transaction id and mode. Your UPI PIN and banking credentials never reach us. Your UPI address is stored only as a one-way hash, so a disputed payment can be matched without us holding the address.
• Security and audit records. IP addresses are stored only as a salted one-way hash, never in the clear. The audit log holds identifiers and state changes only — never names, numbers or transcripts.

We do not use advertising trackers, we do not sell personal data, and we do not build advertising profiles.

2Why we process it, and on what basis

Under the DPDP Act we rely on your consent, taken separately for each purpose, and on legitimate uses where the Act allows.

• Identity verification — consent. A certificate that is not tied to a verified person is worthless.
• Assessment recording and evaluation — consent. We cannot evaluate spoken judgement without recording it.
• Issuing and publishing certification status — consent. Public verifiability is the point of the product.
• Payment, tax and accounting records — legal obligation.
• Security, fraud prevention and audit — legitimate use.

You can withdraw consent at any time. Withdrawing it for identity verification or assessment recording means certification cannot continue and a live certificate lapses at renewal, because the evidence underneath it no longer stands.

3Who else processes your data

We share personal data only with the processors below, only for the stated purpose, and under contract. We do not sell it, and we do not share it with advertisers or data brokers.

We may also disclose data where the law requires it — a binding court order, or a lawful request from a competent authority. Where a safeguarding disclosure is required by law, we comply, and we tell you unless telling you is itself unlawful.

4What becomes public

A certified coach has a public profile so parents and academies can check the certificate. It shows your first name and last initial, your sport, your city, your years of experience, the age groups you coach, and your certification status and dates.

It never shows your email address, your phone number, any part of your Aadhaar number, your date of birth, your address, your assessment recordings or transcripts, or which competencies took more than one attempt.

5Where it is stored, and how it is protected

All personal data is stored in India, in the Mumbai region (ap-south-1). It is not transferred outside India.

• Encrypted in transit (TLS) and at rest.
• Row-level security in the database, so one coach’s records are unreadable from another coach’s session even if the application layer is bypassed.
• Minimisation by design. Aadhaar numbers are stored masked, IP addresses and UPI addresses only as one-way hashes, and the audit log is built so that personal data cannot be written into it.
• Append-only records. Consent and audit entries cannot be edited or deleted, including by us, so what you agreed to cannot be quietly rewritten.
• Access limited to staff who need it, and logged when used.

If a personal data breach occurs we will notify the Data Protection Board of India and affected users as the DPDP Act requires.

6How long we keep it

Some records outlive your account on purpose. Rather than claim we delete everything, here is exactly what is kept and why.

“Unlinked on erasure” means the record survives with every identifier pointing to you removed. What remains is that a consent was given, or a payment was made, under a stated notice version at a stated time — with nobody attached to it.

7Your rights

Under the DPDP Act you have the following rights. Write to privacy@axiopro.in to exercise any of them. We respond within thirty days and we do not charge for it.

8Children

Axio accounts are for adults. We do not knowingly collect personal data from anyone under eighteen, and we do not create profiles for the children a coach trains. If you believe a child has created an account, tell us and we will delete it.

9Grievance officer

[GRIEVANCE OFFICER NAME]
[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
privacy@axiopro.in

If we do not resolve your complaint to your satisfaction, you may escalate it to the Data Protection Board of India.

10Changes to this policy

If we change how we use personal data in a way that materially affects you, we will email you before it takes effect and, where the law requires it, ask for fresh consent. Past versions are available on request from our legal page.