1. Introduction

RARE Academy, operated by RARE Integrated Services Private Limited (CIN: U74900AP2016PTC098067), having its registered office at FF-01, 1st Floor, PVR Residency, Near Lodge Center, 6/12 Brodipet, Guntur, Andhra Pradesh, India, 522002 (“RARE Academy,” “the Company,” “we,” “us,” “our”), is committed to protecting the privacy of everyone who uses our learning platform at rareacademy.in and the RARE Academy mobile apps for Android and iPhone (together, the “Platform”).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have over it. It is drafted in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and rules made thereunder.

This Policy applies to all individuals who create an account or interact with the Platform, including students, trainers, affiliates, and corporate or college program administrators. Where a section below applies specifically to one category of user, this is indicated.

By creating an account or using the Platform, you agree to the collection and use of your information as described in this Policy.

2. Age Eligibility

You must be 18 years of age or older to create an account or make a purchase on the Platform. RARE Academy does not knowingly collect personal data from individuals under 18 through self-registration, and our online purchases, workshops, and self-serve courses are intended for adult users only.

Institutional (college) programs: Where a student is enrolled as part of a batch under a college MOU arrangement rather than through self-registration, the enrolling institution is responsible for confirming the student’s eligibility and, where the student is a minor, obtaining verifiable parental or guardian consent as required by law before providing us with that student’s data. The institution’s MOU with RARE Academy incorporates this obligation.

If we become aware that we have inadvertently collected personal data from a minor without the appropriate consent, we will take steps to delete that data or restrict the account, and we invite parents/guardians to contact us at training@rareacademy.in to request removal.

3. Information We Collect

3.1 Information you provide directly

  • Account information: name, email address and mobile number. We do not use passwords: you sign in with a one-time code sent to your email.
  • Billing information: billing name, address and, if you choose to give it, your GSTIN (so that you can claim input tax credit), as needed to issue GST-compliant invoices
  • Communications: anything you send us by email, through Messages/support inside the Platform, mistake reports on course content, discussion posts, or grievance requests
  • AI Doubt Tutor questions: the questions you type or speak to the AI Doubt Tutor (see Section 12)
  • Investor Awareness Program requests: if you request an Investor Awareness Program, the contact details you give are used only to arrange and run that program. They are never used for marketing.
  • Acknowledgements: where a course requires it, the time you ticked the statement that RARE Academy certificates are not regulator (e.g., NISM/SEBI) certificates, before purchase or certificate download

3.2 Information generated through your use of the Platform

  • Learning activity: courses/units accessed, video-viewing progress, notes read, tool usage, bookmarks and your own notes
  • Assessment data: quiz, drill and mock-test attempts, answers and scores, and LivePoll answers, used to show your own progress and readiness indicators
  • Live-class attendance: when you joined and left a live class, time away from the class screen, and the resulting attendance mark (see Section 13)
  • Device information: because each account may be used on at most two devices, we keep an identifier and a label for each device you use. On the website and in the iPhone app the identifier is a random code our app creates; in the Android app it is the Android ID that your phone gives our app. The label is one we generate, such as “Chrome on Mac” or “RARE Academy app on Android”. We never collect your phone’s IMEI, serial number or MAC address; and, in the mobile app, a notification token if you turn on notifications
  • Technical data: IP address, browser/device type, app version, crash reports and usage logs, collected automatically for security and platform performance

3.3 Information from third-party service providers

  • Website payments: Razorpay shares transaction status (success/failure) and a payment reference ID with us. We do not receive, process, or store your card number, UPI ID, or net-banking credentials at any point — these are handled entirely within Razorpay’s secure, PCI-DSS compliant systems.
  • iPhone in-app purchases: Apple takes the payment for a course bought in the iPhone app. Apple shares with us only the purchase record: Apple’s transaction number, the course, the price, the App Store country and the purchase date. Apple does not share your Apple ID, name or payment details with us.
  • Video-delivery metrics: our video streaming provider records basic technical metrics (e.g., viewing duration, buffering events, IP-based access logs) for bandwidth management, content security, and to prevent unauthorised access/sharing of course videos.

4. How We Use Your Information

We use your personal data only for the following purposes:

  1. To create and manage your account and deliver purchased courses/programs
  2. To process payments and issue GST-compliant invoices and receipts
  3. To track your learning progress and compute assessment scores and readiness indicators for your own reference
  4. To answer your questions through the AI Doubt Tutor (Section 12) and to run live classes and record attendance (Section 13)
  5. To provide customer support and respond to your queries or grievances
  6. To send essential transactional communications (e.g., sign-in codes, purchase confirmations, access links, schedule changes, replies to your messages), by email and, if you allow it, by app notification
  7. To send marketing communications, only if you have said yes to receiving them (see Section 11)
  8. To improve our Platform, content, and course design based on aggregated usage patterns
  9. To detect and prevent fraud, bots, account sharing, unauthorised access or misuse of the Platform
  10. To issue certificates and let third parties verify a certificate you have shared with them (Section 5)
  11. To comply with legal, tax, and regulatory obligations

We do not sell your personal data to any third party. We do not use your data for automated decision-making that produces a legal or similarly significant effect on you — for example, your computed “readiness score” is a self-improvement indicator only and is never used to deny you access, disqualify you, or make any decision about you without your knowledge.

5. How We Share Your Information

We share personal data only in the following circumstances:

  • Service providers who process data strictly on our instructions to operate the Platform:
    • Supabase — account, database, sign-in and file storage (servers in Mumbai, India)
    • Vercel — website hosting (servers in Mumbai, India) and the gateway through which AI Doubt Tutor questions reach the AI model
    • Anthropic — the AI model that answers AI Doubt Tutor questions (Section 12)
    • Sarvam AI — turns spoken AI Doubt Tutor questions into text (Section 12)
    • Zoom — live classes (Section 13)
    • Razorpay — website payments; Apple — iPhone in-app purchases
    • Our video streaming provider — streams course videos to you securely
    • ZeptoMail (Zoho) — sign-in codes, receipts and other transactional email; Brevo — marketing email (Section 11)
    • Google Firebase — app notifications and app crash reports (Section 14)
    • Cloudflare Turnstile — checks that sign-in and sign-up forms are used by a person, not a bot
  • Corporate/institutional sponsored enrolments: Where your course access is sponsored by your employer or institution under a corporate or college program, that organisation’s authorised HR/L&D or placement administrators may see your enrolment status, unit progress, quiz/mock scores, live-class attendance and readiness data through reports or an organisational dashboard, for the purpose of training compliance, completion reporting, and remediation support. This applies only to sponsored (corporate-seat or college-MOU) enrolments — it does not apply to individual retail purchases.
  • Certificate verification: each certificate we issue carries a certificate number. Anyone who has that number (for example, an employer you shared your certificate with) can check it on our certificate verification page, which shows the name on the certificate, the course and the date of issue.
  • Alumni Credential Registry (opt-in, optional): if you choose to opt in after passing a certification, your credential and (if you separately consent) employment status may be shared with corporate partners on request, for example for placement purposes. This is entirely optional, requires your explicit consent, and you may withdraw at any time (see Section 10).
  • Legal requirements: where required by law, regulation, court order, or to protect the rights, property, or safety of RARE Academy, our users, or the public
  • Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to this Policy continuing to apply

6. Where Your Data Is Stored

Your account and platform data is stored on Supabase servers in the South Asia (Mumbai) region, and our website runs on Vercel servers in Mumbai, meaning your core personal data is stored within India.

Some processing necessarily happens outside India through specific service providers:

  • AI Doubt Tutor questions are answered by Anthropic’s AI model, processed in the United States (Section 12)
  • Live classes run on Zoom’s infrastructure, which may be outside India (Section 13)
  • Video delivery uses a global content-delivery network with servers outside India, to stream video to you quickly and reliably
  • Marketing email is sent through Brevo (European Union); app notifications and crash reports use Google Firebase; bot checks use Cloudflare — each on their global infrastructure

Where your data is processed outside India, it is done only by service providers bound by contractual data-protection obligations, and in a manner consistent with the DPDP Act, 2023 (which permits cross-border transfer of personal data except to countries specifically restricted by the Government of India).

7. Data Security

We take the security of your data seriously:

  • There are no passwords to steal: sign-in uses one-time codes sent to your email, protected by a bot check
  • Access to student data is restricted through role-based access controls and database-level rules, so trainers, affiliates, staff and corporate administrators can see only the data relevant to their role
  • All data in transit is encrypted (HTTPS); in the mobile app, your sign-in is kept in the phone’s encrypted storage
  • Payment data is never handled by us directly — it is processed entirely by Razorpay or Apple
  • We conduct periodic reviews of access permissions and security practices

No system can guarantee absolute security, but we take reasonable and appropriate technical and organisational measures, as required under the IT Act, 2000 and the DPDP Act, 2023, to protect your data against unauthorised access, loss, or misuse.

8. Cookies, Browser Storage and Analytics

We use cookies and similar browser storage for:

  • Essential functions: keeping you signed in, remembering your session and preferences (for example, light or dark mode)
  • Referral attribution: if you arrive through a referral or affiliate link, the referral code is kept in your browser so it can be applied at checkout
  • Bot protection: Cloudflare Turnstile on the sign-in and sign-up forms

We do not use Google Analytics or advertising cookies. On a few public tool pages (for example, the FIRE simulator), we use Vercel Web Analytics, which counts page visits without cookies and without identifying you.

You can clear or block cookies through your browser settings at any time; signing in will not work without them.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy:

Data type

Retention period

Account/profile data, learning progress, assessment results, live-class attendance, certificates, notes, messages

While your account exists. Erased when you delete your account (Section 10)

AI Doubt Tutor questions and answers

90 days, then deleted automatically. Recordings of spoken questions are never stored

Billing records, GST invoices and purchase records (including Apple purchase records)

8 years, as required under Indian tax and accounting law. After account deletion they show “Deleted user” instead of your name

Alumni Credential Registry data

Until you withdraw your consent

Marketing consent and unsubscribe records

Until you opt out, plus a reasonable period to demonstrate compliance

Grievance/complaint records

3 years

Where a longer retention period is required by law (e.g., tax records), that legal requirement takes precedence.

10. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the right to:

  1. Access a summary of the personal data we hold about you and how it is being processed
  2. Correct or update inaccurate or incomplete data
  3. Erase your personal data, subject to our legal retention obligations (Section 9). You can delete your account yourself at any time on the website (Delete my account) or in the app (Profile → Delete my account). Deletion takes effect immediately and cannot be undone: your results, progress and certificates are erased, and we can no longer verify a certificate we issued to you.
  4. Withdraw consent for any processing that relies on your consent (e.g., marketing communications, Alumni Registry participation, app notifications), without affecting the lawfulness of processing carried out before withdrawal
  5. Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
  6. Grievance redressal — raise a complaint with us, and if unresolved, with the Data Protection Board of India

To exercise any of these rights, write to us at training@rareacademy.in. We will verify your identity and respond within 30 days.

11. Communications and Marketing Preferences

When you create an account, you will receive transactional and course-related communications essential to your learning experience — for example, sign-in codes, purchase confirmations, access links, schedule or content updates, replies to your messages, and progress reminders for courses you are enrolled in. These cannot be opted out of, as they are necessary to deliver the service.

General marketing communications (e.g., promotions for other courses, newsletters, community updates unrelated to your active enrolment) are sent only to people who have clearly said yes to receiving them. Having an account or buying a course is not treated as a yes. Every marketing email includes an unsubscribe link, and you may also write to training@rareacademy.in at any time to opt out. Unsubscribing from marketing does not stop sign-in codes or receipts.

12. AI Doubt Tutor

The AI Doubt Tutor answers questions about your course material.

  • Typed questions are sent, together with the relevant course notes, through Vercel’s AI Gateway to an AI model provided by Anthropic, which processes them in the United States to write the answer. Your name, email and mobile number are not sent.
  • Spoken questions are sent to Sarvam AI (India) to be turned into text, and then handled like a typed question. The recording itself is never stored.
  • Questions and answers are kept for 90 days so that you can see your recent doubts and so that we can check quality, safety and misuse, and are then deleted automatically.
  • The tutor will not answer questions about specific securities, portfolios or personal financial decisions. Its answers may be inaccurate and are not advice.

13. Live Classes and LivePoll

Live classes run on Zoom. When you join, Zoom receives the display name you join with and connects you to the class. We record when you joined and left, time away from the class screen, and the resulting attendance mark and minutes present. Where your class is part of a sponsored (college or corporate) program, this attendance is shared with that organisation (Section 5).

LivePoll is our real-time quiz tool used during live or classroom sessions. It uses your RARE Academy account; your answers, scores and participation are stored on our own database in India and are used for the session, your own progress and any related reporting to your sponsoring program.

14. Mobile Apps

In addition to what is described above, the RARE Academy apps for Android and iPhone use:

  • App notifications (Google Firebase Cloud Messaging): only if you turn them on. We store a notification token for your phone, which is removed when you sign out. You can turn notifications off at any time in your phone’s settings.
  • Crash reports (Google Firebase Crashlytics): when the app crashes, a report with the device model, operating-system version, app version and the technical error is sent so that we can fix it. It does not include your course content or answers.
  • Microphone: only while you record a spoken question for the AI Doubt Tutor (Section 12).
  • Device identifier: to apply the two-device limit for your account (Section 3.2). It is never your phone’s IMEI, serial number or MAC address.
  • Screen protection: on Android, screenshots and screen recording of course content are blocked; on iPhone, the app detects screen recording during course content.
  • iPhone purchases: handled by Apple, as described in Section 3.3.

15. Trainers, Affiliates, and Corporate Administrators

If you hold a trainer, affiliate, staff or corporate-administrator role on the Platform, we collect the additional data necessary for that role (e.g., qualifications and payout records for trainers; referral codes and commission records for affiliates; organisational role for corporate HR users). Each role has access only to the data relevant to their function, enforced through role-based access controls (Section 7). This Policy applies to you in the same way it applies to students, with role-specific data handled as described here.

16. Third-Party Links

Our Platform may contain links to third-party websites (e.g., NISM, SEBI, IRDAI regulatory resources). We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies independently.

17. Data Breach Notification

In the unlikely event of a personal data breach that is likely to affect you, we will notify you and, where required, the Data Protection Board of India, in accordance with the DPDP Act, 2023, and take prompt steps to contain and remediate the breach.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with a revised “Last Updated” date. Continued use of the Platform after an update constitutes acceptance of the revised Policy. For material changes affecting how we use your data, we will make reasonable efforts to notify you directly (e.g., by email).

19. Grievance Officer

If you have any concerns, questions, or complaints about how your personal data is handled, please contact:

Grievance Officer

Sirisha Boddupalli

Email: sirisha@rareacademy.in

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, we will acknowledge your grievance within 48 hours of receipt and endeavour to redress it within one month from the date of receipt. If you remain unsatisfied with our resolution, you may escalate your complaint to the Data Protection Board of India.

20. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Guntur, Andhra Pradesh.

21. Contact Us

RARE Academy

An Educational Division of RARE Integrated Services Private Limited

CIN: U74900AP2016PTC098067

FF-01, 1st Floor, PVR Residency, Near Lodge Center, 6/12 Brodipet, Guntur, Andhra Pradesh, India, 522002

Email: training@rareacademy.in | Grievance Officer: sirisha@rareacademy.in

Operating Hours: Monday–Saturday, 9:00 AM – 9:00 PM IST