Privacy notice
Version privacy-2026-10-v1 · In force from 12 November 2026
This notice tells you what personal data we collect, why, who sees it, how long we keep it and what rights you have. We collect as little as we can. Most of our site — course pages, free lessons, the knowledge hub — works without an account, and then we do not know who you are.
1. Who we are
LEA.Training (lea.training) is an online training platform. It is owned and run by VSVSV (Vidhi Sangat Vidyut Saksya Vinaya) Tech Private Limited, a company registered in India (CIN U85499TS2023PTC180277), 7-2-1669/Athena-C/0306, Lodha Casa Paradiso, Sanath Nagar Colony, Hyderabad, Telangana 500018, India. In these pages "we" means that company.
In the India edition we also sell you the course. Our bills are GST tax invoices.
Questions about your data: grievance@vsvsv.tech.
2. What we collect and why
| What | Details | Why |
|---|---|---|
| Your account | Full name; Indian mobile number (needed) and email (optional); password (stored only as a one-way hash); edition; country (optional); the role you pick ("I am a…"), which only changes which units are marked core for you | To create and protect your account and show you the right courses. |
| Your choices | Which versions of the terms, privacy notice and acceptable-use rules you accepted, and when; whether you agreed to show your full name on the verify page; whether you want emails about new courses | To prove what you agreed to and respect your choices. |
| Sign-in codes | One-time codes sent by SMS or email. We keep only a scrambled (hashed) form, for 10 minutes | To check it is really you. |
| Your learning | Which lessons you opened or marked complete, and when; your answers, scores and times in learning checks and assessments; your Records of Completion. We do not record time spent on a page or what you click. | To give you the course, keep your place, mark assessments and issue Records. |
| Purchases | Course or bundle bought, price, currency, discount code used, billing country and GST state, payment status and the payment provider's reference numbers. Your card or bank details stay with the payment provider. | To sell you the course, give you access and meet tax law. |
| Invoices and receipts | Your name, billing country, state, what you bought and the tax. Kept in a private store, never on a public link. | Tax and accounting law. |
| Messages | What you send us by email or the contact page, and our replies | To help you. |
| Technical logs | Our servers record each request: the IP address, the date and time, the page or address asked for, and the browser type. Kept 180 days (see below). Only server staff can see them; not used for marketing or analytics, and not used to build a profile of you. Separately, our own server uses your IP address for a moment to look up your country (in the DB-IP country list kept on that server) and suggest an edition; the country is not stored and nothing is sent to anyone else. | Security, fixing faults, and the Indian CERT-In rule on keeping logs. |
What we never collect: identity documents, photos of you, your location, your contacts, your card number, your caste, religion, health or biometric data. We do not ask you to prove your job. Picking a role ("I am a…") tailors the course; it does not check anything.
3. What we do not do
- We do not sell your personal data.
- We do not use advertising or third-party tracking cookies, pixels or analytics. See Cookies.
- We do not use your data to train AI models and do not share it for anyone else's marketing.
- We send you emails about new courses only if you said yes. Messages about your account, purchases and security are always sent.
4. Who sees your data
We share personal data only with these people and companies, and only what each one needs:
- Hostinger — our servers and database, in India (Mumbai).
- Amazon Web Services — storage for videos, pictures and encrypted backups, in India (Mumbai region).
- Google — sends our emails (Gmail / Google Workspace). Google may process email data in the USA and other countries.
- Google Firebase — sends notifications to our mobile app, if you use it and allow notifications.
- 2Factor — sends sign-in codes by SMS, in India.
- Razorpay — takes payments in the India edition, in India.
- Your organisation, if it paid for your seat: it sees your progress, scores and Records — not your individual answers.
- Anyone you give a Record number to can check it on the verify page (initials unless you agreed to your full name).
- Authorities, when the law requires us to, for example a lawful order from a court or the police. We check that each request is lawful and give only what it requires.
5. How long we keep it
| Data | How long we keep it |
|---|---|
| Account, learning record, Records of Completion | Until you delete your account. If an account has not been used for 3 years and has no active course, we may delete it after emailing you. |
| Sign-in codes | 10 minutes |
| Signed-in sessions | Up to 7 days, or until you sign out |
| Orders, invoices and receipts | 8 years after the end of the financial year, as Indian tax and company law requires |
| Messages to us | 2 years after the matter is closed |
| Technical logs (IP address, time, page asked for, browser type) | 180 days, as the Indian CERT-In rule asks; then deleted. From May 2027: one year, as Indian data-protection rules require |
| An account you asked us to delete | Closed at once; personal data locked for 30 days and then erased (from May 2027: no earlier than one year after it was last used). Your old-app forum posts, reviews and chats are deleted at the same time |
| Backups | Deleted data disappears from our backups within 30 days |
| Record of what we did with your data (from May 2027) | Indian data-protection rules will require us to keep personal data and the logs of each use of it for at least one year from that use, even after you delete your account. We keep it locked away, use it only for the purposes those rules list (such as security and lawful investigations), and then erase it |
Server logs. Our servers write a short technical line for every request they receive: the IP address, the date and time, the page or address asked for (and whether it worked), and the browser type your browser reports. We keep these logs for 180 days and then delete them. We need them to keep the service secure (to find and stop attacks and misuse) and because Indian cyber-security rules (the CERT-In directions of 28 April 2022) ask service providers to keep such logs for 180 days. Only a few staff who run the servers can see them. We do not use them for marketing or analytics, and we do not use them to build a profile of you. From May 2027, Indian data-protection rules (Digital Personal Data Protection Rules 2025) ask us to keep logs for one year; we will then keep them one year and update this notice.
Your country (for the edition). When a page of the website is asked for, our own server looks up which country the IP address belongs to, in a country list kept on that server ("IP to Country Lite" by DB-IP.com, licensed CC BY 4.0). Only the two-letter country code is passed on, to suggest the India, Australia or Global edition. Nothing is sent to DB-IP or anyone else, the country is not stored with your account or in a cookie, and you can always pick another edition. Prices, tax and the seller are set by your billing country at checkout, never by this guess.
When you delete your account. Your account is closed at once. Your personal data is locked for 30 days (so a mistake, or a deletion by someone who got into your account, can be put right) and then erased. From May 2027, Indian data-protection rules (Digital Personal Data Protection Rules 2025, rule 8(3)) require us to keep it, locked, until at least one year after it was last used, so the erase can come later than 30 days. When we erase it, we also delete what you wrote in the old LEA.Training app: forum questions (with the answers to them), forum answers, course and trainer reviews, and your chat conversations. Invoices and order records are kept for as long as tax law requires. See Delete your account.
6. How we protect it
Passwords are stored only as one-way hashes. Sign-in codes are stored only in hashed form and expire in 10 minutes. Connections use HTTPS. Staff access needs two-step sign-in and every admin action is logged. Invoices are kept in a private store. If a breach of your personal data happens, we will tell you and the authorities as the law requires.
Your rights under Indian law
India's Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 protect your personal data. Most of the duties in the Act start in May 2027; we already follow them now. Until then the Information Technology Act 2000 and its 2011 rules on sensitive personal data also apply.
We are the Data Fiduciary for your personal data. We use it on the basis of the consent you give when you sign up, or for uses the law allows without consent (for example, to meet tax law).
You have the right to:
- Get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correct, complete or update it. You can change most details in your account; for others, ask us.
- Have it erased, unless the law makes us keep it (for example invoices). See Delete your account.
- Withdraw your consent at any time, as easily as you gave it. Withdrawing does not affect what we did before, but we will no longer be able to run your account, so withdrawing consent to the account means closing it.
- Nominate another person to use these rights for you if you die or cannot act yourself.
- Have your grievance dealt with. Write to our Grievance Officer (below). We reply within one month (the law allows up to 90 days; we aim for faster).
- Complain to the Data Protection Board of India, through the means the Board publishes. The law asks you to come to us first.
How to use your rights: email grievance@vsvsv.tech from the email address or mobile number on your account (or tell us that number), say which right you want to use, and we will reply. We may ask you to confirm a code to prove it is you.
Person who answers your questions about your data (Grievance Officer): Capt. Nilesh Tiwari (Retd.), Director, VSVSV (Vidhi Sangat Vidyut Saksya Vinaya) Tech Private Limited, 7-2-1669/Athena-C/0306, Lodha Casa Paradiso, Sanath Nagar Colony, Hyderabad, Telangana 500018, India. Email: grievance@vsvsv.tech.
Children: our service is only for people aged 18 or over. We do not knowingly process the data of children.
Changes to this notice
The version and date are at the top of this page. If we change how we use your data in a way that matters, we will tell you before it happens and, where needed, ask for your consent again.