Paatya

Privacy Policy

Version 2026-10-15, in force from 15 October 2026

This policy explains what Paatya keeps about academy owners, admins and learners, why, and for how long.

1. What we keep

  • Account details: name, email, mobile number and a one-way hash of your password.
  • Learning activity: courses, progress, quiz answers and certificates, the days you signed in or studied, and how long you spent watching lesson videos.
  • Billing: recharges, invoices, GST details and usage records.
  • Course purchases, where an academy sells courses online: what was bought, the price, discount and any GST, the payment status and reference, receipts and refunds. Card, UPI and bank details are entered on Razorpay's checkout and are never stored by Paatya.
  • An academy's payout account, if it sells courses online: its legal name, business type, contact person, email and mobile, and its bank account's holder name, IFSC and last four digits. The PAN and the full account number are passed to Razorpay and not stored by Paatya.
  • WhatsApp alerts, if an academy admin or platform admin switches them on: the WhatsApp number they give, when they agreed and confirmed it, and when they switched alerts off or replied STOP. For each alert, the number it went to, what it said and whether it was sent, delivered and read. Learners are never sent WhatsApp alerts, and alerts carry no learner's name or contact details, only counts.
  • Security: sign-in times and devices, failed sign-in attempts and any temporary block they caused, the IP address and browser used when terms were accepted, and security events such as a blocked sign-in or a failed bot check, with the IP address involved.

2. Why

To run your academy, to charge for what it uses and issue invoices, to take payments for courses an academy sells and pass the academy its share, to keep accounts secure, and to send the emails and messages the academy and its learners need. We do not sell personal data.

While a learner watches a lesson video, their name and the last four digits of their mobile number (or their email, if there is no mobile) are shown faintly over it, to discourage recording and sharing. This is drawn on the learner's own screen and nothing new is stored.

3. Who else sees it

An academy's admins see the learners of their own academy, including what learners bought from it. Our service providers handle data only to provide their service: Amazon Web Services (hosting), ZeptoMail (email), Razorpay (payments, transfers to academies and payout-account checks), Meta (WhatsApp alerts to admins who switch them on), Cloudflare (the bot check on signup forms) and Google Analytics, as described below. When a learner buys a course, their name, email and mobile number are passed to Razorpay's checkout so they don't have to type them. The full list is on the Sub-processors page.

For learners, the academy decides what is kept about them and why; Paatya keeps it on the academy's behalf. For payments, Paatya and Razorpay also keep what payment, tax and anti-fraud law requires.

4. How long

Account and learning data is kept while the academy is active. Billing, payment and refund records are kept for as long as tax law requires. Unfinished signups are deleted within a few days. Our servers' security logs, which include IP addresses, are kept for 90 days.

5. Your choices

An admin can switch WhatsApp alerts off at any time in the settings, or by replying STOP to any alert. Emails about the account continue either way.

You can ask for a copy of your data, or for it to be corrected or deleted, by writing to the academy's support address or to us at support@paatya.net. We answer within one month. Some billing and payment records must be kept by law, even after an account is deleted.

6. Cookies and website analytics

We use Google Analytics to understand how visitors find and use public pages: the Paatya website, and each academy's home page, public course pages and sign-in pages. Pages you see after signing in are never measured this way; what you do inside an academy is kept only in Paatya's own records, as described above.

Nothing is stored in your browser for analytics until you accept. If you accept, Google Analytics sets a cookie holding a random identifier and records the pages you visit, where you came from, your approximate location (country and city, worked out from your IP address) and your type of device and browser. It is not given your name, email address or anything you type into a form. Until you choose, and if you refuse, pages send Google only a signal without cookies that the page was seen. We have switched off Google's advertising features for this data, and Google keeps it for 14 months.

An academy may also send visits to its public pages to a Google Analytics account of its own. It is then responsible for that account, and your choice here applies to it too.

You can change your choice at any time with the cookie settings link at the foot of each public page.