Privacy Policy

1. Scope & Legal Framework

This Privacy Policy describes the privacy standards, data practices, and security procedures adopted by Lyran Technology & Innovation Private Limited, operating as "Lyran Labs" ("we", "us", or "our") across our websites (lyranlabs.com and its subdomains), learning platforms, course dashboards, and AI support tools.

This Policy is formulated in strict accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Information We Collect

We collect only the minimum necessary data to provide our STEM education, hardware, and consultation services:

• Identity & Contact Details: Name, verified email address, mobile number, physical address, and institutional or corporate affiliation.
• Academic Profile: Class/grade, school board (CBSE, ICSE, IB, State), college degree stream, semester, and enrolled batch.
• Authentication Data: Salted password hashes, multi-factor verification OTPs, and session tokens.
• Billing & Transaction Records: Invoices, transaction reference numbers, and enrolled course history. Note: Payment card and banking credentials are handled directly by RBI-regulated, PCI-DSS compliant payment gateways (e.g. Razorpay, Stripe); Lyran Labs does not store sensitive cardholder details.
• Telemetry & Security Logs: IP address, device fingerprints, operating system data, browser headers, referring URLs, and diagnostic logs for cybersecurity defense.
• Communications: Submissions through contact forms, email correspondence, and conversational messages exchanged with the Lyran AI Chatbot.

3. Lawful Purposes for Data Processing

We process your personal data under lawful grounds (consent, legitimate interest, and statutory obligations) for:

1. Educational Service Delivery: Providing access to specialized course portals, video curriculum, live instructor batches, doubt clearance, and automated project grading.
2. Verification & Certification: Issuing verifiable digital certificates with unique cryptographic hashes, verifying student eligibility, and publishing academic achievements with user consent.
3. Platform Security & Anti-Spam: Utilizing rate-limiting, honeypots, and bot-verification technologies (including Google reCAPTCHA v2 and internal case-sensitive verification codes) to prevent DDoS attacks, credential stuffing, and phishing attempts.
4. Transactional Communications: Sending critical course updates, schedule modifications, fee receipts, password reset links, and security alerts.
5. Service Improvement & Analytics: Analyzing aggregated, anonymized usage telemetry to optimize platform performance and improve STEM curriculum quality.
6. Statutory Compliance: Fulfilling tax obligations (GST), maintaining mandatory financial records, and complying with court summons or regulatory directives.

4. Data Sharing & Third-Party Processors

We share data strictly on a need-to-know basis with vetted infrastructure providers bound by confidentiality:

• Cloud Infrastructure: Certified secure server hosting, database clusters, and Content Delivery Networks (CDNs).
• Payment Gateways: PCI-DSS Level 1 certified processors for course fees and hardware purchases.
• Transactional Communications: Encrypted email relay providers and verified SMS gateways for OTP dispatch.
• Analytics: Google Analytics 4 with IP anonymization enabled for measuring aggregated performance.
• Legal & Law Enforcement: Strictly when compelled by an official order from an Indian court, judicial authority, or statutory investigative body having competent jurisdiction.

5. Data Security & Technical Safeguards

In compliance with Rule 8 of the IT Rules 2011, we implement comprehensive multi-layer protections:

• 256-Bit TLS Encryption: All data in transit between your browser and our servers is secured using modern TLS/HTTPS encryption.
• Salted Cryptographic Hashing: User credentials are protected using salted PBKDF2/SHA-256 password hashing.
• Role-Based Access Control (RBAC): Employee access to user databases is strictly partitioned and audited.
• Proactive Defense: Automated rate-limiters, CSRF protection middleware, and periodic vulnerability scanning.

6. Data Retention & Localization

6.1 Retention: We retain personal data only for as long as necessary to administer educational programs, issue certificate verifications, handle disputes, and satisfy statutory tax record retention requirements.

6.2 Data Localization: Primary databases and records are hosted on secure servers located within the territory of India and certified cloud facilities adhering to Indian data localization principles.

7. Data Principal Rights (Under DPDP Act)

As a Data Principal under Indian law, you have enforceable legal rights:

• Right to Access: Request a summary of the personal data we process regarding you.
• Right to Correction & Update: Correct or complete inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): Request the deletion of your account and personal data, subject to statutory record obligations.
• Right to Withdraw Consent: Opt-out of non-essential communications (such as newsletters) at any time.

8. Children's Privacy (Minors)

As a STEM education provider for school and university students, we exercise special care regarding minors under 18 years of age:

• Minors may register only with the knowledge and supervision of a parent, legal guardian, or their participating school.
• We do not engage in behavioral profiling, tracking, or targeted advertising directed at children.
• Parents or legal guardians may review or request deletion of their child's records by contacting our Grievance Officer.

9. Cookies & Bot Verification

Our website utilizes:

• Essential Session Cookies: Required to maintain secure login sessions, CSRF token security, and cart states.
• Analytical Cookies: Anonymized Google Analytics 4 cookies to measure platform speed and popular content.
• Bot Verification (Google reCAPTCHA v2 & Internal CAPTCHA): Our contact forms use Google reCAPTCHA v2 and our internal case-sensitive challenge system to assess whether submissions originate from human visitors or malicious automated bots. You can review the Google Privacy Policy.

10. Statutory Grievance Redressal

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, you may address any privacy concerns or grievances to our designated officer: