sutra

Privacy Policy

What we collect, why, and what you can ask us to do about it.

Last updated 29 September 2026

[REVIEW] This page is a draft prepared for the Department of Design, IIT Guwahati. It must be checked by the institute before launch. Every point marked [REVIEW] needs a decision.

Who we are

Sutra is operated by the Department of Design, Indian Institute of Technology Guwahati. [REVIEW] Confirm the exact legal entity that contracts with clusters, and its registered address.

What we collect

  • Account details: your name and email address, and a securely hashed password. We never store your password itself. Your cluster's admin enters these when they add you.
  • Learning activity: which applications you open and your progress within them, so your work syncs across devices, and your trainer can follow it.
  • Support correspondence: anything you send us through the contact form.

Why we collect it

To give you access to the applications your cluster has bought, to sync your progress, and to answer your questions. [REVIEW] Confirm whether learning activity is also used for research, and if so, whether it is anonymised and whether ethics approval is required.

Who we share it with

  • Your cluster's admin and your trainer, who can see your name, email and progress.
  • Our hosting and database providers, who store this data on our behalf.

We do not sell your personal data.

How long we keep it

For as long as your account exists. If your cluster is reset (for example when it renews for fewer places), every account in it is deleted together with its progress; copies remain only in encrypted system backups for up to 7 days, and are then gone permanently. [REVIEW] Confirm the backup retention period.

Your rights

Under the Digital Personal Data Protection Act, 2023, you may ask us to show you the data we hold about you, correct it, or delete your account. Write to us at the address below and we will respond within [REVIEW] days.

Children

[REVIEW] The DPDP Act treats users under 18 as children and requires verifiable parental consent. If school students will use these applications, this section must set out how that consent is obtained.

Grievance officer

[REVIEW] Indian law requires a named grievance officer with contact details. Add the name, designation and email here.

Changes

We will post any change to this policy on this page and update the date shown above.