1. Who we are
[Platform name, to fill] is an online design school and studio platform at nidihub.org, run by [responsible body, to fill] at the Industrial Design Centre, IIT Bombay. In this policy, “we” means that team, and “the platform” means the website and the tools you reach from it with the same sign-in.
This policy explains what personal data the platform keeps, why, where, for how long, and what you can ask us to do with it. It follows India’s Digital Personal Data Protection Act, 2023.
2. What this policy covers
One account opens all of these, and this policy covers all of them:
- The school: courses, lessons, your progress and the student dashboard.
- The community: profiles, groups, the activity feed, forums and private messages.
- The tools: GIDhub (code and project repositories), Design (Penpot), Sketch (Excalidraw), the AI assistant, and Ask, the course AI assistants in GID Studio and on lesson pages.
- The sign-in that connects them.
3. What we collect
When you get an account
Your username, your name, your email address and a password. Your password is stored only as a secure one-way code (a “hash”); nobody at the platform can read it. We also note which groups you belong to (for example, students of a course), because that decides what you can open.
When you learn
The courses you are enrolled in, the lessons you complete and when, and your progress.
When you take part
What you choose to post or upload: your profile details, posts in the activity feed and forums, private messages, and the files you keep in the tools, such as repositories in GIDhub, designs in Penpot and drawings in Sketch.
When you use the AI assistant
What you type and the answers you get, kept in your own chat history until you delete them.
When you use Ask
Ask sends only what you choose: your question and the conversation so far in that panel, the lesson you are on (with the minute of the lecture) unless you take it off, and a picture only if you add one. We do not keep your questions or the answers. The conversation stays in your GID Studio window or your browser tab, and is gone when you close it or start a new conversation. Our servers record only that you asked, when, and how long the answer took, never what you wrote. Ask is optional; every course can be followed without it.
Automatically
A record of sign-ins, and short-lived technical logs (including your IP address) that the servers keep to run and protect the platform. We do not use analytics or tracking tools.
4. What we do not do
- We do not sell or rent your data.
- We do not show advertising, and we do not use advertising or analytics trackers.
- We do not use your data to build a marketing profile of you.
5. Why we use it
- To give you your account and one sign-in for every tool.
- To run your courses: enrol you, show your progress, and let your instructors see how you are doing in their course.
- To let you take part in groups, forums and messages.
- To keep the platform secure and working: preventing abuse, fixing faults, and restoring from backups when needed.
- To contact you about your account or your courses (for example, a password-reset link).
- To answer your questions with the course AI assistants (Ask). Their answers are marked as AI and can be wrong. No decision about you is made by AI: grades and assessment are always by people.
6. Who else can see it
Inside the platform
Other signed-in members can see your profile, your public group and forum posts, and your name next to them. Private messages are seen only by the people in the conversation. Instructors can see enrolment and progress in the courses they teach. A small number of administrators can see account data when that is needed to run the platform.
Community and course pages are for signed-in members only; the course catalogue and course descriptions are public.
Services that help run the platform
| Service | What it receives | Where |
|---|---|---|
| Hostinger (hosting) | Everything on the platform, stored on the server we rent | Mumbai, India |
| YouTube, by Google (lesson videos) | Videos are embedded in YouTube’s privacy-enhanced mode: nothing is stored on your device when a page loads. When you play a video, YouTube receives your IP address and may store information on your device | Google’s servers |
| OpenRouter (AI answers for Ask) | What Ask sends (see section 3), plus the passages from the course lectures found for your question, to produce an answer | Outside India. OpenRouter, a US company, passes each request to one of the AI providers it works with, which may be in the USA or elsewhere. We allow only providers that keep nothing (zero data retention) and do not train on what they receive, and OpenRouter itself does not store prompts. |
| Email service | [to fill when connected] – your email address and the message, to deliver it | [to fill] |
We share data with authorities only when the law requires it.
7. Where it is kept, and for how long
- Where: on the platform’s server in Mumbai, India, and in backup copies on IIT Bombay’s own equipment. The only exception is Ask: your question is processed outside India by OpenRouter’s providers to produce an answer, and is not kept there or by us (section 6).
- Your account and what you created: for as long as your account exists. When an account is closed, its data is removed, except where we must keep something by law.
- Backups: a full copy is made every night. The server keeps the last 7 and IIT Bombay keeps the last 14, so a deleted item disappears from all backups within about two weeks.
- Technical logs: kept only briefly and overwritten automatically, usually within days.
8. Cookies
The platform uses only the cookies it needs to work: to keep you signed in, to remember that you are signed in across the tools, and to protect forms against abuse. There are no advertising or analytics cookies. Lesson videos use YouTube’s privacy-enhanced mode, so YouTube stores nothing on your device unless you play a video; if you do, it may (see section 6).
9. How we protect it
- All connections use encryption (HTTPS).
- One sign-in with strong password rules, and access to accounts only by invitation.
- Administrator access is limited to a few people.
- Nightly backups, copied off the server and test-restored every week.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.
10. Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or update it;
- erase it, including closing your account;
- withdraw consent for anything that relies on it (this may mean you can no longer use part of the platform);
- nominate someone to act for you if you cannot.
You can change much of it yourself in your profile and account settings. For anything else, or to raise a concern, write to [contact email, to fill]. We will reply within [time, to fill]. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
11. Children
The platform is for adult learners. If anyone under 18 needs to use it, we will ask for verifiable consent from a parent or guardian first, as the law requires.
12. Changes to this policy
When the platform changes in a way that affects your data (for example, connecting a new service), we will update this page and change the date below. For significant changes, we will also tell you when you next sign in.
13. Contact
Grievance officer: [name, to fill]
Email: [to fill]
Address: Industrial Design Centre, IIT Bombay, Powai, Mumbai 400076
Last updated: 30 September 2026