Privacy policy

The short version

We hold what you tell us when you sign in, what you did on the platform, and

the network address you did it from. We use it to run the service, to

measure assessments honestly, and to protect the question bank. We do not

sell it and we do not use it to train any model — there is no model in this

platform.

Who is responsible

Let Us Support Private Limited, trading as PalmDigitalz, operates Palm

Forge and decides how your data is used. Reach us

at jacinth@letussupport.in.

Where your employer holds a licence and gave you a seat, they are

responsible for their decision to enrol you and for what they do with the

reports they can see. We are responsible for the platform.

What we hold

From your identity provider, when you sign in: your name, email address

and profile picture if you have one. We never see or hold your password.

About what you did: every attempt you start and finish, your score, the

individual answers you gave, which scenarios you opened and when, your

streak and experience points, and any credential issued to you.

About where you did it from: the network address of each sign-in, and

the address recorded against each scenario you open. This is kept for two

reasons we will state plainly — an organisation may restrict access to its

own network, and we detect bulk collection of the question bank by

measuring reading volume per account.

If you pay: by UPI, we hold the amount, the UPI reference (UTR) and the

UPI ID you paid from, so the payment can be matched to your order and any

refund sent back to it. If card payment is offered, we receive confirmation

from the payment processor that a payment happened, with the amount and a

reference. **We never see or hold your UPI PIN, bank login or card

details.**

If you opt in to the talent pool: the profile you write, and your

choice about who may see it.

Why we hold it

• To run the service and show you your own progress.
• To make an assessment mean something: a score is only evidence if the

conditions it was produced under are known.

• To protect the question bank. A credential's worth depends on candidates

not having seen the questions, so we record reading volume and act on

patterns that indicate bulk collection.

• To meet an organisation's access rules where it has set them.
• To tell you about things that concern your account — a decision on an

access request, a credential being issued, a licence about to expire. We

do not send marketing email.

Who can see what

Your organisation's administrators can see your name, email, sign-in

history including addresses, your attempts and scores, and your credentials.

They see this for the people in their own organisation and for nobody else.

Other learners see your name and score on leaderboards within your

organisation. Nothing else.

Anybody with a credential's verification link can see that the

credential exists, who holds it, and what it says. That is the point of a

verifiable credential, and you choose whether to share the link.

We, as the operator, can see everything above across all organisations.

We look when we are asked to, when something is broken, or when a security

finding needs explaining.

Scenario pages carry a visible watermark with your name and email address.

It is shown to you alone, and its purpose is to make a leaked screenshot

traceable to the account that took it.

What we do not do

• We do not sell your data, and we do not share it with advertisers.
• We do not use it to train any machine learning model. The assessment

engine is procedural and the free-text marker is lexical; there is no

model and no inference anywhere in this platform.

• We do not track you across other websites, and there is no analytics

pixel or advertising tag on any page.

• We do not place cookies beyond the one that keeps you signed in.

How long we keep it

• Your account and your results: for as long as you hold an account.

Your attempts and credentials are the record of what you did and deleting

them would unmake it.

• Scenario reading records: 120 days, then deleted automatically. They

exist to detect bulk collection, and that question is answered within

days rather than years.

• Sign-in history: for as long as you hold an account, because it is

the evidence behind any question about access to it.

• Security findings: kept, and acknowledged rather than deleted, so a

finding about an account cannot be cleared away by that account.

• Payment records: for as long as tax and accounting law requires.

Your rights

You can ask us to show you what we hold about you, to correct it if it is

wrong, or to delete your account. Write to

jacinth@letussupport.in and we will

respond within 30 days.

Deleting an account removes your personal data. It does not retract a

credential already issued and verified by somebody else, and it does not

remove aggregate measurements that no longer identify you — the statistics

that tell us whether a question is a good question.

If you are unhappy with how we have handled your data you can complain to

the Data Protection Board of India.

Children

Palm Forge may be used by people under 18, and passports — the kind of

credential that reports what somebody did — are deliberately never pushed to

third-party credential networks for that reason.

If you are under 18, please use Palm Forge with a parent, guardian or

teacher who agrees to these terms on your behalf. If you believe we hold

data about a child without that agreement, write to us and we will remove

it.

Where your data is

Palm Forge runs on a single server. Its location and our processors are

listed on the [contact page](/legal/contact).

Changes

If we change this policy the version number above changes. If a change

materially affects what we do with your data, we will tell you rather than

rely on you noticing.