Privacy Policy

1What we collect

You give us

• Your name, as it appears on your certificates and your public profile.
• Your email address, used to sign in, to send your certificate and to remind you about renewal.
• Your coaching background: sport, years coaching, city, employment type, organisation, age groups, the language you learn in, and any certifications you declare.

Your courses produce

• Course progress and test results: which modules and slides you have completed, and your test answers and scores.

Coaching athletes produces

• Plans and messages: the weekly training plans you review and sign for athletes, and the messages in each athlete’s thread.

We generate

• Payment records: amount, reference, transaction id and mode. Your UPI PIN and banking credentials never reach us. Your UPI address is stored only as a one-way hash, so a disputed payment can be matched without us holding the address.
• Security and audit records. IP addresses are stored only as a salted one-way hash, never in the clear. The audit log holds identifiers and state changes only, never names, numbers or message content.

We do not use advertising trackers, we do not sell personal data, and we do not build advertising profiles.

2Why we process it, and on what basis

Under the DPDP Act we rely on your consent, taken separately for each purpose, and on legitimate uses where the Act allows.

• Issuing and publishing certification status: consent. Public verifiability is the point of the product.
• Payment, tax and accounting records: legal obligation.
• Security, fraud prevention and audit: legitimate use.

You can withdraw consent at any time. Processing that relied on it stops from then on. What was done before stays lawful.

3Who else processes your data

We share personal data only with the processors below, only for the stated purpose, and under contract. We do not sell it, and we do not share it with advertisers or data brokers.

We may also disclose data where the law requires it, a binding court order, or a lawful request from a competent authority. Where a safeguarding disclosure is required by law, we comply, and we tell you unless telling you is itself unlawful.

4What becomes public

A certified coach has a public profile so parents and academies can check the certificate. It shows your first name and last initial, your sport, your city, your years of experience, the age groups you coach, and the course certificates you hold, with their status and dates.

It never shows your email address, your phone number, your date of birth, your address, your test scores, or which modules took more than one attempt.

5Where it is stored, and how it is protected

All personal data is stored in India, in the Mumbai region (ap-south-1). It is not transferred outside India.

• Encrypted in transit (TLS) and at rest.
• Row-level security in the database, so one coach’s records are unreadable from another coach’s session even if the application layer is bypassed.
• Minimisation by design. IP addresses and UPI addresses are stored only as one-way hashes, and the audit log is built so that personal data cannot be written into it.
• Append-only records. Consent and audit entries cannot be edited or deleted, including by us, so what you agreed to cannot be quietly rewritten.
• Access limited to staff who need it, and logged when used.

If a personal data breach occurs we will notify the Data Protection Board of India and affected users as the DPDP Act requires.

6How long we keep it

Some records outlive your account on purpose. Rather than claim we delete everything, here is exactly what is kept and why.

“Unlinked on erasure” means the record survives with every identifier pointing to you removed. What remains is that a consent was given, or a payment was made, under a stated notice version at a stated time, with nobody attached to it.

7Your rights

Under the DPDP Act you have the following rights. Write to support@mydrona.ai to exercise any of them. We respond within thirty days and we do not charge for it.

8Children

Accounts are for adults. A parent or guardian may set up a training profile for their own child inside their account: the child’s first name, age, sport, goal, any injuries or conditions the parent chooses to tell us, the weekly plans, session logs and messages. The parent controls that profile, sees everything in it, and can delete it at any time. We do not collect anything from a child directly and we never show a child’s profile publicly; the coach the parent chose sees it, nobody else. If you believe a child has created an account of their own, tell us and we will delete it.

9Grievance officer

Deckline Leitão
Matrix Teamworks Private Limited
No. 25/1A, Halanayakanahalli, Off Sarjapura Road, Near Wipro Office, Bengaluru, Karnataka 560035, India
support@mydrona.ai

If we do not resolve your complaint to your satisfaction, you may escalate it to the Data Protection Board of India.

10Changes to this policy

If we change how we use personal data in a way that materially affects you, we will email you before it takes effect and, where the law requires it, ask for fresh consent. Past versions are available on request from our legal page.