Privacy Policy — INSLMS
Instilit Learning Management System (INSLMS)
This Privacy Policy explains how Instilit (“Instilit”, “we”, “us”, “our”) collects, uses, discloses and protects personal data when you use the Instilit Learning Management System (“INSLMS”, the “Platform”, the “Service”) — our interactive-video learning platform at inslms.com and any associated applications.
It applies to individual learners who sign up directly, and to learners provisioned with a seat by an employer, institution or other organisation (“Organisation”). It does not apply to third-party websites we link to.
1. Who we are
Instilit is operated by Instilit Technologies Private Limited, a company incorporated in India, with its registered office in India.
For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for personal data you provide to us directly. Where an Organisation provisions seats and instructs us to process learner data on its behalf, that Organisation is the Data Fiduciary and we act as a Data Processor under our agreement with them — in that case, that Organisation’s own privacy notice governs the purposes of processing, and you should direct access and deletion requests to them first.
For learners in the European Economic Area and the United Kingdom, we are the controller (or processor, in the Organisation case) as those terms are used in the GDPR / UK GDPR.
2. A note on how INSLMS works, and why it matters for your privacy
INSLMS lessons are compiled before you ever see them. Course content — the interactive acts, narration, visuals and per-wrong-answer responses — is produced by our content pipeline at build time and then rendered as fixed video, audio and JSON assets.
• Your answers, clicks and notes are never sent to a large language model. There is no chatbot tutor and no runtime AI in the learner experience. The lesson you see is the same fixed artifact every other learner sees.
• Your learning activity is not used to train any AI model — ours or a third party’s. We do not do this today and we will not begin doing it without giving you clear advance notice and, where the law requires it, obtaining your consent.
• Model providers are used only in our authoring pipeline, on source material we supply. They receive no learner personal data.
3. Personal data we collect
3.1 Data you give us
| Category | Examples | Why we need it |
|---|---|---|
| Account data | Name, email address, password (hashed), display name, profile picture if uploaded | To create and secure your account |
| Organisation data | Employer/institution name, seat identifier, cohort, role (learner/admin) | To grant licensed access and report progress |
| Billing data | Billing name, address, GSTIN if supplied, plan and transaction history | To take payment, issue invoices, meet tax obligations |
| Learning content | Quick notes you write inside a lesson, answers and attempts submitted, bookmarks | To deliver the feature and display your work |
| Support data | Messages sent to us, bug reports, survey responses | To resolve issues and improve the Service |
We do not collect your full card details. Payments are handled by our payment processor; we receive only a token, the last four digits, the card network, and transaction status.
3.2 Data generated by your use of the Service
| Category | Examples |
|---|---|
| Learning activity | Lessons started and completed, acts attempted, options selected, correctness, detour branches, time per act, course progress |
| Playback preferences | Playback position, volume, captions toggle, playback speed |
| Device & technical | IP address, browser type and version, operating system, viewport size, language, referring URL |
| Diagnostics | Error traces, performance timings, media decode metrics, crash reports |
3.3 Data we do NOT collect
We do not collect or process special category / sensitive personal data — health, biometric, genetic, financial account credentials, caste, religion, political opinions, sexual orientation, or trade-union membership. Please do not enter such information into notes or support messages.
We do not use webcams, microphones, keystroke logging, screen recording or remote proctoring. INSLMS has no exam-invigilation feature.
4. Cookies and similar technologies
We use a small number of browser storage mechanisms:
- Strictly necessary: session and authentication cookies, CSRF protection, load balancing.
- Functional: remembering playback position, caption preference, and last-viewed lesson.
- Analytics: aggregated product analytics on which lessons are completed, where learners drop off, and which acts are failed most often.
We do not run advertising cookies, third-party ad pixels, cross-site tracking, or data brokerage of any kind. We do not sell personal data, and we do not “share” it for cross-context behavioural advertising.
5. Why we process your data, and our legal basis
| Purpose | DPDP Act basis | GDPR basis (EEA/UK) |
|---|---|---|
| Account operations & lessons | Specified purpose consented to | Contract (Art. 6(1)(b)) |
| Tracking progress & resume | Same | Contract |
| Organisation reporting | Consent or legitimate use | Contract / Legitimate interests (Art. 6(1)(f)) |
| Billing, tax & accounting | Compliance with law | Legal obligation (Art. 6(1)(c)) |
| Security & fraud prevention | Legitimate use | Legitimate interests |
6. Who we share data with
We share personal data only with the following categories of recipients:
- Your Organisation: If your seat was provisioned by an employer or institution (progress and completion metrics only).
- Infrastructure & Hosting Providers: Cloud application hosting, database hosting, and CDN delivery.
- Payment Processors: For processing payments, refunds, and generating tax invoices.
- Communications Providers: Transactional email and support ticketing.
- Authorities: Where strictly required by lawful court order or government subpoena.
Every processor is bound by written agreements enforcing strict confidentiality and security obligations. We do not sell personal data or disclose it to data brokers.
7. Retention Schedule
| Data Category | Retention Period |
|---|---|
| Account & profile data | Life of account, then erased or anonymised within 90 days of closure |
| Learning activity & progress | Life of account; anonymised thereafter for product insights |
| Notes you write | Deleted with your account or immediately when deleted by user |
| Billing & tax records | 8 years (mandated under Indian company and tax laws) |
| Security access logs | 180 days |
8. Your Rights & Grievance Redressal
Under the DPDP Act and GDPR, you have the right to access, correct, update, or erase your personal data, withdraw consent, or nominate a representative.
Grievance Officer (DPDP Act & IT Act)
Email: privacy@inslms.com
Response SLA: Acknowledged within 24 hours, resolved within 30 days.
If unsatisfied, you may escalate to the Data Protection Board of India.