Privacy Policy

ClustraNotes is operated by Divam Dubey, with a contact address at Bengaluru, Karnataka, India. In this policy, “ClustraNotes”, “we”, “us”, and “our” refer to that operator.

We aim to handle personal data in accordance with applicable Indian law, including data-protection requirements that are in force and applicable to our service. The legal framework and our service may evolve, so we will update this policy when appropriate.

• Early-access signup: your email address, signup status, signup and confirmation timestamps, and technical information needed to protect the signup form from abuse.
• Account and authentication: your name, email address, authentication identifiers, account settings, and the information returned by an identity provider when you choose a sign-in method such as Google. Authentication providers handle passwords according to their own systems; ClustraNotes does not need to store your plaintext password.
• Academic profile: details you choose to provide, such as your institution, course, branch, university, and semester.
• Uploaded content: files, titles, descriptions, tags, academic metadata, visibility settings, moderation status, and related records associated with a contribution.
• Activity and preferences: information such as notes you open, save, like, or download and settings you choose, where these actions are supported by the app.
• Verification information: information you submit for student verification, if that feature is offered and you choose to use it. We will describe the information requested at the point of collection.
• Technical and security data: information such as IP address, request metadata, device or app version, error logs, rate-limit events, and security records generated by the website, app, or service providers.
• Messages and reports: information you send to us when contacting support, reporting content, or making a privacy request.

Do not submit government identification, payment details, or other sensitive information unless a specific feature clearly requests it and explains why it is needed.

Depending on the features you use, we may process personal data to:

• create, authenticate, maintain, and secure accounts;
• operate search, uploads, libraries, and other app features;
• display content according to the visibility settings you choose;
• review contributions, investigate reports, and enforce our terms;
• prevent spam, fraud, abuse, and security incidents;
• diagnose errors, maintain reliability, and improve the service;
• send signup confirmations and necessary account or service messages;
• respond to requests, complaints, and legal obligations.

Where consent is the applicable basis for processing, we will seek it in the relevant flow and explain how you can withdraw it. Some processing may instead be necessary to provide a feature, protect the service, or comply with applicable law. We will not treat withdrawal of consent as cancelling processing that we are legally required or otherwise permitted to continue.

Content visibility matters: When you upload a note, its visibility depends on the option you select. If you select public visibility, the note and the associated information displayed with it may be accessible to other users without prior admin approval. Other users may be able to download or share publicly available content where those features are enabled. If you select private visibility, access is limited according to the app's privacy and access controls. Do not upload files containing personal or confidential information that you do not intend to share.

We do not sell personal data. We may share it in these circumstances:

• Service providers: providers that support hosting, authentication, databases, file delivery, email, security, and related operations. The providers relevant to the current service are listed below; this list should be kept aligned with the live implementation.
  • Google (Firebase): authentication and Firestore, where used
  • MongoDB Atlas: application records and analytics, where personal data is processed
  • Cloudinary: uploaded files or media, where used
  • Supabase: early-access signup records
  • Resend: sending signup confirmation and transactional emails
  • Vercel: hosting and operating the website
  • Upstash: rate limiting and signup abuse prevention
• Other users: when you publish or share content or profile details through a feature that makes them visible.
• Legal and safety reasons: where disclosure is required by applicable law or a valid legal process, or is reasonably necessary to protect users, rights, or the service.
• Business transfer: if the service or its relevant assets are transferred, subject to appropriate safeguards and applicable law.

Service providers may process or store data in countries other than India. Any such processing is subject to the arrangements with the provider and applicable legal requirements.

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including operating the service, handling disputes, enforcing our terms, and meeting legal obligations. Actual retention periods can vary by data type and system.

• Account data and contributions: we retain these while an account or contribution remains active. When you request deletion, we will process it through the available deletion workflow, subject to applicable law and legitimate retention needs.
• Early-access signups: we retain signup information while it is needed to administer early access, handle confirmation and related requests, or meet legal or security needs. You may contact us to request removal.
• Backups, security records, and legal records: these may remain for a limited period where necessary for recovery, security, dispute handling, or legal compliance.
• Previously downloaded content: deleting a note cannot recall a copy another user downloaded or independently saved before deletion.

We do not promise immediate deletion from every backup or third-party system. Where data must be retained, we will handle it according to applicable law and our operational retention procedures.

We use reasonable technical and organisational measures appropriate to the service, which may include encrypted connections, access controls, and security monitoring. No internet service or storage system can be guaranteed to be completely secure. If a personal-data breach occurs, we will take the steps required by applicable law.

Subject to applicable law, you may contact us to request that we:

• provide information about personal data associated with you;
• correct or update inaccurate information;
• delete personal data that we are not required or permitted to retain;
• address a request to withdraw consent where consent applies;
• respond to a privacy question or grievance.

Contact us at support@theclustra.com. To help protect your account, we may ask for reasonable information to verify a request before acting on it. We will respond within the time required by applicable law.

ClustraNotes is intended for people aged 18 or older. Do not create an account if you do not meet this requirement. If you believe someone below the permitted age has provided personal data, contact us so we can review the matter and take appropriate action under applicable law.

This website uses Vercel Web Analytics to understand website traffic and improve the experience for visitors. The analytics service may process information such as page views, referring websites, browser or device information, and aggregated visitor statistics. Vercel Web Analytics is designed not to use cookies for analytics tracking. We use this information to understand how visitors discover and use the website.

The website also collects the email address you provide when joining the early-access list. We use it to manage your registration and send confirmation or relevant early-access communications. Our hosting and security providers may process technical information, such as IP addresses and server logs, to maintain the website's security and reliability. For more information about Vercel's processing practices, please consult Vercel's privacy documentation.

For privacy questions, requests, or complaints, contact the grievance officer using the details below:

• Name: Divam Dubey
• Email: support@theclustra.com
• Address: Bengaluru, Karnataka, India, 560037

We will handle complaints in accordance with the grievance process and timelines applicable to ClustraNotes. If the law provides an external complaint or appeal route for your request, you may use that route as well.

We may update this policy as the service or applicable law changes. We will take reasonable steps to communicate material changes through the website, app, or email where appropriate. The current version will be available at this page. Please also review our Terms of Service.