Privacy Policy

NexusAI Technologies ("NexusAI", "we", "us", "our") is the legal entity operating the SkillNexus platform — an AI-powered, cohort-based skill development platform delivering live mentor-led training, AI-generated course content, gamified rewards (SNXP & GNC), and industry certificates to learners across India.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), NexusAI Technologies is the Data Fiduciary for all personal data processed through SkillNexus. Our registered address and Grievance Officer details are in Section 15.

This Privacy Policy applies to the SkillNexus web application (skillnexus.nexusaiweb.com), mobile web experience, push notification services, and all associated APIs. Related NexusAI platforms (MentorNexus, InternNexus, PromptNexus) have separate policies linked in their respective apps.

Before collecting your personal data, we inform you of the following as required by law:

• The personal data we intend to collect (Section 3 below).
• The specific purposes for which it will be processed (Section 4 below).
• The manner in which you may exercise your rights as a Data Principal (Section 12 below).
• The name and contact of the Grievance Officer (Section 15 below).

By creating a SkillNexus account, enrolling in a batch, or otherwise using the Platform, you provide free, specific, informed, and unambiguous consent to the processing described herein. Where consent is the legal basis, you may withdraw it at any time (Section 12 — Right to Withdraw Consent).

Withdrawing consent may impair or prevent your ability to use certain Platform features such as personalised learning paths, SNXP rewards, or push notifications. We will inform you of such consequences before processing your withdrawal.

We collect data directly from you (registration forms, enrollment), automatically (server logs, analytics), and from third parties (Google/LinkedIn OAuth, Razorpay payment gateway, Microsoft Teams attendance exports).

SkillNexus uses Firebase Cloud Messaging (FCM) by Google LLC to deliver real-time push notifications. Push notifications are an optional feature that requires your explicit, separately-granted browser permission.

What we send via push:

• Live session start alerts ("Your mentor's session is live — join now!")
• Session reminders 30 minutes before a scheduled class.
• Recording availability alerts ("Your session recording is ready to watch").
• SNXP milestone and achievement badges.
• New batch enrollments or mentor assignments.
• Important platform announcements.

FCM token and data handling:

• When you grant push permission, a FCM registration token is generated by Firebase on your device and stored on NexusAI's servers, linked to your account, to allow targeted push delivery.
• FCM tokens are rotated automatically by Firebase. NexusAI refreshes the stored token on each login.
• Notification payloads sent to Firebase contain only your FCM token and the notification message — no personally identifiable data is included in the FCM payload itself.
• Your FCM token is deleted from our servers when you revoke push permission in your browser settings, log out from all devices, or request account deletion.

To manage or revoke push notifications: Go to your browser's site settings (🔒 icon in the address bar) and revoke the Notifications permission for skillnexus.nexusaiweb.com. You can re-enable notifications at any time from your SkillNexus profile settings.

Firebase Cloud Messaging is operated by Google LLC. Google's data processing terms apply to FCM token data in transit. For details, see firebase.google.com/terms.

We do not use third-party advertising cookies, cross-site tracking pixels, or sell your behavioural data to advertising networks.

SkillNexus uses AI extensively to generate and personalise course content. Understanding how AI processes your data is important:

• Content generation: AI models (Azure OpenAI gpt-4.1) generate lesson scripts, quiz questions, assignment briefs, and personalised feedback. These models process course topic metadata — not your personal profile.
• NexusGuide chatbot: Your chat messages to NexusGuide are sent to Azure OpenAI to generate responses. Conversations are stored for 90 days to enable contextual follow-up and are then deleted. They are not used to train any AI model.
• Learning path personalisation: Your progress data, quiz scores, and content interaction signals feed into recommendation algorithms to suggest relevant modules and adjust difficulty — fully automated, without human review of individual profiles.
• No solely automated decisions with legal effect: No AI-generated decision on the Platform (e.g., certificate issuance, SNXP award, batch placement) is final without a rule-based system check. You may request human review of any automated outcome by emailing privacy@nexusaiweb.com.

We do not sell, rent, or trade your personal data. We share it only in the following circumstances:

• Cloud infrastructure: Microsoft Azure (India South region) for backend compute, Blob Storage, and OpenAI services; AWS S3 (ap-south-1, Mumbai) for media assets; MongoDB Atlas / Cosmos DB for databases.
• Payment gateway: Razorpay Financial Solutions Pvt. Ltd. processes all payment transactions. Only order identifiers and payment status are returned to NexusAI.
• Communication services: AWS SES for transactional emails (enrollment confirmations, OTP, certificates); Firebase (Google) for push notifications.
• Microsoft Teams: Live sessions are hosted on Microsoft Teams. Your display name and session join/leave timestamps are visible to the hosting mentor and may appear in Teams attendance reports.
• Institutional partners: If your account was created under a college or corporate partnership, your aggregate learning progress, attendance percentage, and certificate status are shared with the institution's admin portal. No granular quiz scores or personal communications are shared without your separate consent.
• Legal and regulatory: When required by law, court order, or government authority under the DPDP Act, IT Act 2000, or any other applicable Indian law.
• Business transfers: In a merger, acquisition, or sale of NexusAI's assets, your data may transfer to the acquiring entity subject to equivalent privacy protections and prior notice to you.

All third-party service providers engaged by NexusAI are contractually required (via Data Processing Agreements) to process your personal data only for the purposes specified by NexusAI and to implement appropriate security measures.

SkillNexus operates primarily on infrastructure in India (Microsoft Azure India South, AWS ap-south-1/Mumbai). Some personal data — specifically FCM tokens (via Google Firebase) and OpenAI prompts (via Azure OpenAI) — may be processed on servers outside India.

Where data is transferred outside India, it is protected under the contractual terms agreed with our service providers (Google Firebase Terms, Microsoft Azure Data Processing Addendum, AWS Data Processing Addendum).

After the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data subject to ongoing legal proceedings, government investigations, or contractual disputes may be retained until resolution.

NexusAI implements the following security measures as required under the DPDP Act and the IT (Amendment) Act, 2008:

• Encryption in transit: TLS 1.3 for all API and web traffic.
• Encryption at rest: AES-256 for database volumes and S3 buckets.
• Authentication: JWT tokens with Redis whitelist; bcrypt-hashed passwords; OTP verification on registration and password reset.
• Access control: Role-based access controls (student, mentor, college admin, super-admin) enforced at the API layer. Principle of least privilege applied to all service accounts.
• Vulnerability management: Regular dependency audits and periodic penetration testing.
• Employee access: Only authorised NexusAI personnel with a business need may access personal data. All personnel are bound by confidentiality obligations.

To exercise any right, email privacy@nexusaiweb.com with the subject line "DPDP Rights Request — [Right Type]". We may verify your identity before processing the request.

Under Section 9 of the DPDP Act, 2023, processing personal data of a child (under 18) requires verifiable consent from a parent or lawful guardian and is subject to restrictions on behavioural monitoring or targeted advertising.

If SkillNexus is accessed under an institutional (college) partnership where enrolled students may include those under 18, the partnering institution is responsible for obtaining the necessary parental consents before onboarding such students to the Platform. NexusAI will not process data of students under 18 without written confirmation from the institution that parental consent has been obtained.

If you believe that a person under 18 has registered without proper consent, please immediately contact privacy@nexusaiweb.com. We will investigate and promptly delete the account.

In the event of a personal data breach that is likely to result in harm to your rights or interests, NexusAI will:

• Notify the Data Protection Board of India (DPAB) in the prescribed form and timeframe under Section 8(6) of the DPDP Act.
• Notify affected Data Principals via the registered email address on record, describing the nature of the breach, data categories affected, likely consequences, and mitigation steps taken.
• Take immediate containment and remediation action.

NexusAI maintains an internal breach response policy and incident log. Breaches affecting only pseudonymised or encrypted data where decryption is not feasible may not require individual notification, subject to regulatory guidance.

We may update this Privacy Policy periodically to reflect changes in law, technology, or our practices. Material changes — those that affect your rights or how we process personal data — will be communicated via:

• An in-app banner displayed for at least 14 days before the change takes effect.
• An email notification to your registered email address.

Continued use of SkillNexus after the effective date of an updated policy constitutes acceptance of the revised terms. If you do not agree with material changes, you may close your account before they take effect.

Non-material changes (grammatical corrections, clarifications that do not alter your rights) may be made without prior notice; the "Last updated" date at the top of this policy will be updated accordingly.