The small print

Privacy Policy

Last updated: 27 September 2026 (draft)

1. Who we are

CLATcoach is operated by Iura (Dwarka, Delhi; Ghaziabad & Noida). For the personal data described here, Iura is the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (the “Act”). You can reach us at hey@clatcoach.com for general questions and at clat@iura.in for anything about your data (section 11).

2. Where the law stands

The Act is being brought into force in stages. The Digital Personal Data Protection Rules, 2025 were published in the Gazette of India on 13 November 2025. Rules 1, 2 and 17 to 21 took effect on publication, Rule 4 takes effect one year after publication, and Rules 3, 5 to 16, 22 and 23 take effect eighteen months after publication. We follow the protections described in this policy now, whether or not a particular provision has yet come into force, and we will update the policy as each one does.

3. What we collect, and why

We collect only what each part of the service needs. The table lists every kind of personal data we collect through our forms and the platform, where it comes from, and what we use it for. We do not sell personal data.

Data	What exactly	Where it comes from	Why we use it
Account	Name, email address, password (held as a secure hash by Firebase Authentication; we never see it), exam year, date of birth. If you sign in with Google: the name and email Google shares.	Sign-up and login	To create and run your account, tell whether you are under 18, and contact you about your enrolment.
Free diagnostic test	Name, email, phone (optional), city, class or year, target CLAT year, whether you are under 18, your answers, scores and timings, and the consent you gave with the wording shown and the time. If you are under 18: your guardian’s name and email.	The free mock test form	To mark the test, show your result and report, recommend what to study next, and follow up by email.
Apply and register interest	Name, email, phone, programme of interest, diagnostic score (optional), whether you are under 18 and, if so, a parent or guardian’s name and contact.	The Apply form	To reply to your interest and, when a programme opens, tell you how to enrol. Other fields may be added to the form; this table will be updated when they are.
Contact form	Name, email, subject and your message.	The Contact form	To answer you.
Guardian consent	Guardian’s name and email, the consent wording, the time, and the IP address from which the guardian link was requested and confirmed.	Guardian confirmation link	To obtain and prove verifiable parental consent for a student under 18.
Learning activity	Mock, sectional, drill, daily-set and previous-year-paper attempts (answers, scores, timings), bookmarks, notes, flashcard and planner activity, streaks, the date you last opened the platform, progress, leaderboard standing, referrals, live-session RSVPs and notifications.	Your use of the platform	To score you, show your progress and analytics, and run the programme.
Forum posts	What you post and reply, with your display name.	The community forum	To run the community; see the Terms, section 4C.
Payments	Plan bought, amount, discount code used, status, times, and the Razorpay order and payment IDs. We do not receive or store your card, UPI or bank details; Razorpay handles those.	Checkout	To give you access, issue receipts, handle refunds and keep the records the law requires.
Live sessions	Audio, video (if you switch it on) and chat from sessions we record, and the questions you ask.	Live sessions	To let enrolled students review sessions and to improve teaching; see the Terms, section 4B.
Emails we send	Your email address, and whether a message was delivered or opened where our email provider reports it.	Our transactional and follow-up emails	Receipts, reminders, your test report, and messages about your enrolment.
Analytics: Google Analytics	Page views and events, an anonymous device identifier (cookie), approximate location and device type.	Your browser, only if you accept analytics cookies (section 4)	To understand how the site is used and improve it.
Advertising: Google AdSense	A cookie Google sets in your browser, your IP address, the page you are reading, and device and browser details. Ads are never personalised: no profile of you is used to choose them.	Your browser, on free pages that carry ads (section 4)	To show ads that help pay for the free content, and for Google to cap how often you see an ad, count views and clicks, and detect fraud.
Visit counts	For a visitor who is not signed in: the page a visit starts on, the site it came from (a site name such as google.com, or a campaign tag), whether this browser has visited before, and which of four steps the visit reached (answering a practice question, seeing or clicking the free-account offer, opening the sign-up page). Each is added to a daily total. Nothing is stored about a person and no cookie is set; your browser keeps only a note, in its own storage, that it has been here before. Your IP address is used only to stop abuse and is not kept.	Your browser, when you are not signed in	To see which pages bring people in and where they stop, without following anyone.
Analytics: our own	For the free diagnostic: a random session ID, the page source (for example ?src=), device type, the event name and its details, and a class or referral code if the link had one. There is no name or email in this record.	Your browser, on the free test pages	To see where people drop out of the test and fix it. See section 4 for what we do about this for under-18s.
Technical	Sign-in tokens kept in your browser, and server logs (which include IP address) kept by our hosting and cloud providers.	Your browser and our providers	To keep you signed in, protect the service and investigate abuse.

We ask for your consent before we process your data for these purposes, and where the law lets us process data without consent (for example, keeping payment records) we say so. We do not collect data about you from anyone else, other than your guardian and the details Google shares if you use Google sign-in.

We use email. We do not send SMS. Support runs on email, with the phone number for calls during office hours; you can also message that number on WhatsApp.

4. Analytics, ads, cookies and your choice

Google Analytics is off until you say yes. When you first visit, a banner asks whether we may use Google Analytics. Until you accept, the Google Analytics script is not loaded and sets no cookies. You can change your mind at any time from “Cookie settings” in the footer.
Ads appear on some free pages, and are never personalised. Legal Updates, the blog, the free resources and the guide pages carry Google AdSense ads. We tell Google to show only non-personalised ads, to everyone: ads chosen from the page you are reading and your approximate location, not from a profile of you. Google still sets cookies to cap how often you see an ad, count views and clicks, and detect fraud. The banner does not cover these cookies. If you do not want them, an ad blocker or your browser’s third-party cookie setting stops them, and the site works as before. There are no ads on paid pages, in your dashboard or in tests. How Google uses cookies in advertising.
Nothing else needs a banner. The cookies and storage that keep you signed in, protect your account and remember your choice are needed for the service to work.
Students under 18. Section 9(3) of the Act says a Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. So: we never use personal data for targeted advertising or remarketing; Google Analytics is not switched on for an account we know belongs to someone under 18, or after you tell us on the free test that you are under 18, even if the banner was accepted before; and a parent or guardian can ask us to delete any analytics record linked to their child.
No event fires before you have answered “Are you under 18?”, and that includes our own diagnostic events (section 3). After you have answered, those events follow the same choice as Google Analytics: they run only if you accepted analytics, and never for someone we know is under 18. They hold no name or email.

5. Children and parental consent

A “child” under the Act is anyone under 18, and most CLATcoach students are 16 or 17. Section 9(1) of the Act requires a Data Fiduciary to obtain verifiable consent of the parent (or lawful guardian) before processing a child’s personal data, and Rule 10 of the Rules sets out how. Section 9(2) says we must not process data in a way likely to harm a child’s well-being.

We treat anyone who tells us they are under 18 as a child. On the free test and on the Apply form we ask “Are you under 18?” directly; we do not guess from your class. A signed-in account is treated the same way using the date of birth you gave.
For the free test we ask “Are you under 18?”. If you are, we ask for a guardian’s name and email and email a confirmation link. Your guardian confirms through that link; no guardian account is needed. We keep the consent record with its time.
A minor’s account can use free content only until a guardian has confirmed; it cannot buy a plan.
A guardian can withdraw consent at any time by writing to clat@iura.in. That stops the processing that relied on the consent and ends paid access.

6. Who we share data with

We share personal data only with the service providers that help us run CLATcoach, and only for that purpose. They act on our instructions.

Provider	What it does for us	Data involved
Google (Firebase Authentication, Firestore, Cloud Functions, Hosting)	Sign-in, database, server functions and website hosting.	Account, test, learning, forum, payment-record and consent data; technical logs.
Razorpay	Takes payment and processes refunds.	Your name and email, the amount and plan; payment credentials go to Razorpay, not to us.
Resend	Sends our emails.	Your email address and the message content.
Google Analytics	Website analytics, if you accept.	Anonymous usage data; see section 4.
Video-conferencing provider for live sessions (set per session, currently Zoom or Google Meet)	Runs and records live sessions.	What you say, show or type in the session.

We may also disclose personal data when the law requires it, to protect our rights, or to a successor if the business is transferred, on terms that keep your data protected.

7. Sending data outside India

Our main database is in Delhi (Google Cloud region asia-south2). Some of our providers still process data outside India: most of our Cloud Functions, including the ones that handle sign-up, the Apply and Contact forms and payments, run in the United States (Google Cloud, region us-central1), so personal data passes through the United States. Google Analytics and Resend process data on servers that may be outside India, and video-conferencing providers may as well. Section 16 of the Act lets the Central Government restrict transfers to countries it notifies; we will follow any such notification.

8. How long we keep it

We keep personal data only as long as it serves the purpose it was collected for, and erase it once that purpose ends or you withdraw consent, unless the law requires us to keep it (Act, s. 8(7)). This replaces the older wording that said we keep data for one year after a deletion request. The rule now is: when you ask us to delete your data, we erase it from our live systems within 30 days of a verified request, except the records the law requires us to keep.

Data	How long
Account, learning activity, forum posts, notes	While your account is active. Erased within 30 days of you closing it or asking us to delete it, except as below.
Free diagnostic test data (no account)	Until you ask us to delete it; we then erase it within 30 days.
Apply and Contact form submissions	Until the enquiry is dealt with and for as long as we may need to reply; erased within 30 days on request.
Guardian consent records	For as long as the child’s data is processed, and after that only as long as needed to show that consent was given.
Payment records (plan, amount, Razorpay IDs, status)	For the period the law requires us to keep such records. Not erased on request while that period runs.
Live-session recordings	Deleted 90 days after the end of the cohort. On request we remove recordings that show you sooner.
Google Analytics data	Kept by Google Analytics for 14 months, the retention period we have set for our property.
Backups	We do not keep scheduled backups or point-in-time recovery of our database, so deleted data is not held in a backup of ours. Google keeps document versions for a short period (one hour by default) as part of running the database.

9. Keeping it safe

Data is encrypted in transit, and encrypted at rest by our cloud provider.
Passwords are hashed by Firebase Authentication. We cannot read them.
Database rules limit what each signed-in user can read and write, and only server functions can write payment and tier records.
Access to student data by our team is limited to those who need it.
If a personal data breach happens that affects you, we will tell you as the law requires.

10. Your rights

Under the Act you have the right to:

Know what we hold. Ask for a summary of the personal data we process, what we do with it, and the other Data Fiduciaries and processors it has been shared with (s. 11).
Correct, complete and update data that is wrong or incomplete, and ask us to erase it, unless we need it for the purpose or the law requires us to keep it (s. 12).
Have a grievance dealt with by us, and go to the Data Protection Board only after you have used our process (s. 13).
Nominate someone to exercise your rights if you die or cannot act for yourself (s. 14).
Withdraw consent at any time (section 11 below).

How to use them. Email clat@iura.in from the address on your account, saying what you want. We may ask you to confirm who you are, and for a child’s data we deal with the parent or guardian. We will respond within 30 days.

You can withdraw a consent you gave at any time, and it should be as easy as giving it was (s. 6(4)). For analytics, use “Cookie settings” in the footer. For anything else, email clat@iura.in. Withdrawal does not undo processing that already happened on the strength of your consent, and it may mean we can no longer provide the part of the service that needs the data (s. 6(5)). After you withdraw, we stop processing and ask our processors to stop, and erase the data unless the law requires us to keep it (ss. 6(6) and 8(7)).

12. Grievance officer

Sagar Kumar, Grievance Officer, Iura
clat@iura.in · Monday to Friday, 09:00–17:00 IST

Write to the grievance officer about any concern with how we handle your personal data. If you are not satisfied you may approach the Data Protection Board of India after you have used this process.

13. Changes

We may update this policy. We will tell you about a material change by email or on the dashboard before it takes effect, and the date at the top will change. See also our Terms of Service and Refund Policy.

14. Governing law

This policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.