Privacy Policy

Who We Are

Productivity Shastra is a 6-week business productivity and performance programme developed and delivered by CA Manan Vasa under Altus Corp. productivityshastra.com is the official registration and information website for this programme.

This Privacy Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

What Information We Collect

We collect the following categories of personal data through our registration forms:

• Identity data: First name, last name
• Contact data: Email address, WhatsApp number (with country code)
• Professional data: Company or organisation name, designation or role
• Business data: City, nature of business or work, business category
• Referral data: How you learned about us (social media or other), name of person who introduced you
• Participation preference: Online (Zoom) or in-person (Mumbai HQ)
• Session preference: Preferred date and time of programme session

We also automatically collect technical data: IP address, browser type, device type, pages visited, session duration, and referral URL.

Payment card or bank details are not collected or stored by us — all payment processing is handled directly by our payment gateway partners (see Section 5).

How We Use Your Information

• To process your programme registration and confirm your seat
• To share Zoom join links, session reminders, and programme materials via email and WhatsApp
• To send pre-programme preparation materials and post-programme follow-ups
• To contact you regarding schedule changes, cancellations, or rescheduling
• To send relevant information about future Altus Corp programmes or events (with your consent)
• To generate invoices and comply with GST and accounting obligations
• To improve our programmes and website experience

We will never sell, rent, or trade your personal data to any third party for commercial purposes.

Legal Basis for Processing

• Consent: When you register for the programme and submit your data
• Contract: Processing necessary to deliver the programme you have registered for
• Legal obligation: GST invoicing, income tax, and other statutory requirements under Indian law
• Legitimate interests: Analytics, security, and programme improvement

You may withdraw consent at any time by contacting our Grievance Officer (Section 13). Note that withdrawal of consent after registration may affect your ability to receive programme communications.

Payment Processing

Programme fees are collected through the following authorised payment gateway partners:

• PayU Payments Private Limited — registered with the Reserve Bank of India (RBI) as a Payment Aggregator. PayU processes your card, UPI, net banking, or wallet payment. We do not receive or store your card or account details. PayU's privacy policy governs their handling of your payment data.
• Jodo (Eduvanz Financing Pvt Ltd or applicable entity) — for EMI or deferred payment options. Jodo's terms and privacy policy govern their processing of your financing data.

All payment transactions are encrypted using SSL/TLS. We receive only a payment confirmation and transaction reference number upon successful payment.

Cookies & Tracking

• Strictly necessary cookies: Required for the registration flow and website operation. Cannot be disabled.
• Analytics cookies: Visitor behaviour tracking (e.g. Google Analytics) — enabled with consent only.
• Marketing cookies: Retargeting and audience insights (e.g. Meta Pixel) — enabled with consent only.

You may control cookies through your browser settings. Disabling non-essential cookies will not prevent you from completing registration.

Third-Party Services

• PayU — payment processing (PayU Payments Pvt Ltd, India)
• Jodo — EMI / deferred payment processing (India)
• Zoom Video Communications — online session delivery (USA) — Zoom's privacy policy applies to session recordings and meeting data
• Google Analytics — website traffic analysis (Google LLC, USA)
• Meta Pixel — audience insights and retargeting (Meta Platforms, USA)
• YouTube (Google LLC) — embedded video testimonials
• WhatsApp Business (Meta) — registration confirmations and reminders
• Google Workspace — email delivery and form data storage (Google LLC, USA)

Data transferred outside India is governed by the standard contractual protections of those processors and applicable Indian cross-border transfer provisions under the DPDP Act.

How We Use & Protect Google Calendar & Drive Data

Productivity Shastra offers two optional, user-initiated integrations with your Google Account. You are asked to connect Google only when you choose to use one of these features, and you may decline or disconnect at any time.

• Google Calendar (calendar.events scope): When you click “Add to Google Calendar”, we create and update calendar events that mirror the tasks and time-blocks you planned inside our tools (such as Power Planner and Time Finder), so your plan appears in your own calendar. We write only the events you ask us to export. We do not read, display, analyse, or manage the events already in your calendar.
• Google Drive (drive.file scope): When you click “Backup to Google Drive”, we create a single folder named “Productivity Shastra” in your Drive containing one Google Sheet per tool, and keep those sheets updated with your own tool data. Because we use the narrowly-scoped, per-file drive.file permission, our app can only ever access files it created itself — it cannot see, read, or list any of your other Drive files or folders.

The access token Google issues is stored securely and used only to perform the export or backup you requested. We never sell this data, never use it for advertising, and never share it with third parties. You may revoke our access at any time at myaccount.google.com/permissions, from within the app, or via the app’s factory-reset option.

How we protect this data. We apply the following safeguards to all data, including the sensitive data accessed through these Google scopes:

• Encryption in transit: all traffic between your browser, our servers, and Google’s APIs is encrypted using HTTPS/TLS.
• Encryption at rest: your data is stored in a managed PostgreSQL database (Supabase) that is encrypted at rest.
• Access control: database row-level security ensures that only your own authenticated account can read your data; our staff cannot read your Google Calendar or Drive content.
• Secure token handling: your Google OAuth token is held only in our secured server-side backend (an isolated Edge Function secret store); it is never exposed to the browser, never logged, and never shared with any third party, and is used solely to perform the calendar export or Drive backup you initiate.
• Least privilege: we request only calendar.events and drive.file — the narrowest scopes that enable these features; drive.file further restricts our access to only the files our app created.
• Deletion & revocation: you can disconnect Google at any time at myaccount.google.com/permissions, and the app’s factory-reset removes your stored data.

Data Retention

• Registration data: Retained for 36 months from programme completion, or as required by GST and accounting laws (whichever is longer)
• Payment transaction records: 7 years, as required under Indian accounting and GST law
• Session recordings (if applicable): Retained for 6 months on Zoom's servers per Zoom's data policy, then deleted
• Analytics data: As per Google Analytics default retention settings (26 months)

Your Rights

Under the DPDP Act, 2023, you have the right to access, correct, erase (subject to legal obligations), withdraw consent, nominate a representative, and seek grievance redressal. Contact our Grievance Officer (Section 13) to exercise any right. We respond within 30 days.

Children's Privacy

Productivity Shastra is designed exclusively for business owners, founders, and working professionals aged 18 and above. We do not knowingly collect data from individuals under 18. If you believe a minor has registered, contact us immediately.

Changes to This Policy

We may update this Policy periodically. Material changes will be notified via email to registered participants and via a prominent notice on this website. The Effective Date will reflect the latest revision.

Grievance Officer & Contact

If unsatisfied with the resolution, you may approach the Data Protection Board of India once constituted under the DPDP Act, 2023.