Privacy policy
Last updated 8 October 2026
CONFIRM: registered business name ("One Man Studio") is the data fiduciary for the personal data you give us on onemanstudio.in. This policy follows India's Digital Personal Data Protection Act, 2023 (DPDP Act). It explains what we collect, why, and the choices you have.
What we collect
- Account details: your email address, name and, if you give it, phone number. If you sign in with Google we receive your name, email address and profile picture.
- Purchase details: which course you bought, the amount, the date, and the payment reference from Razorpay or Dodo Payments. We do not receive or store your card number, UPI PIN or bank login.
- Learning activity: lessons watched, your position in a video, and lessons you mark complete.
- Comments and questions you post under lessons.
- Device and security data: a device identifier and device name for the 3-device limit, and your IP address in server logs.
- Usage analytics, only if you accept cookies: pages visited and how you reached the site (see Cookies below).
Why we use it
We use your personal data only for these purposes:
- to create your account, sign you in and keep it secure;
- to take payment, give you access to the course, issue a GST invoice and handle duplicate-payment refunds;
- to play lessons, remember your progress and enforce the device and single-stream limits that protect the course from piracy;
- to show your name beside your comments and let instructors answer them;
- to email you receipts, login codes, access-expiry reminders and replies to your comments;
- to meet legal and tax obligations;
- to understand how the site is used and improve it, but only if you accept analytics cookies.
Consent
Where we need your consent, we ask for it clearly and you can withdraw it at any time. Analytics and advertising cookies stay off until you accept them in the cookie banner. Declining is as easy as accepting, and you can change your choice later using the Cookie settings link at the bottom of every page.
Withdrawing consent does not affect what we did before. If you withdraw consent we need to run your account, we may no longer be able to provide the course.
Data stored outside India
Some of the providers above process data outside India. We transfer personal data only to countries the Government of India has not restricted, and we choose providers with appropriate security safeguards.
How long we keep it
We keep your account and learning data while your account is open. Invoices and payment records are kept for as long as tax law requires (currently 8 years). If you ask us to delete your account we erase or anonymise the rest of your personal data, except where the law requires us to keep it.
Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we hold about you and who we shared it with;
- ask us to correct or complete your data (you can edit your name and phone number yourself on your account page);
- ask us to erase your data;
- withdraw consent;
- nominate another person to exercise these rights if you die or cannot act for yourself;
- complain to us, and then to the Data Protection Board of India if we do not resolve your complaint.
Grievance officer
To use any of these rights or to raise a concern, write to our grievance officer: CONFIRM: name and designation of the grievance officer, [email protected]. We reply within 2 working days and aim to resolve requests within 30 days.
Children
Our courses are for adults. If you are under 18, a parent or guardian must create the account and give consent on your behalf. We do not track or target advertising at children.
Security
Data is encrypted in transit, access to it is restricted, and payments are handled by PCI-compliant providers. If a personal data breach affects you, we will tell you and the Data Protection Board as the law requires.
Changes to this policy
If we change this policy we will update the date above and, for material changes, email students with an active course.