Privacy Policy
This policy explains what personal data B-Accuracy LMS collects, why we collect it, who we share it with, and the rights you have over it.
Effective September 5, 2026
Two roles, two policies. When you sign up for an account with us directly, we are the data controller and this policy applies. When you are a learner using a training academy run by one of our customers, that organisation is the controller and we act as their processor — their own privacy policy governs, and our obligations to them are set out in our Data Processing Addendum.
1. Who we are
B-Accuracy LMS is a service operated by B-ACCURACY INFOTECH, whose registered office is at #26, Ethiraj Salai, "Fagun Chambers", Office No. 6, 3rd Floor, Egmore, Chennai - 600 008, Tamil Nadu, India (email: info@baccuracy.com, phone: +91-9600039197, +91-44-28211811). For any privacy question, request or complaint, contact info@baccuracy.com.
2. What we collect
We collect only what the platform needs to function. We do not buy personal data from third parties, and we do not build advertising profiles.
| Category | What it includes |
|---|---|
| Account identity | Email address, password (stored only as a bcrypt hash — never in plain text), first and last name, avatar URL, phone number, biography, timezone, and language preference. |
| Authentication and session | Email verification status and timestamp, last login time, account status, and session cookies. Where the Customer configures single sign-on, the identifiers returned by their SAML 2.0 or OIDC identity provider. |
| Learning activity | Course enrollments, lesson and module progress, quiz attempts and answers, assignment submissions, SCORM tracking data (CMI records), certificates issued, learning path progress, and batch membership. |
| Engagement | Forum topics and replies, upvotes, personal course notes, experience points, activity streaks, leaderboard position, and in-app notifications. |
| Organisational | Role, department and group membership, manager relationships, and any custom profile fields the Customer defines. |
| Administrative and audit | Audit log records of administrative actions and impersonation sessions, API key usage metadata, and webhook delivery logs. |
| Billing | Plan and subscription status, invoice history, and payment method metadata. Full payment card, UPI and bank details are collected and stored by Razorpay and are never received or retained by us. |
We also record standard technical information when you use the Service — IP address, browser type, and request timestamps — for security, abuse prevention and diagnostics.
Data we deliberately do not hold
- Your password. Only a bcrypt hash is stored. We cannot read, recover or tell you your password.
- Your payment card. Card, UPI and bank details are collected and stored directly by Razorpay. We do not receive or store any part of your payment details ourselves.
- Your AI provider keys, in readable form. If you connect your own Anthropic, OpenAI, Google or Azure OpenAI account, the key is encrypted at rest with AES-256-GCM and used only to serve your own tenant’s requests.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Providing the Service — accounts, courses, progress, certificates | Performance of a contract |
| Billing, invoicing and collecting payment | Performance of a contract |
| Transactional email — verification, invitations, notifications | Performance of a contract |
| Security, fraud prevention, audit logging | Legitimate interests |
| Diagnosing errors and improving reliability | Legitimate interests |
| Marketing email to account holders about the product | Consent, withdrawable at any time |
| Meeting tax, accounting and legal obligations | Legal obligation |
4. Who we share it with
We do not sell personal data. We share it only with the service providers below, each of which is bound by a written agreement to process data only on our instructions.
| Provider | Purpose | Data handled |
|---|---|---|
| Cloud infrastructure hosting | Application and database hosting | All Customer Data stored by the Service |
| Content delivery and domain infrastructure | CDN, DNS, TLS certificate provisioning for custom domains, and (where selected) video streaming | IP addresses, request metadata, video content |
| Razorpay Software Private Limited | Subscription billing and payment processing | Billing contact details, payment card/UPI/bank data (collected directly by Razorpay), invoice records |
| Resend | Transactional email delivery (verification, invitations, notifications, scheduled reports) | Email address, name, message content |
| Video hosting and streaming (optional) | Video storage and streaming, where the Customer selects a third-party video provider other than the default above | Video content, viewer IP addresses |
We name payment and email providers above because you already see them directly — a Razorpay checkout, an email from our sending domain. The infrastructure categories are described rather than branded because which specific cloud host, CDN or video provider we use can change without changing what we do with your data, and we’d rather this page stay accurate than list a name we might swap out next quarter. We’re not withholding it: write to info@baccuracy.com and we’ll tell you exactly who they are.
We may also disclose data where legally required, or to establish or defend legal claims. If the business is ever sold or merged, data may transfer as part of that transaction — we will give notice before it takes effect.
5. International transfers
Some providers above operate outside the UK and EEA. Where personal data is transferred internationally, we rely on the European Commission’s Standard Contractual Clauses or an applicable adequacy decision, together with technical safeguards including encryption in transit and at rest.
6. How long we keep it
This is two different things depending on how an account ends, and we keep them distinct rather than quoting one number for both:
- Active accounts: for as long as the account exists.
- Using the self-service delete tool: deleting your own data from your account privacy settings removes or anonymises it in our live systems immediately — this is a direct action you take, not a request we queue.
- When an organisation’s subscription ends without anyone using the delete tool first: the organisation has 30 days to export its data, then we delete or irreversibly anonymise what remains within a further 30 days. This is the same process our Data Processing Addendum describes for Customer Data in more detail.
- Billing and tax records: retained for the period required by applicable tax law, typically six to seven years.
- Audit logs: retained for security and accountability, then purged on a rolling schedule.
- Backups: deleted data may persist in encrypted backups for a limited period until those backups rotate out, regardless of which path above removed it.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent.
You can exercise the two most important rights yourself, immediately. The platform includes built-in data export and permanent deletion — you do not need to raise a support ticket or wait for us. Find them under your account privacy settings.
For anything else, email info@baccuracy.com. We respond within 30 days. If you are a learner on an academy operated by one of our customers, direct your request to that organisation — we will forward it if it reaches us first.
If you believe we have handled your data improperly you may complain to your local data protection authority. We would appreciate the chance to resolve it first.
8. Cookies
We use a deliberately small number of cookies. We do not use advertising or cross-site tracking cookies, which is why you will not see a consent banner asking you to accept them.
| Cookie | Purpose | Retention | Type |
|---|---|---|---|
| Access token | Authenticates your session | 24 hours | Strictly necessary |
| Refresh token | Issues a new access token without re-entering your password | 7 days | Strictly necessary |
| Theme preference | Remembers light or dark mode | Until cleared | Functional |
Authentication cookies are set with HttpOnly, SameSite=Lax and, in production, the Secure flag. Blocking them will prevent you from signing in.
9. Security
Measures we apply include:
- Tenant isolation enforced at the database layer: every query is automatically scoped to the requesting tenant by the database itself, a rule enforced structurally rather than something our application code has to get right every single time.
- Encryption in transit via TLS, and encryption at rest for stored data.
- Passwords stored only as bcrypt hashes.
- Role-based access control, with administrative actions written to an audit log.
- Scoped API keys that can be rotated or revoked immediately.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a personal data breach affecting you, we will notify you and the relevant supervisory authority as required by law.
10. Children
The Service is not directed at children under 16 and we do not knowingly collect their data directly. Where a customer uses the platform to train under-16s, that organisation is responsible for obtaining any consent required by local law.
11. Changes to this policy
We will update this page when our practices change and revise the effective date above. For material changes affecting account holders, we will give notice by email before the change takes effect.