1. Who we are
This website and the Pencilastic learning platform are operated by Melifluo ("Melifluo", "we", "us", "our"), with its place of business at Tower E, Flat 1309, Indis One City, KPHB-Hitech City Main Road, Near Malaysian Township, KPHB, Kukatpally, Hyderabad, Telangana 500072, India. For the purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we act as the Data Fiduciary for the personal data described below. You ("you", "the user", "Data Principal") are the person whose data we process.
2. What data we collect
We practise data minimisation — we collect only what we genuinely need:
- Information you give us at sign-up: your full name, email address, and mobile number.
- Learning-account information: a learning nickname, your course enrolment and subscription validity dates, and your activity/progress within the courses on our Learning Portal.
- Transaction information: a payment reference identifier and order identifier from our payment partner, the amount paid, and the subscription tier/period. We do not collect or store your card number, CVV, UPI PIN, or bank credentials (see Section 4).
- Technical information: limited server logs and, where applicable, your IP address for security and abuse-prevention (e.g. rate-limiting), in masked or minimal form.
- Communications: if you contact us (e.g. by email), the contents of that correspondence.
We do not knowingly collect special categories of sensitive data beyond what is listed above.
3. Why we collect it & our legal basis
We process your personal data, with your consent and as necessary to provide the service you request, for these specified purposes:
- To create and manage your learning account and enrol you in the courses you subscribe to.
- To send you your login credentials, subscription confirmations, renewal notices, and essential service communications.
- To process your payment (via our payment partner) and maintain transaction records as required by law (e.g. tax/accounting).
- To provide customer support and respond to your queries.
- To secure the service, prevent fraud and abuse, and comply with applicable law.
Under the DPDP Act, our lawful basis is your consent (which you give when you tick the agreement box and subscribe) and, where applicable, the legitimate use of providing a service you have requested. You may withdraw consent at any time (see Section 8); withdrawal does not affect processing already carried out, and may mean we can no longer provide the service.
4. Payments & what we do not store
Payments are processed by Razorpay Software Private Limited ("Razorpay"), a third-party payment gateway, in accordance with applicable Reserve Bank of India and PCI-DSS requirements. When you pay, your card/UPI/bank details are entered on Razorpay's secure interface and are processed by Razorpay — they are never transmitted to or stored on our servers. We receive only a payment reference, the amount, and the payment status. Razorpay's own privacy policy governs its handling of your payment-instrument data.
5. Who we share data with
We do not sell your personal data. We share it only with the following categories of Data Processors, strictly to deliver the service:
- Razorpay — to process payments (see Section 4).
- Our cloud infrastructure and email provider (Microsoft Azure, including Azure Communication Services) — to host the service and send you transactional email.
- Professional advisers and authorities — where required by law, court order, or to protect our legal rights.
Where any provider processes data outside India, we take steps to ensure protection consistent with applicable Indian law and any restrictions notified by the Government under the DPDP Act.
6. How long we keep it
We retain your personal data only for as long as necessary for the purposes above. In practice:
- Account & learning data: for as long as you maintain an account with us, and for a reasonable period afterwards so you can resume or renew without losing your progress, unless you ask us to delete it.
- Transaction records: for the period required by applicable tax, accounting, and other laws.
- Operational/technical logs: for a short period for security, then routinely purged.
When data is no longer required and there is no legal obligation to retain it, we delete or anonymise it.
7. How we protect it
We apply reasonable security safeguards consistent with the IT Act, 2000, the SPDI Rules, 2011, and the DPDP Act, including: encryption in transit (HTTPS), access controls and least-privilege access to systems, secrets kept out of source code, masking of personal data in logs, and not storing payment-instrument data at all. No method of transmission or storage is perfectly secure; in the event of a personal-data breach, we will act in accordance with our obligations under applicable law.
8. Your rights
Subject to applicable law, you have the right to:
- Erasure of your personal data where it is no longer required and not subject to a legal retention obligation.
- Withdraw consent at any time (this may end your ability to use the service).
- Grievance redressal — to raise a complaint with our Grievance Officer (Section 11).
To exercise any right, contact us using the details in Section 11. We may need to verify your identity before acting on a request.
9. Children & parental consent
Pencilastic provides career-guidance learning content aimed at school students (including those in Grades 8–10, who may be under 18). Under the DPDP Act, processing the personal data of a child (a person under 18) requires verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
Accordingly, the account holder who subscribes and provides personal data must be a parent or lawful guardian (or an adult aged 18 or over) who consents to this Policy on behalf of the student where the student is a minor. By subscribing, you confirm you are authorised to provide this consent. If you believe a child's data has been provided without appropriate consent, contact our Grievance Officer and we will address it.
10. Cookies & tracking
Our website uses only the minimal storage necessary to operate (for example, to carry your details securely from the sign-up form to the payment step within your session). Our learning platform may use essential cookies required to keep you logged in. We do not use our site to run third-party advertising or cross-site behavioural tracking.
11. Grievance Officer & contact
In accordance with the IT Act/SPDI Rules and the DPDP Act, you may contact us — including our Grievance Officer / Data Protection contact — at:
- Grievance Officer (data protection): gc@pencilastic.com
We aim to acknowledge and address grievances within the timelines prescribed by applicable law.
12. Changes to this policy
We may update this Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be notified by reasonable means (e.g. a notice on this page or by email). Your continued use of the service after an update constitutes acceptance of the revised Policy, to the extent permitted by law.