Privacy Policy

Who We Are

This website is operated by TrojanByte Labs Private Limited, a company based in Jaipur, Rajasthan, India. We act as the data fiduciary for the personal data you submit here, as described in the Digital Personal Data Protection Act, 2023.

What We Collect

We only collect what you choose to give us through our forms:

• Contact enquiries, your name, organisation, e-mail address, optional phone number and your message.
• Making Digital Bharat Surakshit applications: organisation details, the website to be assessed, contact person details, your description and, optionally, an authorisation letter.
• Training certificates, the holder’s name, programme, batch, dates, learning hours and grade as printed on the certificate. Anyone who has a certificate ID can see these details on our verification page; they are not listed by search engines.
• TrojanByte Academy, your mobile number (Indian numbers only) when you verify it with a one-time SMS code to unlock course details or download a syllabus; the pages and actions linked to that number (course visits, syllabus downloads, demo or advisor requests) so our admissions team can follow up; if you book a demo class or ask a program advisor to call you, your name, e-mail address (demo only), preferred language, date or time and optional message; and, if you enroll, your name, e-mail address, the course, plan, language, promo code, scholarship and order amounts. Marketing messages are sent only if you tick the optional box.
• Event registrations: your verified mobile number, your e-mail address (required, because we send every update about the event, its joining details, the feedback link and your certificate to it), your name and organisation if you give them, any promo code and the fee. For a team CTF, your team's name.
• Job applications: your name, e-mail address, mobile number, city, preferred language, the role you apply for, your answers about your skills and experience, links to your work, practical details (when you could start, how you would like to work, optional expected pay) and, if you attach one, your resume. See Job applications.
• Launchpad ideas: your name, e-mail address, mobile number, city, state, age group and what you do now; your idea (its name, sector, stage, the problem, your solution, its users and how it earns, alternatives), your team, the time you can give, whether your business is registered, how it is funded, the help you need, an optional link and anything else you tell us. See Launchpad.
• Security records: a one-way cryptographic fingerprint of your IP address and your browser’s user-agent string, used to prevent abuse. We do not store your raw IP address with your submission.
• Visit records: when you open a page of our website we record, for security and to meet our legal duties, the date and time, your IP address (stored encrypted), your browser and device type, the pages you open (cleaned so that no private reference in an address is kept), the site that sent you and any campaign tags in the address. We keep one entry per visitor per day, recognised from your IP address and browser; no cookie is set for this.
• SMS records: for every SMS we send you (a verification code, a link) we keep the date and time, its reference, your number (encrypted), the text with any one-time code hidden and any private link shortened, the sender ID and template, whether it was handed to the operator and (when our provider reports it) whether it reached your phone and why not, and the IP address (encrypted) and browser of the request that asked for it.

Please do not send passwords, exploit code or sensitive personal data through our forms.

Why We Use It

• To respond to your enquiry and provide the services you ask about.
• To assess eligibility for, verify and deliver the Making Digital Bharat Surakshit initiative, including sending one-time codes needed to download your report.
• To let employers and institutions confirm that a training certificate is genuine.
• To verify your mobile number, share course details you asked for, process enrollments, demo classes and scholarships and contact you about your order.
• To consider you for a role at TrojanByte Labs and contact you about it.
• To protect this website and our users from spam, fraud and attacks.

We process this data on the basis of the consent you give when you submit a form. We do not use it for unrelated marketing and we do not sell it.

How We Protect It

• Contact details, messages and application descriptions are encrypted in our database.
• Uploaded files are checked, re-processed where possible and stored privately. They are never publicly accessible.
• VAPT reports are encrypted at rest, never sent as e-mail attachments, and can be downloaded only after a one-time code sent to the applicant’s e-mail address.
• Only authorised staff using two-factor authentication can view submissions, and access is logged.
• All connections to this website use HTTPS.

Job Applications

When you apply for a role, or send an open application, on our careers page:

• We do not ask for degrees, marksheets, certificates or identity documents when you apply. If you are selected, we may ask for documents to verify your identity and anything the role requires, at that stage only.
• Your contact details, answers, the links you share and your resume's file name are encrypted in our database. Your resume is accepted as a PDF only, encrypted before it is stored and can be opened only by authorised staff, and each download is logged.
• We do not visit or fetch the links you share automatically; a person may open them while reviewing your application.
• Only the people who handle hiring can see applications. Internal notes and the status of your application are kept with it.

Launchpad Ideas

When you send an idea to Launchpad, our programme that helps founders with technology:

• Your contact details and everything that describes your idea are encrypted in our database. Only the people who review ideas can read them.
• We use them only to review your idea, contact you about it and, if it is selected, plan the support with you. We do not share your idea with anyone outside TrojanByte Labs.
• We do not visit or fetch the link you share automatically; a reviewer may open it while reading your idea.
• You must be 18 or older to apply online. Applying does not guarantee support.

Security-Awareness Demonstrations at Events

At some of our events we run an ethical, opt-in phishing-awareness demonstration. When you mark your attendance by scanning the event QR code at a participating event, your device may take a single photo from its front camera at that moment, and show it back to you straight away with a short message explaining what happened.

• The photo is captured and shown entirely on your own device, in your browser. It is never sent to us and never stored on our servers, and it is deleted the instant you close the message.
• We keep only a record of how you marked attendance (by scanning or by typing the code) so we can show the awareness results. We never keep the image, and typing the code instead of scanning avoids the demonstration entirely.
• The purpose is education and awareness: to show, safely, how an everyday action like scanning a QR code can use a permission you have already granted. Your data is safe with us; the demonstration is designed to teach, not to collect.

Partnered Events and Official E-mail Addresses

Some events we run with a university, college or company are open only to its students or staff. To register for one, after verifying your mobile number you enter the official e-mail address your organisation gave you, and confirm it with a code we send to it.

• We keep the address (encrypted) with your registration, only to confirm that you are eligible for that event.
• Each address can register one person for an event. To check this we keep a one-way fingerprint of the address, not the address itself.
• The code is valid for a few minutes and is kept only as a one-way fingerprint until it is used.

Feedback After Events

If you attended an event or CTF, we send you a personal feedback link by e-mail a few hours after it ends (and one reminder a few days later if you have not answered), or show it on your registration page. The link works once.

• Two questions are required (an overall rating and how likely you are to recommend it); everything else is optional. Your written answers are stored encrypted.
• You can hide your name from our team: your answers still count once, but we do not see who gave them.
• We quote what you found most useful only if you tick the box to allow it, with your first name.
• An event page may show the average of everyone's overall rating and how many rated, once at least 3 people have answered. Individual ratings are never shown.

Photos From Events

We may take photos at our events and show a selection on the event's page afterwards. Before a photo goes online we save it again as a plain image, which removes the location and camera details a phone stores in it.

• If you appear in a photo and would rather not, contact us with the event and the photo, and we will remove it.
• Photos are not used to identify people and are never combined with your registration details.

Event Certificates

If you met an event's attendance requirement, we issue a certificate with your name as you registered it, the event and its dates. It depends on your attendance only, never on whether you gave feedback. Anyone holding its ID or QR code can check it on our verification page, which shows only what is printed on the certificate.

Hearing About Our Next Event

On the page of a past event you can leave your e-mail address to hear about our next one. We keep the address encrypted, send one e-mail when the next event is announced, and then delete the request. Nothing else is sent.

Onboarding Our Team: Contractors, Employees and Interns

If we invite you to work with us as a contractor, a full-time employee or an intern, you receive a personal onboarding link. Opening it on a new browser sends a code by SMS to the number we invited.

• PAN: we check your PAN with an authorised verification service (Cashfree or SignCare), which returns the details held by the Income Tax Department: your name, date of birth, gender, address and whether your PAN is linked with Aadhaar. We show them to you before using them, and we keep your PAN encrypted. If the check is not possible, you can send a photo of your PAN card instead, which is stored encrypted and checked by hand.
• Agreement: you sign our Non-Disclosure Agreement with Aadhaar eSign on the page of our eSign service (SignCare, or Leegality as a backup). You enter your Aadhaar number and OTP there only: we never receive your Aadhaar number. We keep the signed agreement (encrypted) and the name and birth year shown on the signature.
• Full-time employees: for payroll and your Provident Fund we ask for your father's or spouse's name (as the PF form needs it), your UAN if you already have one, earlier PF membership and previous employer, your income tax regime, and your salary bank account. Marital status, blood group, education and certificates are optional. We never ask for your Aadhaar number: if you need a new UAN, it is created on the government's own app.
• Interns: we ask for your institution, course, year and (optionally) enrolment number and your college's NOC. Without a PAN you can send your college ID card, which is checked by hand. If a stipend is paid, we ask for the bank account it goes to. You need to be 18 or older to onboard online; younger interns are onboarded with a parent or guardian.
• Other people's details: the nominees (for gratuity and other dues) and the emergency contact you name are used only for that purpose. Please tell them you are sharing their details with us.
• Everything above is stored encrypted. Your bank account number is shown to our team only in part; showing it in full needs a fresh second factor and is recorded.
• Your progress is saved on our server as you go, so you can continue later. Only our core team can open your onboarding, and every time someone views your full PAN or account number or downloads a document it is recorded.
• Letters we issue you: an offer, appointment, internship or experience letter carries your name, the details it states and a QR code. We keep a copy of each letter encrypted. Anyone holding the letter can check it on our verification page, which shows the kind of letter, its number, its date, your name and whether it is still valid (never why it was withdrawn).

How Long We Keep It

We keep personal data only while we need it for the purpose you gave it for, or for as long as a law requires. Nothing is deleted by an automatic timer: our team reviews what we hold and deletes it by hand, and we review each kind of record at least at the points below.

• Contact enquiries: reviewed 24 months after submission.
• Initiative applications, authorisation letters and VAPT reports: reviewed 36 months after submission.
• Job applications, including resumes and notes: reviewed 12 months after you apply.
• Launchpad ideas that are not selected: reviewed 24 months after you apply. Ideas we support are kept while we work together.
• Visit records: reviewed 6 months after the visit (India's CERT-In directions expect such logs to be kept for 180 days). SMS records: reviewed 12 months after the SMS.
• Onboardings that do not lead to an engagement: reviewed 12 months after they close. The records of people we work with are kept for as long as the engagement and tax and labour laws require.
• Letters we issued: reviewed 96 months after the letter's date, never while you work with us.
• Training and event certificates: kept as permanent records so they can be verified. You can ask us to revoke a certificate issued to you.
• Event photos: kept on the event's page until you or we remove them.
• Academy mobile verifications without an order or a seat: reviewed 24 months after the last verification. Orders are kept as long as tax and accounting laws require.

You can ask us to delete your data at any time, and we will, unless we must keep it to meet a legal obligation.

Sharing

We do not share your personal data with third parties except service providers that help us operate this website (for example e-mail delivery or spam protection), or where the law requires it. One-time codes by SMS are delivered by MSG91 or Authkey, which receive your mobile number and the code only. Before any one-time code is sent, Cloudflare Turnstile may check that a person, not a script, is asking; Cloudflare receives your IP address and browser details for that check.

Paying Online

When you pay a course, demo or event fee online, you pay on the secure page of our payment gateway, Razorpay Software Private Limited or Cashfree Payments India Private Limited. To open that page we send the gateway the amount, a reference for your fee, your mobile number, a customer number we derive from your account (not your phone number) and, if you gave them, your name and e-mail address, so the payment and its receipt can be matched to you. You enter your card, UPI or bank details on the gateway's page only: we never receive or store them. From the gateway we keep the payment's status, its reference and the payment method (for example UPI or card). The gateways process your payment under their own privacy policies and the Reserve Bank of India's rules for payment aggregators.

If a payment request is altered on its way to our server (for example, to change a price), you still pay the actual fee, and we keep a record of the attempt for two years to protect the site: your account, the fee, what was changed, and the IP address and browser the request came from.

Cookies

Essential cookies run this site: a session cookie, a security token that protects our forms and, if you verify your mobile number for TrojanByte Academy, a cookie that remembers the verification on that device for 400 days. If we invite you to onboard, a cookie remembers that your browser confirmed the code, until your link expires.

We do not use analytics, advertising or cross-site tracking cookies.

Analytics and Ad Measurement

We do not use analytics or advertising tools on this website. If we start, this section will say which, and nothing will load without your permission.

Your Rights

You may ask to access, correct or erase your personal data, withdraw your consent, or raise a grievance about how it was handled. Withdrawing consent does not affect processing that already took place.

Contact

To exercise your rights or ask a question about this policy, e-mail hello@trojanbyte.com or use our contact form. Please include your submission reference if you have one.