Privacy Policy

1. Who we are and what this policy covers

BitMento (“BitMento”, “we”, “us”) is an AI-assisted learning platform operated from Goa, India. This policy explains what personal data we collect when you use bitmento.com and the BitMento app (together, the “Service”), why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and its rules, BitMento is the entity that decides why and how your personal data is processed. By creating an account or using the Service you agree to this policy. If you do not agree, please do not use the Service.

2. The personal data we collect

We collect the following categories of data, depending on how you use the Service.

• Account data. Your full name, username, email address, password (stored only as a one-way hash, never in readable form), the role you select when signing up (student, working professional, teacher or other), an optional phone number, and an optional promo, referral or institution code. If you sign in with Google, we receive the basic profile details Google shares with us for that purpose.
• Profile data you choose to add. For example a profile photo link, bio, location, education and career details, skills, links to your professional profiles, the name you want printed on certificates, and whether your public profile is switched on.
• Learning activity. The goals, topics and messages you give our AI when building a course or chatting with the mentor; courses generated for you; lesson progress; practice attempts; the code you write and run; answers and results in arcade games and the problem lab; skill ratings, XP, levels, streaks, badges and leaderboard standing; and certificates you earn. If you upload a syllabus or notes to help build a course, we read the text out of the file in memory to use it for that request; we do not save the file itself.
• Practice-integrity data. During graded course practice we record each time you leave the practice tab together with the reason you type, and — if you allow it — periodic camera checks. Section 4 explains exactly what that involves.
• Payment data. When you buy a plan, payment is handled by Razorpay. We receive and store the order and payment identifiers, the plan, amount, currency and status, and any promo code used. We do not receive or store your card, UPI or bank credentials.
• Technical and security data. IP address, device, operating system and browser details, approximate location derived from them, sign-in times and security events. We use this to keep accounts secure and to detect abuse.
• Waitlist data. If you previously joined our waitlist, we hold the name, email address, optional phone number and interest you gave us. It is stored in a Google Firebase (Firestore) database.

3. How we use your data

We use personal data to:

• create and secure your account and sign you in;
• generate courses and lessons, run your code, power the mentor chat, and adapt arcade and problem difficulty to your skill;
• track progress, award XP, levels and streaks, and issue certificates you earn;
• operate your public profile and certificate verification pages if you turn them on;
• protect the fairness of graded practice (Section 4) and detect fraud, abuse and security incidents;
• process payments, apply promo codes, activate plans and handle refunds;
• send service messages such as account, security and payment notices;
• maintain, debug and improve the Service; and
• comply with legal obligations and respond to lawful requests.

We do not sell your personal data, and we do not show third-party advertising.

4. Camera checks and practice-integrity monitoring

Graded course practice can include two integrity measures. They apply only inside that practice area, not across the rest of the Service.

• Tab-switch record. If you leave the practice tab, the editor pauses and asks you to type a short reason. We store the time and the reason you give, and a count of switches, on that attempt.
• Camera check (only with your permission). Before any camera use we show a consent screen. If you allow it, your browser takes a small snapshot roughly every 13 seconds and sends it to our servers, which pass it to Google’s Gemini API to answer two coarse questions: is a second device (such as a phone) visible, and does the person appear to be looking at the screen. We do not use the images to identify you or to build a face profile.
• What we keep. We do not save the images. We keep only the outcome — a flag type, a confidence score and a timestamp — on the attempt. The images are processed by Google under Google’s own terms for the API.
• If you decline or have no camera. You can still practise. We ask for a one-line reason and record that the camera was not used. Declining is not treated as a violation.
• Limits. These checks are automated, coarse signals and can be wrong. A flag is a prompt for review, not proof of misconduct. You can withdraw camera permission at any time in your browser settings.

5. Who we share data with

We share personal data only with service providers that help us run the Service, and only what each needs. They act on our instructions and under their own terms and privacy commitments:

• Groq — AI model provider that generates courses, lesson content, game questions and mentor-chat replies from the text you and our system send it.
• Google — Gemini API (camera-check analysis, Section 4), Firebase (Google sign-in and the waitlist database).
• Judge0 — sandboxed code execution; the code you choose to run, and any input you provide, is sent there to be executed.
• Razorpay — payment processing for plan purchases.
• Hosting and infrastructure providers — Vercel (website), Render (application server) and our database hosting provider.

We may also disclose data if required by law, court order or a lawful government request, or to protect the rights, safety and security of our users and the Service. If BitMento is involved in a merger, acquisition or sale of assets, data may transfer to the successor, which will be bound by this policy.

What others can see. Your public profile is off by default. If you switch it on, anyone with the link can see your username, avatar, bio, badges, streak, leaderboard standing and certificates. Each certificate also has a public verification page, reachable by anyone who has its verification code or link, showing the name on the certificate, course title, issue date and score summary. You can switch your profile off at any time in Settings.

6. Where your data is processed

Our providers operate infrastructure in India and in other countries, so your data may be processed outside India. Where the DPDP Act or other applicable law restricts transfers to particular countries, we will comply with those restrictions. By using the Service you understand that your data may be handled in these locations.

7. Consent and lawful use

We process your personal data with your consent — given when you accept our Terms and this policy at sign-up, and again at the point of any optional feature such as the camera check — and for the limited “legitimate uses” the DPDP Act recognises, such as providing a service you asked for, complying with the law, and preventing fraud and security incidents. You can withdraw consent at any time; withdrawing may mean we can no longer provide the feature that depended on it, and does not affect processing done before you withdrew.

8. How long we keep data

We keep account and learning data while your account is active and for as long as needed to provide the Service. When you ask us to delete your account we erase or anonymise your personal data unless we must keep some of it — for example payment and invoice records that tax and accounting laws require us to retain, records needed to resolve a dispute, or security logs needed to investigate abuse.

Camera images are not stored by us at all. Waitlist entries are kept until you ask us to remove them or until we no longer need them.

9. How we protect your data

We use encryption in transit (HTTPS), hashed password storage, access controls and ownership checks so that accounts can only reach their own data, rate limiting on sensitive endpoints, and sandboxing for code execution. No system is perfectly secure, and we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.

10. Your rights and how to use them

Under the DPDP Act and other applicable law you can:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct inaccurate data and complete incomplete data;
• ask us to erase your data, including closing your account;
• withdraw consent you have given;
• nominate another person to exercise your rights if you die or become unable to; and
• raise a grievance with us and, if unresolved, complain to the Data Protection Board of India.

You can edit most profile details and your public-profile setting yourself inside the app. For access, correction or deletion requests, or to withdraw consent, email support@bitmento.com from the address on your account. We may need to verify your identity first, and we will respond within the time the law requires.

11. Children

BitMento is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or legal guardian, and we do not track or monitor the behaviour of children or target advertising at them. If you are a parent or guardian and believe a child has created an account without your consent, email support@bitmento.com and we will delete the account and its data.

12. Cookies and similar technologies

We use only what is needed to run the Service:

• Sign-in cookie (bm_token) — keeps you signed in. It is not readable by scripts on the page.
• Language cookie (bm_locale) — remembers the language you chose.
• Browser storage — your light/dark theme, your camera-permission choice, dismissed notices for the current session, and cached course data to make pages load faster. Google sign-in may also keep its own sign-in state in your browser.

We do not currently use advertising cookies or third-party analytics trackers. If that changes we will update this policy before it takes effect. You can clear cookies and storage in your browser at any time; doing so will sign you out and reset these preferences.

13. Changes to this policy

We may update this policy as the Service or the law changes. We will change the “Last updated” date above and, for material changes, tell you in the app or by email. Continuing to use the Service after a change takes effect means you accept the updated policy.

14. Contact and grievance officer

Questions, requests and complaints about your personal data can be sent to our Grievance Officer at support@bitmento.com. Postal correspondence: BitMento, Goa, India. We aim to acknowledge requests promptly and resolve grievances within the period the law prescribes.