Privacy Policy

Last updated: 15 April 2026

1. Introduction

Learning Bench ("we", "us", "our") is a gamified learning application designed for delivery leaders. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Learning Bench application ("App").

We are committed to complying with the EU General Data Protection Regulation (GDPR) and the Indian Digital Personal Data Protection Act, 2023 (DPDP Act).

Data Fiduciary / Controller: Amit Shah
Contact: shahamitkumar@gmail.com

2. Data We Collect

Category	Specific Data	Source
Account information	Name, email address, profile photo	Google Sign-In
Role selection	Delivery role chosen during onboarding	User input
Learning progress	Scenario completion status, chosen responses, XP scores	App usage
Device information	Device model, OS version, app version, screen size	Automatic collection
Analytics data	Feature usage, session duration, crash reports	Firebase Analytics
Push notification tokens	FCM device token	Firebase Cloud Messaging

We do not collect financial information, precise location data, contacts, or any special-category personal data.

3. Legal Basis for Processing GDPR

Purpose	Legal Basis (GDPR Art. 6)
Account creation and authentication	Performance of a contract (Art. 6(1)(b))
Tracking learning progress and XP	Performance of a contract (Art. 6(1)(b))
Analytics and app improvement	Legitimate interest (Art. 6(1)(f))
Push notifications	Consent (Art. 6(1)(a))

4. Purpose of Processing DPDP

Under the DPDP Act, 2023, we process your personal data for the following lawful purposes:

• To provide and operate the Learning Bench service
• To authenticate your identity via Google Sign-In
• To track and display your learning progress and XP scores
• To send push notifications about new scenarios or reminders (with your consent)
• To improve the App through aggregated analytics

5. Data Storage and Security

Your data is stored in Firebase (Google Cloud Platform) in the europe-west2 (London) region. We use the following security measures:

• Firebase Security Rules to restrict data access
• Data encrypted in transit (TLS) and at rest (AES-256)
• Authentication enforced for all data operations
• Minimal data collection principle — we only store what is necessary

6. Data Sharing

We do not sell, rent, or trade your personal data to any third party.

We share data only with the following service providers, who act as data processors on our behalf:

Provider	Purpose	Data Shared
Google / Firebase	Authentication, database, analytics, push notifications	Account info, progress data, device info, analytics events

Google processes data in accordance with the Firebase Privacy and Security documentation and applicable data processing terms.

7. Data Retention

• Account data and progress: Retained for as long as your account is active.
• Analytics data: Retained for 14 months (Firebase Analytics default), then automatically deleted.
• Deleted accounts: All associated personal data is permanently removed within 30 days of account deletion.

8. Your Rights

Under GDPR (EU/EEA Users)

You have the following rights under Articles 15 – 22 of the GDPR:

• Access — Request a copy of your personal data (Art. 15)
• Rectification — Correct inaccurate data (Art. 16)
• Erasure — Delete your account and all associated data (Art. 17)
• Restriction — Restrict processing in certain circumstances (Art. 18)
• Data Portability — Receive your data in a machine-readable format (Art. 20)
• Object — Object to processing based on legitimate interest (Art. 21)
• Withdraw Consent — Withdraw consent for push notifications at any time

To exercise any of these rights, email shahamitkumar@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local Data Protection Authority.

Under DPDP Act (Indian Users)

As a Data Principal under the DPDP Act, 2023, you have the right to:

• Access — Obtain a summary of your personal data and processing activities (Sec. 11)
• Correction and Erasure — Request correction, completion, updating, or erasure of your data (Sec. 12)
• Grievance Redressal — Raise a grievance with us; we will address it within 30 days (Sec. 13)
• Nominate — Nominate another individual to exercise your rights in case of death or incapacity (Sec. 14)

9. Account Deletion

You can delete your account directly within the App via Settings > Delete Account. This will:

• Permanently remove your profile information
• Delete all scenario progress and XP scores
• Revoke your Google Sign-In link
• Remove your FCM token and stop all notifications

Deletion is irreversible and completed within 30 days.

10. Children's Privacy

Learning Bench is not intended for children under the age of 16 (GDPR) or 18 (DPDP Act). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately so we can delete it.

11. International Data Transfers

Your data is stored in the europe-west2 (London) region. If you access the App from outside the UK/EEA, your data will be transferred to this region. For transfers from the EEA, we rely on Google's Standard Contractual Clauses (SCCs) as the appropriate safeguard.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted within the App and on this page with an updated "Last updated" date. For material changes, we will notify you via push notification or email.

13. Contact Us

If you have questions, concerns, or wish to exercise your data rights, please contact:

Amit Shah
Learning Bench
Email: shahamitkumar@gmail.com

For grievances under the DPDP Act, you may also contact the Data Protection Board of India once established.