Privacy Policy

We collect only what we need to run the Service securely. We do not sell your data, and we do not run third-party advertising or cross-site tracking.

• Account details — your name and email address, which you give us at sign-up.
• Password — stored only as a one-way hash (see “How we protect your data”). We never store or can read your actual password.
• Learning progress — which labs and Academy lessons you have started or completed, and any certificates issued to you.
• Security & audit logs — records of key actions such as sign-in, sign-out and lab sessions, kept to keep accounts and the platform secure.
• IP address & technical data — your IP address is processed for rate-limiting, abuse prevention and security. We do not use it to build an advertising profile of you.
• Payment metadata — for paid plans, our payment processor tells us metadata such as whether a payment succeeded, the plan, amount, currency and a transaction reference. Your full card details are entered with, and handled by, the payment processor — they are not stored on ZerodayLearn.
• Support messages — anything you send us when you contact support.

We use your data for the purposes below. Where the GDPR applies, the lawful basis is shown; the DPDP Act relies mainly on your consent and on certain “legitimate uses”, which map closely to these.

• To provide the Service — create your account, run your labs, track progress and issue certificates. Basis: performance of our contract with you.
• To take payment for paid plans. Basis: performance of a contract.
• To keep the platform secure — rate-limiting, abuse and fraud prevention, and audit logging. Basis: our legitimate interest in a safe service, and compliance with law.
• To communicate with you about your account, security, and service changes. Basis: contract and legitimate interest.
• To meet legal obligations — for example tax and accounting. Basis: legal obligation.

We use a small number of strictly necessary cookies. We do not use advertising cookies or third-party tracking, and there is no cross-site profiling.

• Session cookie (zdl_session, or __Host-zdl_session over HTTPS) — keeps you signed in. It is signed, and marked HttpOnly and Secure.
• Lab-ownership cookie (pl_lab) — a signed token that proves a running lab belongs to your session, so only you can reach your lab instance.

Because these cookies are essential to deliver a service you have asked for, they do not require consent under the applicable rules, but you can block them in your browser — the Service will not work properly without them.

We keep personal data only as long as we need it. Account and progress data is kept while your account is open. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep certain records longer — for example security and audit logs for a limited retention window, and billing records for as long as tax and accounting law requires. Backups are rotated and purged on a routine schedule.

We share personal data only with service providers who help us run ZerodayLearn, and only as far as they need it to do their job. Each is bound by contract to protect your data and to use it only on our instructions.

• Payment processor — to take and manage payments and handle card data (which does not reach us).
• Infrastructure & hosting providers — to host the application, run lab containers and store data.
• Authorities — where we are legally required to disclose data, or to protect our rights, users or the public.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

Security is the subject we teach, and we hold ourselves to it. Our measures include:

• Password hashing with scrypt, a slow, memory-hard algorithm, using a unique random salt per password. We store only the hash, never the password itself.
• Signed tokens. Session and lab-access tokens are protected with HMAC using independent, separately derived secret keys, so compromising one does not forge another.
• Isolated lab containers. Each vulnerable lab runs in its own locked-down, non-root, network-isolated container, separated from the platform and from other learners.
• Transport security. Traffic is served over HTTPS/TLS in production, and session cookies are marked Secure and HttpOnly.
• Access control and logging of sensitive actions, with least-privilege access to systems and data.

No system is perfectly secure, but if a data breach is likely to affect you we will notify you and the relevant authority (such as the Data Protection Board of India or your supervisory authority) as the law requires.

We are India-based and may process and store data in India and in other countries where our service providers operate. Where we transfer personal data across borders, we do so only to destinations permitted under applicable law and with appropriate safeguards in place — for example standard contractual clauses under the GDPR, or transfers to countries not restricted under the DPDP Act.

The Service is intended for adults. Paid subscriptions require you to be 18 or older, and anyone aged 16–18 may use the Service only with verifiable consent from a parent or legal guardian. We do not knowingly collect personal data from children under 16. In line with the DPDP Act, we do not track, profile or serve targeted advertising to children. If you believe a child has given us personal data without the required consent, contact us and we will delete it.

You have rights over your personal data. Depending on where you live, these include the right to:

• Access the personal data we hold about you and get a summary of it.
• Correct data that is inaccurate, and complete data that is incomplete.
• Erase your data, including by deleting your account.
• Withdraw consent at any time, where we rely on consent (this does not affect processing already done).
• Portability — receive certain data in a portable format (GDPR).
• Object to or restrict certain processing, and nominate another person to exercise your rights if you die or become incapacitated (DPDP Act).
• Complain to a supervisory authority or the Data Protection Board of India.

To exercise any right, email grievance@zerodaylearn.com. We will respond within the time the law requires. We may need to verify your identity first.

In line with the DPDP Act and Indian IT rules, we have appointed a Grievance Officer to address your questions and complaints about how we handle your data.

For general privacy questions you can also reach us at support@zerodaylearn.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India or, in the EU/UK, to your local data-protection authority.

We may update this Privacy Policy from time to time. When we make a material change, we will update the “Last updated” date above and, where appropriate, notify you by email or an in-product notice. Please review it periodically.