Privacy Policy

Overview

This Privacy Policy explains how personal data is handled when you use Centrely (the “Service”), a personal project built and operated by Sudwipto Kumar Mondal (“I”, “me”). I act as the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Service you agree to the collection and use of information in line with this policy. If you do not agree, please do not use the Service.

Data I collect

Data you provide

• Account data — name, email address and password (stored only as a salted hash) when you register.
• Business data — records you enter to run your branches: students, teachers, batches, schedules, payments, allocations, discounts and receipts.
• Contact data — anything you send when you book a demo or email me for support.

Data collected automatically

• Technical data — IP address, browser type, device information and pages visited, gathered through standard server logs and my hosting provider.
• Session data — cookies strictly necessary to keep you signed in and to secure the Service.

How I use data

• To provide, operate and maintain the Service.
• To authenticate you and enforce row-level access control.
• To respond to demo requests and support enquiries.
• To detect, prevent and address technical or security issues.
• To comply with legal obligations.

I do not sell your personal data, and I do not use it for advertising or profiling.

Legal bases

I rely on the following legal bases under UK GDPR:

• Contract — to deliver the Service you have signed up for.
• Legitimate interests — to secure, maintain and improve the Service.
• Consent — where you have specifically agreed, for example when contacting me for a demo.
• Legal obligation — where the law requires it.

Sub-processors

The Service is built on third-party infrastructure. These providers process data on my instructions:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.

Each provider operates under its own data-processing terms and appropriate safeguards for any international data transfers.

Data retention

I keep personal data only for as long as needed to provide the Service or to meet legal obligations. When you delete your account, associated personal data is deleted or anonymised within a reasonable period, except where retention is legally required.

Your rights

Under UK GDPR you have the right to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• request erasure of your data;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time.

To exercise any of these rights, email sudwiptokmondal@gmail.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Security

I use reasonable technical and organisational measures to protect your data, including encryption in transit and database row-level security. See the Security page for detail. No method of transmission or storage is completely secure, so I cannot guarantee absolute security.

Children

The Service is intended for use by tuition and coaching businesses, not directly by children. Where you enter data about students who are minors, you are responsible for having a lawful basis and any required consent to do so.

Changes to this policy

I may update this policy from time to time. Material changes will be reflected in the “Last updated” date above. Continued use of the Service after changes means you accept the revised policy.

Contact

Questions about this policy or your data? Email sudwiptokmondal@gmail.com.