Last changed 2026-10-13

Privacy

This covers Natural Intelligence and Find Your Passion. It is written to describe what the software actually does, so where it is specific, that specificity is deliberate.

Who is responsible

Turtle Labs is the trading name of a sole proprietorship of Aditya Bisen. Its registered office is #3, L2, Maxx Pride, Manish Nagar, Nagpur, Maharashtra 440037, India, and it has a regional office at Kochi, Kerala, India.

In the language of the Digital Personal Data Protection Act, Aditya Bisen, trading as Turtle Labs, is the Data Fiduciary and you are the Data Principal. A proprietorship has no legal personality of its own, so the person named here is the one accountable for your information, rather than a company standing between you and them.

You can reach us about anything here at info@turtlelabs.co.in.

What we hold, and why

Grouped by what it is, because the categories behave differently and deserve different treatment.

We do not buy information about you, we do not sell anything about you, and we do not use anything you write to train a model.

Your account	Your email address, and your name if you gave one. There is no password: signing in works by a link sent to that address.	So your journal can find you again.
What you write in a practice	The line you write after a sit, and anything you log about what you made. This is the most personal thing here, and it can touch health, mood and belief.	It is the product. Nothing is derived from anything else.
Assessment answers	Your answers to the Natural Intelligence assessment and, if you take it, the Find Your Passion profile.	To show you your own result.
Answers you write in a book or a strategy	Whatever you type into the Brand Systems workbooks, and into the strategy questions at the end of a brand audit. Your own words about your own business, filed against your address.	So you can read them back later, and so the document can be rebuilt from them. They are never used to train anything.
Photographs you attach	Any image you add to something you made.	So the thing you made has the evidence attached.
The free quiz	Nothing, unless you are signed in and ask us to keep it. The five answers are scored in the request and are not written down.	There is no reason to store what nobody asked us to keep.
People you refer	Names, addresses and phone numbers you type into the referral form.	Only so the invitations can be prepared for you to send. We do not contact them.
Enquiries	What you type into a contact form, and the address it came from.	To answer you.
Payments	What you bought, when, how much, and the reference the payment provider gives us. Not your card number, which we never receive.	To prove you paid for what you have, and to keep the books.
Technical	Your IP address at the moment of a request, for rate limiting.	So the forms cannot be used to send mail at scale.

The lawful basis

Your account, your practices and your assessments are processed because you asked us to provide them: without that information there is no service to provide.

Referral details, enquiries and anything we send you are processed on your consent, which you gave when you submitted the form and can withdraw at any time.

Rate limiting is processed on our legitimate interest in not having our forms used to send mail at scale, which is also your interest.

What is never done with it

No artificial intelligence decides what your practice meant. Where a paid reading is produced by a model, the page says so before you buy and a person can be asked for instead.

Your Carry number, your assessment result and your passion statement are yours. There is no leaderboard, nothing is comparable between people, and nothing about you is shown to another user unless you deliberately share it.

Nothing you write is used as marketing copy, as a testimonial, or as an example, without asking you first and separately.

Who else touches it

Only the suppliers that make the service run, and each does one job.

Some of these operate outside India, so your information may be processed abroad. We rely on contractual protection with each of them.

We will hand something over if the law requires it. If we are allowed to tell you, we will.

MongoDB Atlas	Stores the database.	Under contract, on infrastructure we configure.
Our mail relay	Sends sign-in links and replies.	Sees your address and the message.
Our hosting provider	Runs the server.	Sees requests as any host does.
Razorpay	Takes payments in India.	Collects your card or bank details on its own page, under its own policy. We never see them.
Lemon Squeezy	Sells and takes payment outside India, as merchant of record.	It is the seller for that transaction. It collects your details and the tax on its own page, under its own policy, and we never see them.

How long it stays

Deleting an entry deletes what it built. That is a rule of the product, not only of this policy: the world you build is exactly as true as your log, so removing the log removes the structure.

Practices, assessments and uploads	Until you delete them, or until you delete your account.
Your account	Until you close it. An account with no activity for three years is deleted after we write to the address first.
Free quiz answers	Not kept at all, unless you are signed in and asked us to keep them.
Referral lists	Ninety days, then deleted.
Enquiries	Two years, so we can pick up a conversation you started.
Rate limiting records	Minutes. They are held in memory and disappear when the process restarts.
Records of payment	Eight years, because tax law requires it. Closing your account does not remove these, and we would be breaking the law if it did. They hold what was bought and when, not what you wrote.

Your rights

Under the Digital Personal Data Protection Act you can ask us to do all of this, and we will not charge you for it.

Write to info@turtlelabs.co.in. We will answer within thirty days and usually much sooner.

See what we hold about you, and get a copy of it.
Correct anything wrong or incomplete.
Delete it. Where you have a paid record we will tell you what deleting removes before we do it, and the record of the payment itself stays for as long as tax law says it must.
Withdraw consent for anything based on consent, as easily as you gave it.
Nominate somebody to exercise these rights if you die or become incapable.
Complain, to us first and to the Data Protection Board of India if we do not resolve it.

Grievances

Our grievance officer is Aditya Bisen, reachable at grievance@turtlelabs.co.in.

We acknowledge within forty-eight hours and resolve within thirty days. If you are not satisfied, you may take it to the Data Protection Board of India.

Children

The programme runs in schools, so under-eighteens using it is expected rather than accidental. The DPDP Act requires a parent's verifiable consent below eighteen, and this is how that works here.

If you believe a child has an account without that consent, write to us and we will delete it.

This is a considered position rather than a settled one: it is on the launch checklist for a lawyer, because in loco parentis as a basis for verifiable parental consent is the part most likely to need changing.

A child never arranges this themselves. The school or the parent does, and the consent we rely on is theirs.
Where a school arranges it, the school confirms to us that it holds each parent's consent for that pupil, and it tells us on which of two bases: the parent signed for it, or the school is acting in loco parentis under its own policy. We keep that confirmation for as long as we keep the pupil's data.
A parent can withdraw consent at any time by writing to us, and the account and everything in it goes. Withdrawal is as easy as giving it, which the Act requires and which is easy to get wrong.
No behavioural advertising is shown to an account we know to be a child's, none of it is tracked across other sites, and nothing is held beyond what the exercise needs.
A school sees a pupil's completion and their result. It does not see the free text a pupil wrote to get there, because a passion statement written honestly is not written for a teacher to read.
A pupil's data is deleted at the end of the school year unless the parent or the school asks us to keep it.

Security

No system is perfectly safe. If something happens that puts your information at risk we will tell you and the Board, promptly and in plain words.

Sign-in links and session tokens are stored hashed, never in readable form, so a copy of the database does not hand anybody a working login.
A sign-in link works once and expires in twenty minutes.
Player accounts and staff accounts are kept in separate collections behind separate cookies, so a fault in the public sign-up cannot produce access to the content management system.
Connections are encrypted in transit.

If something goes wrong

A promise to tell you promptly is worth nothing without a route that starts the moment somebody notices. This is that route.

It goes to the proprietor, Aditya Bisen, directly and first. Not to a queue, and not to whoever happens to be on shift.
The proprietor names one person to own the fix, that same day. That person owns it until it is closed and reports back to the proprietor and the grievance officer as it moves.
Containment comes before explanation. We shut the hole first and work out how it opened afterwards.
You are told what happened, what of yours was involved and what to do about it. The Data Protection Board of India is told in the same breath, and questions go to grievance@turtlelabs.co.in.
Afterwards we write down what happened and what changed because of it, so the same fault does not need discovering twice.

Cookies

A cookie to keep you signed in, if you sign in. A preference stored in your browser for light or dark. Nothing for advertising, and no third-party tracker.

Changes

If we change something that matters we will say so on this page and, where it affects what happens to your information, write to you. The date at the top is the last change.