Last changed 2026-09-12
Privacy
This covers Natural Intelligence and Find Your Passion. It is written to describe what the software actually does, so where it is specific, that specificity is deliberate.
Who is responsible
Turtle Labs is the trading name of a sole proprietorship of Aditya Bisen, at #3, L2, Maxx Pride, Manish Nagar, Nagpur, Maharashtra 440037, India.
In the language of the Digital Personal Data Protection Act, Aditya Bisen, trading as Turtle Labs, is the Data Fiduciary and you are the Data Principal. A proprietorship has no legal personality of its own, so the person named here is the one accountable for your information, rather than a company standing between you and them.
You can reach us about anything here at fyp@turtlelabs.co.in.
What we hold, and why
Grouped by what it is, because the categories behave differently and deserve different treatment.
We do not buy information about you, we do not sell anything about you, and we do not use anything you write to train a model.
| Your account | Your email address, and your name if you gave one. There is no password: signing in works by a link sent to that address. | So your journal can find you again. |
|---|---|---|
| What you write in a practice | The line you write after a sit, and anything you log about what you made. This is the most personal thing here, and it can touch health, mood and belief. | It is the product. Nothing is derived from anything else. |
| Assessment answers | Your answers to the Natural Intelligence assessment and, if you take it, the Find Your Passion profile. | To show you your own result. |
| Photographs you attach | Any image you add to something you made. | So the thing you made has the evidence attached. |
| The free quiz | Nothing, unless you are signed in and ask us to keep it. The five answers are scored in the request and are not written down. | There is no reason to store what nobody asked us to keep. |
| People you refer | Names, addresses and phone numbers you type into the referral form. | Only so the invitations can be prepared for you to send. We do not contact them. |
| Enquiries | What you type into a contact form, and the address it came from. | To answer you. |
| Payments | What you bought, when, how much, and the reference Paytm gives us. Not your card number, which we never receive. | To prove you paid for what you have, and to keep the books. |
| Technical | Your IP address at the moment of a request, for rate limiting. | So the forms cannot be used to send mail at scale. |
The lawful basis
Your account, your practices and your assessments are processed because you asked us to provide them: without that information there is no service to provide.
Referral details, enquiries and anything we send you are processed on your consent, which you gave when you submitted the form and can withdraw at any time.
Rate limiting is processed on our legitimate interest in not having our forms used to send mail at scale, which is also your interest.
What is never done with it
No artificial intelligence decides what your practice meant. Where a paid reading is produced by a model, the page says so before you buy and a person can be asked for instead.
Your Carry number, your assessment result and your passion statement are yours. There is no leaderboard, nothing is comparable between people, and nothing about you is shown to another user unless you deliberately share it.
Nothing you write is used as marketing copy, as a testimonial, or as an example, without asking you first and separately.
Who else touches it
Only the suppliers that make the service run, and each does one job.
Some of these operate outside India, so your information may be processed abroad. We rely on contractual protection with each of them.
We will hand something over if the law requires it. If we are allowed to tell you, we will.
| MongoDB Atlas | Stores the database. | Under contract, on infrastructure we configure. |
|---|---|---|
| Our mail relay | Sends sign-in links and replies. | Sees your address and the message. |
| Our hosting provider | Runs the server. | Sees requests as any host does. |
| Paytm | Takes payments. | Collects your card or bank details on its own page, under its own policy. We never see them. |
How long it stays
Deleting an entry deletes what it built. That is a rule of the product, not only of this policy: the world you build is exactly as true as your log, so removing the log removes the structure.
| Practices, assessments and uploads | Until you delete them, or until you delete your account. |
|---|---|
| Your account | Until you close it. An account with no activity for three years is deleted after we write to the address first. |
| Free quiz answers | Not kept at all, unless you are signed in and asked us to keep them. |
| Referral lists | Ninety days, then deleted. |
| Enquiries | Two years, so we can pick up a conversation you started. |
| Rate limiting records | Minutes. They are held in memory and disappear when the process restarts. |
| Records of payment | Eight years, because tax law requires it. Closing your account does not remove these, and we would be breaking the law if it did. They hold what was bought and when, not what you wrote. |
Your rights
Under the Digital Personal Data Protection Act you can ask us to do all of this, and we will not charge you for it.
Write to fyp@turtlelabs.co.in. We will answer within thirty days and usually much sooner.
- See what we hold about you, and get a copy of it.
- Correct anything wrong or incomplete.
- Delete it. Where you have a paid record we will tell you what deleting removes before we do it, and the record of the payment itself stays for as long as tax law says it must.
- Withdraw consent for anything based on consent, as easily as you gave it.
- Nominate somebody to exercise these rights if you die or become incapable.
- Complain, to us first and to the Data Protection Board of India if we do not resolve it.
Grievances
Our grievance officer is Aditya Bisen, reachable at fyp@turtlelabs.co.in.
We acknowledge within forty-eight hours and resolve within thirty days. If you are not satisfied, you may take it to the Data Protection Board of India.
Children
This programme has been run in schools since 2019, so under-eighteens using it is expected rather than accidental. That means the school or the parent arranges it and consents, not the child on their own.
Nobody under eighteen should create an account here by themselves. Where a school or a parent has arranged it, we do not show behavioural advertising to that account, we do not track it across other sites, and we hold nothing beyond what the exercise needs.
If you believe a child has created an account without that consent, write to us and we will delete it.
Security
No system is perfectly safe. If something happens that puts your information at risk we will tell you and the Board, promptly and in plain words.
- Sign-in links and session tokens are stored hashed, never in readable form, so a copy of the database does not hand anybody a working login.
- A sign-in link works once and expires in twenty minutes.
- Player accounts and staff accounts are kept in separate collections behind separate cookies, so a fault in the public sign-up cannot produce access to the content management system.
- Connections are encrypted in transit.
Cookies
A cookie to keep you signed in, if you sign in. A preference stored in your browser for light or dark. Nothing for advertising, and no third-party tracker.
Changes
If we change something that matters we will say so on this page and, where it affects what happens to your information, write to you. The date at the top is the last change.