Privacy Policy

• Who we are
• What we collect
• How we use it
• Consent
• Your research data
• Our software
• Who we share it with
• Where it is stored
• Cookies
• How long we keep it
• Security
• Your rights
• Children
• Grievance Officer
• Governing law
• Changes

1. Who we are

PlantNura Consulting & Solutions LLP ("PlantNura", "we", "us") is a limited liability partnership registered in India, with its office at Mahaveer Gateway, 12th Floor, Office 5, Gachibowli, Hyderabad, Telangana 500032. We provide training in plant breeding, genomics and data science, software for plant scientists, and consultancy. For your personal data we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and the "controller" under the GDPR if you are in the European Economic Area or the United Kingdom.

This policy covers plantnura.com and every service we provide through it: enquiries, courses, the Internship Academy, consultancy and, when they open, our software applications. It is written to meet the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which apply today, and the DPDP Act and the Digital Personal Data Protection Rules, 2025, which replace them in May 2027. Questions about this policy go to our Grievance Officer (section 14) or to pnura@plantnura.com.

2. What we collect

Everything in this section is data you give us yourself, except the two technical items at the end. Each form on the site asks only for what the next step needs. Where a field is optional, it says so.

During a programme. Your attendance, the exercises and the capstone you submit, your questions, and your name as you want it on your certificate. If a live session is recorded for the participants, we say so at the start of the session and share the recording only with that cohort. For the Internship Academy we also keep the work you deliver, because your certificate and recommendation letter are written from it.

"Notify me" requests. When you ask to be told when a software application launches, the request opens your own email app with your name and email address, and arrives with us as an ordinary email.

When you simply browse. Our hosting provider, Hostinger, keeps standard server logs of each request: the IP address, the page, the time, and the browser and device type. We use them only to keep the site running and secure, and never to identify a visitor. Our fonts are served by Fontshare, so when a page loads your browser requests the font files from Fontshare’s servers, which see your IP address.

What we do not collect. We do not ask for, and ask you not to send us, government identity numbers, passwords, financial account details, or health or other sensitive personal information. If you send such information in a message, we delete it. We do not profile visitors, and no decision about you is made by automated means alone.

3. How we use it

We use your personal data for these purposes, and no others:

• To reply to your enquiry and arrange a strategy call.
• To register you for a course or internship track; to send you the joining details, materials, schedule and reminders; and to issue your certificate and, for interns, your recommendation letter.
• To take payment through Razorpay, issue invoices and keep the accounts and tax records Indian law requires.
• To carry out the analysis or consultancy engagement you have commissioned, and to support it afterwards.
• To tell you when a software application launches, if you asked us to.
• To keep the site and our services secure, prevent spam and fraud, and resolve disputes.
• To meet a legal obligation, or a lawful request from a court or authority.

Course news by email. We send news about new courses, tools or editions only to people who have asked for it. Every such email has an unsubscribe link, and one message to pnura@plantnura.com stops them. Emails that are part of a programme you have joined (joining details, schedule changes, your certificate) are not marketing and continue until the programme ends.

Testimonials. We publish a participant’s or client’s words, name or photograph only with their written permission, which can be withdrawn at any time.

Legal basis. Under Indian law, we process your data on the basis of the consent you give when you submit a form or share data for a stated purpose, and, where the DPDP Act allows it, for the "legitimate uses" of data you have given us voluntarily for that purpose and of meeting our legal obligations. If you are in the EEA or the UK, our bases are: performance of a contract with you (enrolment, consultancy, software), our legal obligations (accounting and tax), our legitimate interests (answering enquiries, keeping the site secure, keeping records of what we delivered), and your consent (course news, testimonials). We never sell personal data, and we never share it for advertising.

4. Consent and withdrawal

When you submit a form on this site you consent to the processing described next to it and in this policy, for that purpose. You can withdraw your consent at any time by writing to pnura@plantnura.com. Withdrawing is as easy as giving it: one email, no form, no reason needed. We will stop the processing that depended on the consent, and delete the data unless a law requires us to keep it (for example, invoice records). Withdrawal does not affect processing that happened before it, and it may mean we can no longer provide the service the data was for. Where a consent manager registered under the DPDP Rules becomes available for this kind of service, you will be able to manage your consent through it as well.

5. Your research data

Data you share with us for a consultancy engagement remains yours. We act as your processor: we use it solely to produce the deliverables agreed with you, and on your instructions. In particular:

• It is treated as confidential. Access is limited to the people on our team who work on your engagement.
• It is transferred and stored through encrypted channels, in a shared workspace restricted to named people, or by a method you choose.
• It is never reused for another client, never used for our own research or publications, and never used to train any model.
• It is never put into a third-party AI service, such as ChatGPT, Claude or Gemini. All analysis is done with our own tools and code, on systems under our control.
• We publish nothing from it, and claim no authorship or acknowledgement, unless you agree in writing.
• At the end of the engagement we delete it within 90 days of the final deliverable, or at once if you ask. We keep only the deliverables themselves, as the record of the work.
• Where you or your institution require it, we sign a non-disclosure agreement or a data-processing agreement before any data is shared, and we follow your institution’s data policy where it is stricter than this one.

If your dataset contains personal data about other people (for example, farmer names in a survey), please remove or code it before sharing. Where that is not possible, tell us, and we will agree in writing how it is to be handled.

6. Our software applications

DataViz Pro is open in early access; KropAnalytix and BreedPilot are not yet open to the public. The same principles apply to all three: the files you upload are used only to produce your results; they are not shared with other users, not used for our own research, and not used to train models. To run your account and plan we keep your name, email address, organisation, your plan and invoice records, and sign-in and session times, with standard server logs for security. Each application shows its own data notice when you sign up.

DataViz Pro in detail. DataViz Pro runs on Amazon Web Services in Mumbai, India (region ap-south-1). Sign-in is handled by Amazon Cognito, which stores your email address and a protected form of your password; we never see your password. Every session runs in its own private workspace: the files you upload exist only inside it, and when you sign out or the session ends, the workspace is removed together with your files. The workspace has no access to the internet or to our cloud credentials, so nothing inside it can be sent anywhere else. Your files are never sent to an AI service or any third party. To run your plan we keep, in the same Mumbai region, your email address, your plan and its end date, and a usage record of when you opened and closed the application and on which plan (for example, to count Big Data hours), kept for 12 months. Technical logs record sign-in and session times and errors, never the contents of your files, and are kept for up to 30 days. Access to the servers is limited to PlantNura’s administrator, requires multi-factor sign-in, and every administrative session is recorded and kept for 90 days. Sales and invoice records (payment reference, plan, amount, invoice number and email address) are kept in our Google Workspace account.

AskNura, the optional assistant in DataViz Pro. DataViz Pro includes AskNura, an assistant that can set up plots, prepare data and explain results. It is off until you turn it on, and you can turn it off at any time in the app. When it is on, the following is sent over an encrypted connection to Anthropic PBC (United States), the provider of the Claude AI models, only to generate AskNura’s answers:

• your messages to AskNura;
• the module and settings you have open;
• your data’s column names and summary figures (counts, ranges, averages, missing values, and the most frequent values in a column, such as genotype names);
• an image of a plot, only when you attach it or ask about it.

Your files and data rows are never sent. Anthropic processes this information as our service provider under its commercial terms. It does not use it to train its models, and deletes it within 30 days, unless it is flagged under Anthropic’s usage policy or must be kept by law (up to 2 years). Your AskNura conversation is kept in DataViz Pro only for your session. We keep:

• a record of when you turned AskNura on or off, and which version of this notice applied, while your account is open;
• a usage record (date, plan, AI model, amount of text processed and cost; no email address and no text) for 12 months.

Both are stored in Mumbai under a coded form of your account. If names in your data are confidential, give lines, markers and samples coded names before you upload.

7. Who we share it with

We share personal data only with the providers below, each of which processes it to deliver one part of our service and under its own privacy policy, and with our accountants and legal advisers when needed, and with authorities when the law requires it. No one else.

• Razorpay (Razorpay Software Pvt. Ltd., Bengaluru), a payment aggregator regulated by the Reserve Bank of India — payments for courses, internships and DataViz Pro plans, in India and abroad.
• Google Workspace (Sheets, Drive, Gmail, Calendar and Meet) — enquiry, enrolment and application records, sales and invoice records for our software plans, our email, strategy-call bookings, live sessions, and delivery of consultancy outputs. The form on this site sends your entry to a Google Apps Script that writes it to our private spreadsheet and emails our team.
• Hostinger — hosting of this website and its server logs.
• Fontshare (Indian Type Foundry) — the web fonts served to your browser when a page loads.
• YouTube (Google) — product and course videos, in privacy-enhanced mode, which load only after you choose to play a video. Our films on YouTube open in a new tab on youtube.com.
• WhatsApp (Meta) — only if you choose to contact us on WhatsApp through the link on the site. WhatsApp’s own terms apply to that conversation.
• LinkedIn — The Crop Science Brief is a LinkedIn newsletter. Subscribing happens on LinkedIn, under LinkedIn’s terms; we do not receive subscribers’ email addresses.
• Amazon Web Services — hosting of DataViz Pro in Mumbai, India: sign-in (Amazon Cognito), the application itself, plan records and technical logs.
• Anthropic (Anthropic PBC, San Francisco, USA) — only if you turn on AskNura in DataViz Pro, to generate AskNura’s answers from the information described in section 6.

8. Where it is stored

We are based in India, and your data is handled by our team in India. Our providers store data in their own data centres: Razorpay in India; Amazon Web Services in Mumbai, India, for DataViz Pro; Anthropic in the United States, for AskNura, only when you turn it on; Google Workspace, Hostinger and Fontshare in data centres that may be in India or in other countries. The DPDP Act allows personal data to be transferred outside India except to countries the Central Government restricts by notification; we do not transfer data to any restricted country.

If you are outside India, the personal data you send us is processed in India. For participants in the EEA or the UK: India has not been granted an adequacy decision, so we transfer and process your data because it is necessary for the contract you asked for (an enrolment or an engagement) or, for an enquiry or course news, on the basis of your explicit consent, with the protections described in this policy. You can ask us for a copy of what we hold and for its deletion at any time.

9. Cookies and your browser

This website sets no cookies and stores nothing in your browser: no analytics, no advertising or tracking tools, no social-media pixels. Your light or dark theme is not saved. Two things run only when you choose them: the Razorpay checkout, which opens when you pay and may set Razorpay’s own cookies to complete the payment securely, and YouTube players, which load in privacy-enhanced mode after you press play. If we ever add an analytics tool, we will update this section first, and no analytics cookie will be set without your agreement.

10. How long we keep it

We keep personal data only as long as the purpose needs it, or as long as Indian law requires. In practice:

Data	Kept for
Enquiries and strategy-call requests	24 months after our last exchange, then deleted. Earlier on request.
Enrolment, invoice and payment records	Up to 8 years after the financial year of the payment, as required by the Limited Liability Partnership Act, the Income-tax Act and GST law. Only what the invoice needs is kept that long.
The rest of an enrolment or application (R and statistics level, what you would like to work on, how you heard about us)	24 months after the programme ends.
Applications not accepted or withdrawn	12 months, so we can answer you if you apply again.
Certificate register (name, programme, date)	Kept so a certificate can be verified, unless you ask us to remove your entry.
Client research data	Deleted within 90 days of the final deliverable, or at once on request (section 5).
"Notify me" requests	Until the application launches and we have written to you, or until you ask us to stop.
Email correspondence	While we work with you and for up to 3 years after, unless it supports a record kept longer.
Server logs	Kept by Hostinger for a limited period for security and troubleshooting.
DataViz Pro: files you upload	Only during your session. Deleted with your workspace when you sign out or the session ends.
DataViz Pro: account and plan (email address, plan, end date)	While your account is open. Deleted within 30 days when you ask us to close it, except invoice records (above).
DataViz Pro: usage record (when you opened and closed the application, and on which plan)	12 months.
DataViz Pro: technical logs	30 days.
DataViz Pro: AskNura conversation	Only during your session. At Anthropic, deleted within 30 days (up to 2 years if flagged under its usage policy or required by law).
DataViz Pro: AskNura on/off record	While your account is open.
DataViz Pro: AskNura usage record (date, plan, model, amount processed, cost; no text)	12 months.
Recordings of administrative access to our servers	90 days.

When a retention period ends, we delete the data, or make it anonymous so that it no longer identifies you, and we ask our providers to do the same.

11. How we protect it

• Every page and every form on this site is served over HTTPS, and form entries travel encrypted to our records.
• Payment details never pass through our site or our records. Razorpay is PCI-DSS certified and regulated by the Reserve Bank of India, and our payment keys are kept outside the website, on the server side only.
• Our records live in a Google Workspace account protected by two-step verification, and are shared only with named members of the team who need them for their work.
• Client research data is exchanged through encrypted channels and access-controlled workspaces, never by open links.
• In DataViz Pro, every session runs in its own isolated workspace on encrypted disks, with no internet access, and your files are deleted when the session ends. Server access is limited to our administrator with multi-factor sign-in, and every administrative session is recorded.
• Everyone on the team who handles personal or client data is bound by confidentiality.
• We keep what we hold to the minimum, and we review this policy and our practices at least once a year.

If something goes wrong. If a breach of personal data ever occurs, we will tell each person affected without delay, by the email address we have for them, describing what happened, what it may mean for them, what we have done and what they can do, with a contact for questions. We will notify the Data Protection Board of India and any other authority as the law requires.

12. Your rights

You can, at any time:

• See what personal data we hold about you, what we do with it, and whom we have shared it with.
• Correct, complete or update it.
• Delete it, except what the law requires us to keep.
• Withdraw consent (section 4), and stop any course news.
• Nominate a person who can exercise these rights for you if you die or are unable to.
• Complain, first to our Grievance Officer and then to the Data Protection Board of India (section 14).

If you are in the EEA or the UK, you also have the rights to restrict or object to processing, to data portability, and to complain to your national data protection authority (in the UK, the Information Commissioner’s Office).

To use any of these rights, write to pnura@plantnura.com from the email address we have for you, or to the postal address in section 1. We may ask you to confirm your identity before we act, so that we do not give your data to someone else. We acknowledge every request within 48 hours and complete it within 30 days; if a request is complex we tell you why and when. There is no charge. If we cannot do what you ask, for example because a law requires us to keep an invoice, we tell you the reason.

13. Children

Our courses, internships and services are for adults. We do not knowingly collect personal data from anyone under 18, and by enrolling or applying you confirm that you are 18 or older. If we ever open a programme to younger participants, we will obtain verifiable consent from a parent or guardian first, as the DPDP Act requires. If you believe a person under 18 has given us personal data without that consent, write to the Grievance Officer and we will delete it.

14. Grievance Officer

In line with the Information Technology Act, 2000 and the rules under it, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, we have appointed a Grievance Officer. Any concern about this policy, about your data or about a service you have bought from us goes here first:

If you are not satisfied with our answer, or do not receive one within 30 days, you may complain to the Data Protection Board of India under the DPDP Act, or, if you are in the EEA or the UK, to your national data protection authority. You can also contact the Board directly, but it may ask whether you have raised the matter with us first.

15. Governing law

This policy is governed by the laws of India. Any dispute about it is subject to the courts at Hyderabad, Telangana, without prejudice to the rights that the DPDP Act, the GDPR or your local consumer law give you and that cannot be excluded.

16. Changes to this policy

If we change how we handle data, we update this page and the date at the top. If a change matters to you, for example a new provider or a new purpose, we email everyone enrolled or in an engagement with us before it takes effect, and where consent is needed we ask for it afresh. Earlier versions are available on request.