Privacy policy

The company that runs sidenotes.in is Sidenotes India. Its office is at Mumbai, Maharashtra, 400062. The DPDP Act calls it the Data Fiduciary. This means the company decides why and how personal data on the site is used.

It covers anyone who visits the site, sends a form on it, or calls, writes to or messages Sidenotes. It does not cover the sites of universities or other sites that Sidenotes links to. Each of those has its own privacy policy.

Details a person shares

• Contact details: name, mobile number and email address, typed into a form such as Request a call.
• Course interest: the course and university the form was sent from, the page it was on, and the website the person came from.
• Calls and messages: what the person tells an adviser on a call, on WhatsApp or by email, such as their education, work experience, city and the courses they are looking at.

Details collected on their own

• Pages visited: the pages opened, the buttons clicked and the type of phone or computer used. Google Analytics, a tool that counts website visits, records these using small files called cookies.
• Searches: the words typed into the search box. Numbers and email addresses are removed before the words are stored, and the stored search does not show who typed it.
• Ad visits: when a person opens the site from an ad in ChatGPT, a number that marks which ad was clicked. When they send a form, a code made from their email address and mobile number. The OpenAI Pixel, a measuring tool, collects these (see section 8).

• To call back the person who sent a form, about the course they asked about.
• To answer questions about courses, fees, who can apply and admission.
• To help a student apply. Details stay with Sidenotes until the student applies, and then go to the university they applied to.
• To send course and admission updates by call, SMS, WhatsApp or email, until the person asks Sidenotes to stop.
• To see which ads bring people to the site and lead them to send a form.
• To see how the website is used and to improve its pages and search.
• To keep the website safe and stop misuse.
• To follow the law.

Sidenotes does not use personal data for any other purpose.

An adviser from Sidenotes calls back on the number given. Calls are made Monday to Saturday, 10 AM to 7 PM. The adviser answers questions and helps compare courses. The student then applies on the university’s own website.

Sending a form means the person agrees to be contacted about the course they asked about. Contact can be by call, SMS, WhatsApp or email.

A person can take back consent at any time by writing to customersupport@sidenotes.in. Sidenotes then stops all contact and deletes the data, unless the law says it must be kept. Contact made before that was allowed, because consent had been given.

Sidenotes does not sell or rent personal data. It shares data only with:

• Universities: the university a student applies to, once they apply. Until then, the details stay with Sidenotes.
• Service providers: companies that run parts of the service, such as website hosting, Google Analytics, and calls, SMS, email and WhatsApp. They may use the data only to provide that service.
• OpenAI, the company that runs ChatGPT: the number that marks the ad click, and the code made from the email address and mobile number on a sent form. OpenAI uses them to tell Sidenotes which ads led to a form (see section 8).
• Authorities: a court, regulator or police when the law requires it.
• A new owner: if the company is sold or joins another company, the data passes to the new owner, who must follow this policy.

A cookie is a small file a website saves in the browser. Sidenotes uses Google Analytics cookies to count visits and see which pages are read. Google handles this data under its own privacy policy.

OpenAI Pixel

Sidenotes runs ads in ChatGPT. To see which ads lead to a form being sent, the site carries the OpenAI Pixel, a measuring tool from OpenAI. It does three things:

• Ad click number: when a person opens the site from an ad in ChatGPT, the link carries a number that marks that one click. The Pixel keeps it in a cookie for 30 days.
• Browser number: the Pixel keeps a random number for the browser in a cookie for one year. The number holds no name, email address or mobile number.
• Coded contact details: when a form is sent, the Pixel turns the contact details typed into it, such as the email address and mobile number, into a code (a SHA-256 hash) inside the browser. Only the code goes to OpenAI. The details as typed are not sent.

OpenAI uses this to report ad results to Sidenotes. It handles the data under its own privacy policy.

Cookies can be blocked or deleted in the browser settings. The website still works without them.

• Call requests and notes from calls are kept for two years, then deleted.
• Searches are deleted after 180 days.

Data is deleted sooner when a person withdraws consent or asks for it to be deleted, unless the law says it must be kept.

Anyone whose data Sidenotes holds can ask to:

• See it: get a summary of the data, how it is used, and who it was shared with.
• Correct it: correct, complete or update it.
• Delete it: have it deleted, unless the law says it must be kept.
• Take back consent: at any time, as explained above.
• Complain: raise a complaint with the Grievance Officer (see section 15).
• Nominate: name another person to use these rights after their death, or if illness stops them from acting.

To ask, write to customersupport@sidenotes.in and give the mobile number used on the form. Sidenotes may check who is asking before it acts.

The DPDP Act also sets duties. A person sharing data must give true details and must not pretend to be someone else. They must not make a false complaint to Sidenotes or to the Data Protection Board of India.

The DPDP Act treats anyone under 18 as a child. A child’s data can be used only with the consent of a parent or lawful guardian. A student under 18 should send a form only with that consent, or ask the parent to send it. If Sidenotes finds a child’s details sent without consent, it deletes them.

The website uses HTTPS, which keeps data private while it travels to the site. Only the company’s own team and the companies that run parts of the service (see section 7) can use the data Sidenotes keeps. No website can promise complete safety. If personal data leaks (a data breach), Sidenotes tells the Data Protection Board of India and each person affected, as the DPDP Act requires.

Sidenotes links to the sites of universities and others. It does not run those sites or control how they use data. Each has its own privacy policy.

Questions or complaints about personal data go to the Grievance Officer, the person who handles complaints at Sidenotes:

Sidenotes replies within 90 days. A person who is not satisfied with the reply can then complain to the Data Protection Board of India.

Sidenotes may update this policy. The new version will be posted on this page, with a new date at the top.