Privacy policy

1. The short version

• We collect what we need to run accounts, sales and payouts.
• We do not sell your data or share it with advertisers.
• There are no third-party advertising or social trackers.
• Analytics are aggregated and cookieless; we cannot use them to identify you.
• You can export or delete your data from account settings at any time.

2. Who is responsible

Utenix Technologies Private Limited, which operates CramShare from 18, Ganesh Avenue, Porur, Chennai, Tamil Nadu 600116, India, is responsible for the personal data described here: the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and the controller under the GDPR for users in the EU and UK.

Privacy requests and complaints go to our Grievance Officer, [Name of Grievance Officer], at grievance@cramshare.com, or through contact.

3. What we collect

You give us:

• Account details — name, email, password hash.
• Institution and course details, if you add them to improve your search results.
• Documents you upload, including their metadata and any content inside them.
• Reviews, support messages and anything else you send us.

We generate:

• Purchase and payout records, which we are legally required to retain.
• Security logs — IP address, browser and timestamps for sign-in events and abuse prevention.
• Aggregated usage counts such as how often a document is opened. These are not linked back to individual accounts.
• Payout details, if you sell — a PayPal address, bank account or UPI ID, and the name on the account. Used only to pay you, never shown to buyers or other sellers, and shown back to you masked rather than in full.

We deliberately do not collect payment card details. Those are entered with our payment provider and never reach CramShare servers.

4. Why we process it, and our legal basis

• To provide the service — accounts, downloads, sales. Basis: performance of a contract.
• To pay sellers and meet tax obligations — payout and invoice records. Basis: contract and legal obligation.
• To keep the marketplace safe — fraud detection, review of uploads, abuse investigation. Basis: legitimate interests.
• To improve the product — aggregated, cookieless analytics. Basis: legitimate interests.
• To email you about your account — receipts, payout statements, security notices. Basis: contract. Marketing email is separate and opt-in only.

The bases named are the GDPR’s, for users in the EU and UK. Under India’s Act, we rely on the consent you give when you create an account, and on the legitimate uses the Act allows for data you give us for a stated purpose and for meeting a legal obligation.

5. How long we keep it

• Account data: until you delete your account.
• Documents you published: removed from sale immediately on unpublishing; deleted 90 days later.
• Purchase and payout records: eight years, because Indian company and tax law require it. This is the one category deleting your account does not clear.
• Security logs: 12 months.
• Support conversations: 24 months.

6. Who else processes it

We use a small number of processors, each under a data processing agreement and each limited to what they need:

• A cloud hosting and database provider, hosted in the EU.
• A payment provider, for card processing and payouts.
• An email provider, for transactional messages.

We do not share personal data with advertisers, data brokers or any third party for their own purposes. Your data is processed outside the country you live in, including in India, where we are. For users in the EU and UK, transfers out of those regions are covered by Standard Contractual Clauses.

7. Cookies

We set one essential cookie to keep you signed in, and one to remember your consent choices. Neither is used for tracking and neither requires consent under the ePrivacy Directive.

We do not use advertising, retargeting or social media cookies. If that ever changes, we will ask for consent before setting them, with refusing as easy as accepting.

8. Your rights

You can ask for a summary of the data we hold about you and who we have shared it with, have it corrected, completed or erased, and withdraw consent. You can also nominate someone to exercise these rights for you if you die or become unable to. In the EU and UK, the GDPR adds restriction, portability, and objecting to processing based on legitimate interests. Most of these are self-service in account settings; the rest we handle within 30 days.

If you are unhappy with how we have handled a request, tell the Grievance Officer first. If that does not resolve it, you can complain to the Data Protection Board of India or, in the EU and UK, to your national data protection authority.

9. Security

Data is encrypted in transit and at rest. Access to production data is restricted to staff who need it and is logged. Passwords are stored hashed and salted, never in a form we can read. If a breach affecting your data occurs, we will notify you and the relevant authority within the timeframes the law requires.

10. Changes

We will post changes here and, for anything material, email you at least 30 days before it takes effect. The date at the top of this page always reflects the current version.