Privacy Policy

Last updated: 2026-03-19

Privacy Policy

Effective Date: March 19, 2026 Last Updated: March 19, 2026

Hey there. This is the Privacy Policy for 2BFT Academy (accessible at 2bft.in), operated by 2 Boys From Town ("2BFT," "we," "us," or "our"). We're Nav and Sujal — two 22-year-olds building an AI skills platform out of India. We care about your privacy, and we want to be upfront about what data we collect, why we collect it, and what we do with it.

This Privacy Policy applies to all services offered through 2bft.in, including the free Skill Library (746 AI skills), the paid Academy curriculum (monthly at ₹499/month and lifetime at ₹4,999), workshops (Visual Mastery at ₹399, Content Audit at ₹1,999), the Claude Code Setup service (₹9,999), and our physical Stashed tech bag. By using our website or services, you agree to the practices described in this policy.

We have drafted this policy to comply with India's Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian laws. If you're accessing our platform from outside India, please be aware that your data will be processed in accordance with Indian law.

1. Who We Are

2BFT Academy is a product of 2 Boys From Town, founded by Nav and Sujal. We are based in India. Our platform teaches AI skills through a free Skill Library and a premium Academy curriculum. We also offer Claude Code setup services for businesses.

Data Fiduciary (as defined under DPDPA): 2 Boys From Town Contact Email: [email protected] Website: 2bft.in

For any privacy-related questions, concerns, or requests, you can reach us at the email above. We aim to respond within 72 hours.

2. What Data We Collect

We collect only the data necessary to provide our services, improve your experience, and fulfil our legal obligations. Here is a breakdown of the categories of personal data we collect:

2.1 Information You Provide Directly

  • Account Information: When you sign up for 2BFT Academy, we collect your name, email address, and a password (or authentication token if you sign in via a third-party provider like Google).
  • Payment Information: When you subscribe to a premium plan (₹499/month or ₹4,999 lifetime), register for a workshop (₹399 Visual Mastery or ₹1,999 Content Audit), or purchase the Claude Code Setup service (₹9,999), we collect payment details. Your card number, UPI ID, or other payment instrument details are processed by our third-party payment processor and are not stored on our servers. We receive only a transaction reference, amount, and status.
  • Shipping Information: If you purchase the lifetime plan (which includes a Stashed tech bag), we collect your shipping address, phone number, and any delivery instructions necessary to ship your bag within India.
  • Communication Data: If you email us, use a contact form, or reach out on social media, we collect the content of your message along with your name and contact details.
  • Workshop Registration Data: Name, email address, WhatsApp number (optional), and any pre-workshop questions submitted when registering for the Visual Mastery (₹399) or Content Audit (₹1,999) workshops.
  • Service Request Data: If you purchase the Claude Code Setup service (₹9,999), we may collect information about your business environment, technical setup, and requirements necessary to perform the service.

2.2 Information Collected Automatically

  • Usage Data: We collect information about how you interact with our platform — pages visited, skills viewed, time spent on pages, clicks, and navigation patterns. This helps us understand which content is most useful and improve the platform.
  • Device and Browser Information: We collect your device type, operating system, browser type and version, screen resolution, and language preferences.
  • IP Address: Your IP address is collected for security purposes, approximate geolocation (country/region level), and analytics.
  • Cookies and Similar Technologies: We use cookies and similar tracking technologies as described in our Cookie Policy.

2.3 Information from Third-Party Services

  • Authentication Providers: If you sign in using Google or another third-party authentication provider, we receive your name, email address, and profile picture from that provider.
  • Payment Processors: Our payment processor shares transaction status, payment method type, and transaction identifiers with us. They do not share your full card number or banking credentials.

3. How We Use Your Data

We use your personal data for the following purposes, each of which has a lawful basis under the DPDPA:

3.1 To Provide Our Services

  • Creating and managing your account
  • Granting access to the free Skill Library (746 AI skills)
  • Managing your Academy subscription (₹499/month or ₹4,999 lifetime)
  • Processing payments for plans, workshops, the Claude Code Setup service, and physical products
  • Administering workshop registrations (Visual Mastery ₹399, Content Audit ₹1,999) and sending pre-workshop and post-workshop communications
  • Shipping the Stashed tech bag to lifetime plan subscribers
  • Delivering the Claude Code Setup service to business clients
  • Sending transactional emails (account confirmation, payment receipts, subscription updates, workshop confirmations, shipping notifications)

Lawful Basis: Performance of a contract / consent.

3.2 To Improve Our Platform

  • Analysing usage patterns to understand which AI skills are most popular
  • Identifying technical issues, bugs, and performance bottlenecks
  • Improving the curriculum and content based on engagement data
  • A/B testing new features and designs

Lawful Basis: Legitimate interest in improving our services.

3.3 To Communicate With You

  • Responding to your support requests and inquiries
  • Sending important service announcements (changes to terms, security alerts, maintenance windows)
  • Sending optional marketing communications about new skills, courses, or features (only with your explicit consent, and you can unsubscribe anytime)

Lawful Basis: Consent (for marketing); legitimate interest (for service communications).

3.4 To Ensure Security

  • Detecting and preventing fraud, abuse, and unauthorized access
  • Monitoring for suspicious activity on accounts
  • Enforcing our Terms of Service

Lawful Basis: Legitimate interest in maintaining security.

3.5 To Comply With Legal Obligations

  • Maintaining financial records as required by Indian tax law
  • Responding to lawful requests from government authorities
  • Complying with the DPDPA and other applicable regulations

Lawful Basis: Legal obligation.

4. Analytics and Third-Party Services

4.1 Firebase Analytics

We use Google Firebase Analytics to understand how users interact with our platform. Firebase collects usage data, device information, and certain identifiers to provide us with aggregated analytics reports. Firebase may use cookies or similar technologies to collect this information.

Firebase's data processing is governed by Google's Privacy Policy. Firebase Analytics data is used solely for our internal analytics purposes and is not used to build advertising profiles or sold to third parties.

4.2 Vercel Analytics

Our website is hosted on Vercel, and we use Vercel's built-in analytics to monitor website performance, page load times, and visitor metrics. Vercel Analytics is privacy-focused and collects aggregated, non-personally-identifiable data by default.

Vercel's data handling is governed by Vercel's Privacy Policy.

4.3 Payment Processor

We use a third-party payment processor to handle all financial transactions. Your payment information (card details, UPI credentials, net banking details) is collected and processed directly by the payment processor. We do not store, access, or have visibility into your full payment credentials.

The payment processor is PCI-DSS compliant and adheres to industry-standard security practices for handling financial data.

4.4 Shipping Partners

For lifetime plan subscribers who receive a Stashed tech bag, we share your name, shipping address, and phone number with our logistics/shipping partner to fulfil the delivery. The shipping partner uses this data solely for delivery purposes.

4.5 No Sale of Data

We do not sell, rent, or trade your personal data to any third party. Period. We do not share your data with advertisers. We do not monetize your data in any way beyond using it to provide and improve our own services.

5. Cookies

We use cookies and similar technologies on our platform. For full details about what cookies we use, why, and how to manage them, please refer to our Cookie Policy.

In summary: we use essential cookies (to keep the site working), functional cookies (to remember your preferences), and analytics cookies (Firebase and Vercel, to understand usage). We do not use advertising or tracking cookies.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Here are our specific retention periods:

| Data Type | Retention Period | |-----------|-----------------| | Account information (name, email) | As long as your account is active, plus 90 days after deletion request | | Payment transaction records | 7 years (as required by Indian tax/accounting regulations) | | Shipping address and phone number | 1 year after successful delivery of the Stashed bag | | Workshop registration data | 1 year after the workshop date | | Usage/analytics data | 26 months (Firebase default), then auto-deleted | | Support correspondence | 2 years from the date of last communication | | Claude Code Setup service data | 90 days after service completion, unless the client requests earlier deletion | | Marketing consent records | As long as consent is active, plus 1 year after withdrawal |

When data is no longer needed, we delete it or anonymize it so that it can no longer be associated with you.

7. Data Security

We take reasonable technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, or alteration. These measures include:

  • Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
  • Encryption at Rest: Sensitive data stored in our databases is encrypted at rest.
  • Access Controls: Only authorized team members (Nav and Sujal, and any authorized contractors) have access to personal data, and only to the extent necessary for their role.
  • Authentication Security: Passwords are hashed using industry-standard algorithms. We support and encourage the use of strong, unique passwords.
  • Infrastructure Security: Our hosting provider (Vercel) maintains SOC 2 compliance and implements physical and network security controls.
  • Regular Reviews: We periodically review our security practices and update them as needed.

While we do our best to protect your data, no system is 100% secure. If you believe your account has been compromised, please contact us immediately at [email protected].

8. Your Rights Under the DPDPA

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a "Data Principal":

8.1 Right to Access

You have the right to request a summary of your personal data that we hold, along with information about how it is being processed. We will provide this information in a clear, readable format.

8.2 Right to Correction

You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You can update most of your account information directly through your account settings. For other corrections, email us.

8.3 Right to Erasure

You have the right to request deletion of your personal data, subject to certain exceptions (such as data we are legally required to retain). Upon receiving a valid erasure request, we will delete your data within 30 days, except where retention is required by law.

8.4 Right to Grievance Redressal

If you are unsatisfied with how we handle your data or respond to your requests, you have the right to file a complaint. You can:

  1. Contact us first at [email protected] — we will try to resolve your concern within 15 days.
  2. If unresolved, you may escalate your complaint to the Data Protection Board of India as established under the DPDPA.

8.5 Right to Nominate

Under the DPDPA, you have the right to nominate another person to exercise your data rights in the event of your death or incapacity. To register a nominee, please email us with the nominee's details and your explicit authorization.

8.6 How to Exercise Your Rights

To exercise any of the above rights, send an email to [email protected] with the subject line "Data Rights Request". Include your registered email address and specify which right you wish to exercise. We will verify your identity before processing the request and respond within 30 days.

9. Children's Data

2BFT Academy is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under the age of 18 without verifiable parental or guardian consent, as required by the DPDPA.

If you are under 18 and wish to use our platform, your parent or legal guardian must create the account on your behalf and provide consent for the collection and processing of your data.

If we become aware that we have collected personal data from a child under 18 without appropriate consent, we will take steps to delete that data as soon as reasonably possible. If you believe a minor has provided us with personal data without consent, please contact us at [email protected].

10. International Users

2BFT Academy is based in India, and our servers and data processing infrastructure are located in India (and in jurisdictions where our hosting and analytics providers operate, such as the United States for Firebase/Google Cloud and Vercel).

If you access our platform from outside India, your data will be transferred to and processed in India and potentially other jurisdictions. By using our services, you consent to this transfer. We ensure that all data processing complies with the DPDPA regardless of where the data originates.

11. Third-Party Links

Our platform may contain links to third-party websites, tools, or resources (for example, links to AI tools, documentation, or external learning resources referenced in our skills content). We are not responsible for the privacy practices of these third-party sites. We encourage you to read the privacy policies of any third-party site you visit.

12. Data Breach Notification

In the event of a personal data breach that is likely to cause significant harm to you, we will:

  1. Notify the Data Protection Board of India as required under the DPDPA.
  2. Notify affected users via email within 72 hours of becoming aware of the breach.
  3. Provide details about the nature of the breach, the data affected, and the steps we are taking to mitigate the impact.
  4. Offer guidance on steps you can take to protect yourself.

13. Automated Decision-Making

We do not currently use automated decision-making or profiling that produces legal effects or similarly significant effects on you. If this changes in the future, we will update this policy and provide you with information about the logic involved, as well as the significance and expected consequences of such processing.

14. Data Processing for Services

14.1 Skill Library (Free)

To access the free Skill Library, you may browse without an account (in which case we collect only analytics data). If you create an account, we collect your name and email to personalize your experience and track your progress across the 746 available skills.

14.2 Academy Subscription (Premium)

When you subscribe to the Academy (₹499/month or ₹4,999 lifetime), we process your account information and payment data to manage your subscription. We track your progress through the Academy curriculum to provide a personalized learning experience.

14.3 Workshops

For our Visual Mastery Workshop (₹399) and Content Audit Workshop (₹1,999), we collect your name, email address, WhatsApp number (optional), and any questions or context you provide at registration. This data is used to confirm your seat, send pre-workshop materials, deliver the workshop session link, and follow up with post-workshop resources. Workshop registration data is retained for 1 year after the workshop date.

14.4 Stashed Tech Bag (Lifetime Plan Perk)

Lifetime plan subscribers receive a Stashed tech bag. To ship this physical product, we collect and process your shipping address and phone number. This data is shared with our shipping partner solely for delivery purposes.

14.5 Claude Code Setup Service

For businesses purchasing the Claude Code Setup service at ₹9,999, we may collect business contact information, technical environment details, and any data necessary to perform the setup. This data is used exclusively for service delivery and is deleted 90 days after service completion unless the client requests otherwise.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make changes:

  • We will update the "Last Updated" date at the top of this page.
  • For significant changes, we will notify you via email or through a prominent notice on our website.
  • Continued use of our platform after the changes take effect constitutes your acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically.

16. Consent Management

Under the DPDPA, we rely on your consent for certain data processing activities (such as marketing communications). You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To withdraw consent for marketing communications, click the "unsubscribe" link in any marketing email, or email us at [email protected].

To withdraw consent for other processing activities, contact us at the same email. Please note that withdrawing consent for essential processing (like account management) may require us to close your account.

17. Grievance Officer

In accordance with the DPDPA and the Information Technology Act, 2000, the details of our Grievance Officer are as follows:

Name: Nav (2 Boys From Town) Email: [email protected] Response Time: Within 15 days of receiving your complaint

If you have any grievance regarding the processing of your personal data, please contact the Grievance Officer. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

2 Boys From Town Email: [email protected] Website: 2bft.in

We will do our best to respond to your inquiry within 72 hours.

This Privacy Policy was last updated on March 19, 2026.

Questions about this policy?

Email us at [email protected] — we respond within 72 hours.