Privacy notice

Smriti AI Labs (“we”, “us”) operates this website. This notice explains what personal information the website collects, why, and who can see it.

It covers the public website, the enquiry form, certificate verification pages and the private founder portal used by our founders and administrators.

When you submit the enquiry form, we store:

• your name;
• your work email address;
• your organisation;
• the business area you selected;
• your description of the project or question; and
• the time you acknowledged this privacy notice.

We also record the page of this website from which the enquiry was sent. We use this information to read, reply to and follow up on your enquiry. Founders and authorised administrators can see it in the founder portal, where they may also record the enquiry’s status and internal notes.

Please do not include confidential information, documents or sensitive personal information in the form.

We have not yet set a fixed period for keeping enquiries. You can ask us to delete yours at any time (see “Your requests”).

Retention period for enquiries to be decided during legal review.

To limit repeated or automated requests, the website derives a pseudonymous identifier from your network (IP) address using a keyed hash — a one-way calculation with a secret key that we hold. The address itself is not stored.

The identifier is stored with your enquiry and in short-lived rate-limit counters, which are deleted by routine clean-up. The same technique limits repeated attempts at founder sign-in (including emailed sign-in links) and password resets, and repeated views of certificate verification pages and certificate downloads.

The public website does not use analytics or advertising cookies, and it does not load scripts, fonts or images from third-party services. You do not need to accept any cookie to use it.

The founder portal uses one essential cookie. It is set only when an authorised founder or administrator signs in, keeps them signed in, and cannot be read by scripts on the page. Sessions expire automatically, and we store only a one-way hash of the session token.

Each internship certificate has its own verification page, reached through the certificate’s unique link or QR code. For an issued certificate, the page shows:

• the recipient’s name;
• their role and internship track;
• the internship dates and the issue date;
• the certificate number; and
• the certificate’s status — issued, revoked, or superseded by a corrected certificate.

Email addresses, phone numbers, notes, documents and evaluations are never shown. A certificate that has not been issued shows no personal details. There is no public list or search of certificates, and verification pages are excluded from search-engine indexing.

Certificate documents (PDFs) are private by default. A certificate’s document can be downloaded from its verification page only where we have explicitly approved public download for that certificate.

Each view of a verification page, and each certificate download, adds to a short-lived rate-limit counter keyed by the pseudonymous identifier described under “Preventing abuse”. This limits repeated or automated lookups; your IP address itself is not stored.

For people who carry out internships with us, founders and authorised administrators keep the records needed to administer internships and certificates: name, contact details, institution where provided, internship details such as role, track, dates and status, internal notes, and certificate records.

When a certificate is issued, a fixed copy of the details it certifies is stored, so later edits to a profile or template never alter an issued credential. Corrections are made by issuing a replacement that records which certificate it replaces. We keep these records for as long as they are needed to administer certificates and keep verification accurate.

Founders and administrators who use the portal have an account with an email address, a display name and a role. Sign-in is handled through Supabase Authentication, which also sends their invitation and password-reset emails.

Administrative actions are recorded in an activity log — who acted, what changed and when. The log cannot be edited or erased through ordinary operations, and it does not record private contact details.

We use two service providers to run the website:

• Cloudflare — hosts the website and stores files such as certificate documents and portfolio images.
• Supabase — provides the database and the authentication service used for founder sign-in.

They process information on our behalf to run the website. We do not sell personal information or share it for advertising.

Enquiries, intern records and certificate administration are available only to signed-in founders and authorised administrators, and access is checked on the server for every request.

Files such as certificate documents are kept in private storage and served only through authorised routes, apart from certificate documents approved for public download. Images published with a portfolio project are public.

You can ask us what personal information we hold about you, and ask us to correct or delete it.

Some records may need to be kept — for example, an issued certificate record, so that its verification page stays accurate, and the activity log. If that applies to your request, we will explain why.

We will update this notice when the website changes. The date at the top of the page shows when it was last updated.