Privacy notice

Effective date: 25 October 2026. In short: no accounts, no cookies for visitors, no advertising and no tracking. The site counts visits only as anonymous totals, your lesson progress stays in your browser, and if you email us we use your email only to reply.

This notice follows India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025.

Who is responsible for your data

This site, Open CAD Academy (opencadacademy.com, with its courses such as Sheet Metal with SolidCraft), is run by Ahmad Khan, an individual in India, under the name Open CAD Academy. Under the DPDP Act the Data Fiduciary is Open CAD Academy (Ahmad Khan): the person who decides why and how personal data is processed here.

What we process and why

1. Visit counts (not personal data)

• What: when a page opens, or when you finish a lesson's checks, the site adds one to a total for that day, page, event (page view or finished sheet), referring website's name (for example www.google.com, never the full address), country (as our host reports it) and device type (phone, tablet or desktop).
• Not kept: no IP address, no cookie, no user-agent string, no device identifier, no name or email. To tell the device type and to skip crawlers, the counter looks at your browser's user-agent string for that moment, then discards it.
• Why: to see which lessons help and where learners stop.
• Only totals are kept and nothing in them can identify you, so these counts are not personal data.
• If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

2. Lesson progress (only in your browser)

Ticked steps, values that passed a check, quiz answers, finished sheets and which part (A to H) each sheet gave you are saved in your browser's local storage, under one name (sheet-course-v2). They are never sent to us or anyone else. The numbers you type into the checks are compared inside your browser. To remove your progress, clear this site's data in your browser.

3. Emails you send us

• What: your email address, your name if you give it, and what you write.
• Why: only to reply to you and deal with your question, correction, request or grievance. Nothing else: no newsletter, no marketing, no sharing.
• Basis: you give this data voluntarily for that purpose, a legitimate use under section 7(a) of the DPDP Act. You can tell us at any time to stop using it, and we will delete it.
• How long: no longer than 12 months after the conversation ends, then deleted.
• Where: mail to the contact address is passed on by Cloudflare (our host) to a Gmail mailbox, so Cloudflare handles it in transit and Google stores it for us.

4. Hosting by Cloudflare

The site is hosted on Cloudflare (Cloudflare Workers), and the visit counts are kept in Cloudflare's database. Like any web host, Cloudflare receives every request your browser makes to this site, including your IP address and browser details, to deliver the pages and to protect the site from attacks. Cloudflare acts as our processor. We have not turned on any Cloudflare feature that stores request logs or visitor analytics for us, and we never see visitors' IP addresses. Cloudflare runs servers worldwide, so these requests may be processed outside India.

5. YouTube videos (only if you click play)

A video (on a lesson or the install page) shows a picture and a play button. Nothing is loaded from YouTube until you click play. When you click, your browser loads YouTube's privacy-enhanced player (youtube-nocookie.com), and YouTube (Google) receives your IP address and browser details under its own privacy policy. The lessons work without the videos.

Cookies and storage

The site sets no cookies for visitors. Fonts and the 3D viewer's code are served from this site itself, so opening a page contacts no one but our host. The only cookie on the site is a sign-in cookie for the owner's private statistics page, set only after the owner enters the owner key.

Who else receives data

• Cloudflare, our host and processor, as described above.
• Google, which runs the contact mailbox, for emails you send us.
• YouTube, only if you click play on a video.

No one else. We do not sell personal data, and we do not share it with advertisers, data brokers or anyone for marketing.

Where your data is processed

Cloudflare and Google run servers in many countries, so your requests and emails may be processed outside India. Section 16 of the DPDP Act allows this unless the Government of India restricts transfers to a country; we will follow any such restriction.

How long we keep it

• Visit counts: anonymous totals, kept while they are useful for improving the course.
• Lesson progress: in your browser, until you clear it.
• Emails: up to 12 months after the conversation ends, then deleted.

Security

The site is served only over HTTPS. The statistics page is locked to the owner by a secret key and a signed, HttpOnly cookie. The accounts that run the site and the contact mailbox are protected by strong passwords and two-step verification, and only the owner has access. If a personal data breach ever affects you, we will tell you and the Data Protection Board of India, as the DPDP Rules require.

Your rights

Under the DPDP Act you have the right to:

• Access (section 11): a summary of the personal data we process about you, what we do with it, and who else has received it.
• Correction, completion, updating and erasure (section 12) of your personal data.
• Grievance redressal (section 13): an answer from us to any grievance about how we handle your data.
• Nominate (section 14) someone to use these rights for you if you die or become unable to.
• Stop us using the email you sent, at any time.

The visit counts hold nothing that identifies you, so there is nothing in them we could find, show or delete for you. Your lesson progress is only in your browser, where you can delete it yourself.

How to use your rights

Email contact@opencadacademy.com, ideally from the address you wrote to us from, saying what you would like. We may ask you to confirm that the data is yours. It costs nothing. We acknowledge your email within 7 days and aim to resolve it within 30 days; in any case within 90 days, the longest period the DPDP Rules allow for a grievance.

This notice is in English. If you would like it in another language listed in the Eighth Schedule to the Constitution of India, email us.

Complaints to the Data Protection Board of India

If you are not satisfied with our answer to a grievance, you can complain to the Data Protection Board of India. The DPDP Act (section 13(3)) asks you to contact us first, as described above.

Children

The site does not knowingly collect personal data from children (under 18). It has no accounts, no tracking, no behavioural monitoring and no targeted advertising, for anyone. If you are under 18, please ask a parent or guardian to email us for you or with you. If we learn that we hold a child's email without a parent's or guardian's consent, we will ask for it, and delete the email if we don't get it.

Changes to this notice

If this notice changes, the new version is published on this page with a new effective date.

Effective date: 25 October 2026.