Privacy notice · Unscripted

In short

We collect only what our forms ask for, and only to deliver what you asked for.
We ask for your consent on every form. The box is never ticked for you, and marketing emails are a separate, optional choice.
Your data is stored on servers in India, seen only by the people who handle your request, and never sold.
You can see, correct or delete your data, or withdraw consent, at any time, as easily as you gave it.

Who we are

Unscripted is a women-led leadership and learning studio founded by Shilpi Khanna. For your personal data, Unscripted is the Data Fiduciary: we decide why and how it is used, and we are responsible for it. Contact us about anything in this notice at hello@leadunscripted.com, with “Privacy” in the subject line.

What we collect, why, and for how long

When	What we collect	Why	How long we keep it
Registering for a programme or free session	Name, email, phone or WhatsApp (optional), city, how you heard about us, and your answers about your business, career or interview	To review your registration or application, choose who gets free places, send joining details, run the session and follow up on it	24 months from the date you send it
Asking a question	Name, email, topic and your message	To reply to you	24 months from the date you send it
Requesting a Training Cost Audit or pulse survey review	Name, work email, organisation, role, team size and what you tell us about your training, budget or survey	To contact you and prepare the audit or review	24 months from the date you send it
Joining a live session	Your name and email as shown in the video call, your attendance, and anything you share in the chat or exercises	To run the session and send you the follow-up materials	24 months after the session
Feedback and questionnaires	Your answers	To measure what changed and improve our training. We report results only in groups, never by name	Named answers 24 months; anonymous summaries kept
Paying for a programme	Name, billing details and payment record. Card and bank details go to the payment provider or bank, never to us	To take payment, issue invoices and meet tax law	As long as tax law requires, currently up to 8 years
Marketing emails, only if you tick the optional box	Name and email	To tell you about future sessions	Until you unsubscribe or withdraw consent
Privacy requests	Name, email and your request	To act on it and keep a record that we did	3 years after we close the request

We do not ask for, and you should not send us, sensitive details such as health information, government ID numbers, passwords or card numbers. On the pulse survey page, please do not paste your survey data into the form: we send a secure link after an NDA.

When a retention period ends, we delete your data or make it fully anonymous.

The legal basis we rely on

Your consent, which you give by ticking the box on each form (Section 6 of the Act). Your consent covers only the purpose written next to the box. We also process data where the law allows without consent: for example, to keep invoices for tax law, or to respond to a lawful request from a court or authority (Section 7).

Withdrawing consent

You can withdraw consent at any time, as easily as you gave it: use the privacy request form below, or email us. Once you withdraw, we stop using your data for that purpose and delete it, except anything we must keep by law. Withdrawing does not affect what we did lawfully before. If you withdraw while registered for a session, we may not be able to keep your place.

Who can see your data

Only the Unscripted team members who handle your request, and the facilitator of a session you join, who receives your name and email for that session under a duty of confidentiality. We never sell your data, and we never share it for anyone else’s marketing.

We use these service providers (Data Processors), who act only on our instructions and under their own security commitments:

Supabase: our database. Form entries are stored in its Mumbai, India region.
Zoho Mail: our email.
Google Meet: our online sessions. If you message us on WhatsApp, Meta processes that message.
GitHub Pages: hosts this website. Like any web host, it records the IP addresses of visitors in its server logs.
Google Fonts and jsDelivr: serve the fonts and code this website uses, so they receive your IP address when a page loads.
A payment provider or bank, for paid programmes.

Some of these providers may process data outside India. The Act allows this except to countries the Government of India restricts, and we will stop any transfer to a restricted country.

Your rights

Under the Act you have the right to:

Access: a summary of the data we hold about you, what we do with it, and who we have shared it with.
Correction, completion, updating and erasure of your data.
Withdraw consent at any time.
Grievance redressal: a reply from us to any complaint.
Nominate someone to exercise your rights if you die or cannot act yourself.

We reply within 30 days, and always within the 90 days the Rules allow. If you are not satisfied with our reply, you can complain to the Data Protection Board of India. You can also ask for this notice in English or any language listed in the Eighth Schedule to the Constitution of India.

Children

Our sessions and forms are for adults aged 18 and over, and each form asks you to confirm your age. We do not knowingly collect data about children. If we learn that we have, we will delete it.

Security and data breaches

Form entries go to our database over an encrypted connection. Only signed-in team members can read them, and the public can only add an entry, never read one. We give access only to the people who need it. If a breach affects your data, we will tell you and the Data Protection Board of India without delay, as the Rules require, with what happened and what you can do.

Photos, recordings and testimonials

We do not record sessions without telling everyone at the start and giving a way to opt out. We publish a photo, quote or story only with your written permission, and you can ask us to remove it at any time.

When we handle data for a company

When an organisation shares its employees’ data with us, for example for a pulse survey or a team programme, that organisation is the Data Fiduciary and we act as its Data Processor under a written contract. We use the data only on its instructions, report pulse results only for groups of five or more, and delete the data when the work ends.

Cookies and browser storage

We use no advertising, analytics or tracking cookies. If you are a team member who signs in to the admin page, your browser stores a sign-in token so you stay signed in.

Changes to this notice

If we change this notice, we will update the version and date at the top of this page. If a change affects how we use data you have already given us, we will ask for your consent again.

Make a privacy request

Use this form to see, correct or delete your data, withdraw consent, stop marketing emails, nominate someone, or make a complaint. You can also email hello@leadunscripted.com with “Privacy” in the subject line.