CAMP by Consult-ify is a learning platform operated by Consult-ify Pvt. Ltd. from Kathmandu, Nepal. We run placement-focused courses, CAMP Innovation Labs and startup programs for colleges, schools and individuals.

This policy explains what we collect when you use https://camp.consult-ify.com, why we collect it, and what you can do about it. It covers the website and the account you hold with us. It does not cover other websites we link to.

If you have a question about anything here, write to [email protected] and a person will answer.

We collect only what the platform actually needs to work. In practice that falls into five groups.

Account details

Your first and last name, email address, and — if you choose to add them — phone number, gender and a profile picture. On verification we issue you a CAMP ID (for example CAMP-07) that identifies you across the platform.

Login credentials

A hashed password, or a Google account identifier if you sign in with Google. We never store your password in a readable form and we never receive your Google password.

Learning records

Courses you enrol in, your progress, wishlisted courses, membership tier and validity, gift purchases and claims, and certificates issued to you.

Payment records

The amount, currency, method and verification status of each payment, plus the reference Khalti returns. We do not store card numbers, wallet PINs or bank credentials — those are entered on Khalti and never reach our servers.

Content you post

Reviews and ratings you leave on courses, and anything you send us by email or the contact form.

We also log ordinary technical information — IP address, browser and device type, and timestamps — because our servers need it to answer requests, apply rate limits and investigate abuse.

We do not run advertising trackers, we do not build advertising profiles, and we do not sell personal data to anyone.

• To create and secure your account, verify your email with a one-time code, and let you sign back in.
• To enrol you in courses and events, track completion, and issue certificates.
• To take payment through Khalti and confirm that it succeeded.
• To send transactional email you asked for by using the service — verification codes, password resets, enrolment and review confirmations, certificate notices.
• To send in-app and push notifications about courses, events and community activity, where you have opted in on that device.
• To show your reviews next to the course or event they are about, with your name and profile picture.
• To answer your messages and provide support.
• To keep the platform working and safe — rate limiting, abuse investigation, backups and debugging.
• To meet legal, tax and accounting obligations in Nepal.

Where the law requires your consent — for example push notifications or optional marketing email — we ask first, and you can withdraw it at any time without losing access to anything you have paid for.

Course fees, gift purchases and membership payments are processed by Khalti. When you start a payment we hand Khalti the amount and an order reference, and you complete the payment on their page under their terms and privacy policy.

What comes back to us is a confirmation: the amount, the method, a payment reference and whether it succeeded. That record is attached to your enrolment so we can prove you paid and so you can see it in your profile. Card numbers, wallet PINs and banking credentials never touch our servers.

We use the minimum needed to keep you logged in and remember your preferences. There are no advertising or cross-site tracking cookies on CAMP.

token

A signed, HTTP-only session cookie set when you log in. It is what keeps you signed in, it cannot be read by JavaScript, and it expires after seven days.

camp-theme

Stored in your browser, not sent to us. Remembers whether you prefer the light or dark theme.

Payment intent

Held in session storage only while you are being redirected to and from Khalti, so we can show you the right confirmation. It is cleared as soon as the payment resolves.

Clearing your browser storage will log you out and reset your theme. Nothing else is affected.

We share personal data only with the service providers that make the platform run, and only with what each of them needs:

Khalti

Payment gateway for course, gift and membership payments. You enter your wallet, card or bank details on Khalti — they never reach CAMP.

Brevo

Sends our transactional email (verification codes, password resets, enrolment and review confirmations). Receives your name and email address.

Firebase Cloud Messaging (Google)

Delivers push notifications to devices you have opted in on. Receives a device token, not your identity.

Google Sign-In

Optional login. If you use it we receive your Google account name, email address and profile picture — nothing else, and never your Google password.

Amazon Web Services (S3, ap-south-1)

Stores uploaded images and documents, served from cdn.consult-ify.com. Hosted in Mumbai, India.

MongoDB

Our application database, holding your account, enrolment and content records.

Beyond those, we share data in three situations: with a partner college, school or organisation where you joined a CAMP program through them, and then only your participation and progress in that program; with our accountants and auditors where the law requires it; and with authorities where we are legally obliged to respond to a valid request.

We do not sell or rent personal data, and we do not share it for anyone else’s marketing.

Our database and file storage run on infrastructure hosted outside Nepal — file storage is in the Amazon Web Services Mumbai region. Our email and notification providers also process data outside Nepal.

Wherever it goes, the same protections in this policy apply, and we only use providers that commit to appropriate safeguards for the data they handle on our behalf.

• Account details: for as long as your account is open, and up to 90 days after you ask us to delete it, so the deletion can be completed across backups.
• Enrolment, payment and certificate records: retained after account closure where accounting, tax or certificate-verification law requires it — generally five years.
• Reviews: kept while the course or event is published. If you delete your review it is removed immediately.
• Notifications and email logs: up to 12 months.
• Technical logs: up to 12 months, then discarded or aggregated so they no longer identify you.

• Passwords are hashed, never stored in readable form, and never returned by our API.
• Sessions use HTTP-only, secure cookies that scripts on the page cannot read.
• Login, registration, password reset and verification endpoints are rate limited against brute force.
• Uploads go through short-lived signed URLs with enforced type and size limits, and assets can only be served from our own approved domains.
• Access to production data is limited to the people who need it to run the service.

No system is perfectly secure. If a breach ever affects your personal data, we will tell you and the relevant authority without undue delay, and we will tell you plainly what happened.

Nepal’s privacy law gives you real control over your personal data, and we honour the same rights for everyone regardless of where they live.

• See what we hold about you, and get a copy.
• Correct anything wrong — most of it you can edit yourself from your profile.
• Delete your account and the personal data attached to it, except records we are legally required to keep.
• Withdraw consent for notifications or optional email at any time.
• Object to a particular use, or ask us to restrict it while we look into your objection.
• Complain to the relevant data protection authority in Nepal if you think we have got it wrong.

To exercise any of these, email [email protected] from the address on your account. We respond within 30 days, and we do not charge for it.

CAMP runs programs in schools and with high-school students, so we work with minors by design and take it seriously.

If you are under 16, you need a parent or guardian to agree to these terms and to your account being created. Where a school or college enrols a group, we rely on that institution to obtain the necessary consent from parents or guardians before sharing student details with us.

A parent, guardian or school can ask us to see, correct or delete a student’s data at any time by writing to [email protected]. We do not use children’s data for marketing.

When we change how we handle personal data, we update this page and move the date at the top. If a change materially affects your rights, we will email account holders before it takes effect rather than leaving you to notice it.

Questions, requests or complaints about privacy go to [email protected], or by post to Consult-ify Pvt. Ltd., Kathmandu, Nepal. A person reads these — you will get a real answer, usually within two working days.