OneSkill Privacy Policy

Last updated: 19 October 2026. This Policy stays in force until replaced by an updated version.

This Privacy Policy explains how OneSkill Education Pvt. Ltd. and OneSkill Capital Edfintech Pvt. Ltd. collect, use, share and protect your personal data, and the choices you have. It applies to our website, mobile application, courses, certifications, career services, research services (including stock screeners, the Oneace.ai AI chatbot and algo services), taxation services and any onboarding or KYC process run by us.

1. Who we are

• Education (courses and learning platform): OneSkill Education Pvt. Ltd. — support@oneskilledu.com
• Research services: Capital Markets by OneSkill, owned and operated by OneSkill Education Pvt. Ltd., SEBI Registered Research Analyst, Registration No. INH000030773 — support@oneskillcapital.com. Principal Officer: Mandeep Singh Chhabra.
• Taxation services: OneSkill Capital Edfintech Pvt. Ltd., available to all users — support@oneskillcapital.com
• Distribution services (Authorised Person): OneSkill Capital Edfintech Pvt. Ltd. — support@oneskillcapital.com
• Address: 521 Kanwali Road, Near Balliwala Chowk, Dehradun 248001, Uttarakhand, India
• Phone: +91-7668953001

Each company is a separate Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data it collects. In this Policy, "OneSkill", "we", "us" and "our" mean the company whose service you use, as shown to you at sign-up and onboarding.

Our services. OneSkill Education Pvt. Ltd. provides education (courses, certifications, career counselling, jobs and apprenticeship opportunities for alumni, franchise partnerships and a refer-and-earn programme) and research services as a SEBI Registered Research Analyst under the brand Capital Markets by OneSkill, which it owns and operates (buy and sell research recommendations for different financial instruments, stock screeners, the Oneace.ai financial AI chatbot, algo services, and Free, Pro and Elite subscriptions). OneSkill Capital Edfintech Pvt. Ltd. provides taxation services and works as an Authorised Person (AP) for the distribution of financial products (SEBI-regulated products such as stocks, ETFs, bonds, mutual funds, SIFs, AIFs and PMS, and non-SEBI products such as loans, insurance and travel). Taxation services are open to everyone including research clients. Education and free content are open to everyone.

Your data stays separate. Each company uses your data only for the service you chose with it. We share your data between the two companies only if you ask for a service from both, and then only what is needed for it, or where the law or a regulator requires. Your research records are never used to sell you another product.

2. Your consent

By creating an account, submitting your details, completing KYC or continuing to use our services, you agree to this Policy. Where the law requires specific consent (for example for KYC, marketing messages or optional features), we ask for it separately, in clear language, before we collect or use the data. You can withdraw consent at any time as described in Section 12; withdrawal does not affect processing already done, and we may still keep data that the law requires us to keep.

3. Information we collect

We collect only what we need for the services you use.

• Account data: name, email address, mobile number, password (stored in hashed form).
• Google sign-in data: if you choose "Continue with Google", Google shares your name, email address and profile picture with us, along with a Google account identifier. We request only these basic profile scopes (openid, email, profile) and use them solely to create or sign you in to your OneSkill account and to link it to an existing account with the same verified email. We do not sell this data, use it for advertising, or share it with anyone except as described in Section 6. We do not receive your Google password. Our use of information received from Google APIs follows the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. You can disconnect Google at any time from your account page (https://oneskillcapital.com/account) or by removing OneSkill in your Google Account settings, and ask us to delete your data as described in Section 12.
• Profile and learning data: display name, courses and certifications, lessons completed, quiz scores, alumni status and similar activity.
• Career data (if you use job or apprenticeship services): resume or CV, qualifications, skills, work history, job preferences, applications and placement status.
• Counselling records: your goals, questions and the notes from career counselling sessions.
• Referral and partner data: your referral code, the people who joined through it, rewards earned and payout details (bank or UPI); for franchise partners, business details, KYC and agreements. If you refer someone, you must have their permission to share their contact details with us.
• Client onboarding data (research services): PAN, date of birth, address, occupation, income range, investment experience and risk-profile answers, nominee details where applicable, signed client agreement and records of the research you receive.
• KYC data: see Section 4.
• Distribution data: details of the products you apply for or hold through us (for example mutual fund, demat, loan, insurance or travel applications), nominee details, and transaction records shared with the regulated intermediary or product provider.
• Subscription and payment data: your plan (Free, Pro or Elite), billing dates, transaction ID, amount and payment status. Card and UPI credentials are handled by our payment partner; we do not store full card numbers or UPI PINs.
• Research and tool usage: reports and recommendations viewed or downloaded, watchlists, saved screens and screener filters, and alert preferences.
• AI chatbot data: your questions to the Oneace.ai chatbot, its replies, feedback you give and related technical data.
• Algo and broker data: if you connect a broker account or use algo services, your broker name, client ID, API keys and access tokens (stored encrypted), strategies you publish or buy, strategy settings, orders, positions, holdings and trade logs. We do not hold your funds or securities.
• Communication records: emails, chats, WhatsApp or SMS messages, and call recordings or notes with our team, kept for service, quality and regulatory record-keeping.
• Device and log data: IP address, device and browser type, operating system, pages visited, referring URL, crash reports and approximate location derived from IP.
• Cookies and similar technologies: see Section 9.

If you use taxation services from OneSkill Capital Edfintech Pvt. Ltd., we also collect the details you give us for them, such as PAN, income details and tax documents, used only to provide that service.

4. KYC and identity verification

If you take up a research, advisory or distribution service, or any service for which law requires us to know our client, we verify your identity and address.

• Documents and data we may ask for: PAN (and PAN–Aadhaar link status), proof of address, a photograph or selfie, signature, bank account details for verification, and, where you choose Aadhaar-based verification, the information returned by the verification service.
• Aadhaar: we use Aadhaar only if you consent and only through UIDAI-permitted routes, such as offline e-KYC, DigiLocker or an authorised e-KYC provider. We do not collect or store your full Aadhaar number unless the law specifically permits it. Where it is not required to keep it, we hold only a masked number (last four digits), a reference token and the verification result. We never use Aadhaar for any purpose other than the verification you consented to.
• Verification partners: your KYC details may be checked with or through SEBI-registered KYC Registration Agencies (KRAs), the Central KYC Records Registry (CKYCR), the Income Tax Department's PAN verification service, DigiLocker, banks or payment processors for account verification, and our contracted KYC, e-sign and liveness-check providers. These providers act on our instructions and are bound by confidentiality and security obligations.
• Why it is mandatory: KYC is required under SEBI regulations and the Prevention of Money Laundering Act, 2002 and its Rules. If you do not provide it, we cannot onboard you for the regulated service, and no such service is provided until all KYC and other required compliance steps are completed. You can still use our free educational content.

Users outside India (global KYC). If you are located outside India, we may verify you with internationally accepted documents and checks: a passport or national ID card, proof of address (such as a utility bill or bank statement), a photograph or liveness check, your tax identification number and country of tax residence, and, where required, details of your source of funds. We may screen your details against sanctions, politically-exposed-person (PEP) and adverse-media lists, and use identity-verification providers in India or other countries for this. We do this to meet Indian law and the rules of the places where we serve you, and to prevent fraud and money laundering. Face or other biometric checks are used only to verify your identity and only with your explicit consent; we keep the verification result and a reference, not your biometric template.

5. How we use your data

• To create and manage your account, deliver courses, certifications and counselling, and process enrolments, subscriptions and payments.
• To connect alumni with jobs and apprenticeship opportunities, when you opt in.
• To onboard you as a research client, verify your identity, assess suitability and deliver research recommendations, alerts, screeners and subscription features.
• To run the Oneace.ai chatbot, answer your questions and keep it safe, accurate and improving.
• To provide algo services and connect to your broker account only as you instruct.
• To run our referral and franchise programmes, calculate and pay rewards, and prevent misuse.
• To comply with law: SEBI (Research Analysts) Regulations, KYC and anti-money-laundering rules, tax and audit requirements, and orders of courts or regulators.
• To send service messages such as OTPs, receipts, onboarding and compliance notices.
• To send course updates and promotional messages, only where you have agreed (Section 8).
• To detect and prevent fraud, misuse and security incidents, and to improve and secure our platform.
• To handle your requests, complaints and grievances.

We do not use your data for any other purpose without fresh consent, and we do not sell your personal data.

6. Who we share it with

• Regulators and authorities: SEBI, BSE Administration & Supervision Ltd. (BASL) or any other recognised body, FIU-IND, tax authorities, law-enforcement agencies and courts, when required by law, for inspection, audit or complaint handling.
• KYC and verification partners: KRAs, CKYCR, DigiLocker, UIDAI-permitted verification services, and our KYC, e-sign and liveness-check providers (Section 4).
• Service providers: cloud hosting, payment gateways, SMS, WhatsApp and email delivery, analytics, customer-support tools and auditors, under written agreements that limit use of your data to our instructions.
• AI service providers: companies that supply the AI models behind Oneace.ai process your chats only to provide the service, under written terms.
• Your broker: when you connect a broker account for algo services, we exchange data with it as needed to run the services you set up.
• Intermediaries and product providers: for distribution services, the SEBI-registered broker, depository, mutual fund house, AIF or PMS manager, lender, insurer or travel partner whose product you choose, only as needed to process your application.
• Employers and apprenticeship partners: only your profile or CV, and only when you apply or opt in.
• Franchise partners: limited learner details needed to deliver an education course at a training centre, under a data-protection agreement. Franchise partners are not given your research, KYC or client-onboarding data.
• Referrals: the person who referred you may see that you joined through their code; you are never shown another person's contact data.
• Professional advisers: legal, compliance and audit advisers, under confidentiality.
• Business transfer: a successor entity, in a merger or restructuring, which will be bound by this Policy.

We share only the data needed for the purpose. Where a provider processes data outside India, we do so only where the law allows and with appropriate safeguards.

7. Where your data is stored

Your data is stored on secure servers located in India and other countries, through global cloud infrastructure. We serve users in India and around the world. If you are outside India, your data will be transferred to and processed in India, and may also be processed in other countries where our service providers operate. We transfer data across borders only where the law allows, and we use safeguards such as contractual protections and security controls. KYC and client records are kept in access-controlled systems.

8. Research, advisories and marketing

Research recommendations and service communications are sent to clients as part of the regulated service. Promotional messages about courses or offers are sent only if you have opted in, through SMS, WhatsApp, email or calls, in line with applicable telecom rules. You can opt out at any time using the link in the message, by replying STOP, or by writing to the contact for the service you use (Section 17). Opting out of marketing does not stop messages we are legally required to send you.

Subscriptions. Your Free, Pro or Elite plan decides which content and tools you can use. We record your plan and usage to provide it and to bill you.

AI chatbot (Oneace.ai). Oneace.ai is a finance assistant offered under Capital Markets by OneSkill, the research brand of OneSkill Education Pvt. Ltd. (SEBI Registered Research Analyst, Registration No. INH000030773). Investments in the securities market are subject to market risks. Read all related documents carefully before investing. We process your chats to answer you, keep the service safe and improve it. Please do not type sensitive details such as passwords, OTPs, card numbers or full ID numbers. Our staff may review chats for quality and compliance, and we keep them as records where the law requires.

Algo services. If you use algo services offered under Capital Markets by OneSkill, you may publish your own strategy, connect your broker account to automate trades, or buy and follow strategies published by others. We collect and use the strategy details you publish, your settings and subscriptions, and, if you connect a broker through its API, the data described in Section 3, only for the purposes you set. You can disconnect at any time from the app or from your broker account, after which we stop accessing it. Access keys and tokens are stored in encrypted form. If you publish a strategy, its name, description and the performance figures you choose to show may be visible to other users; we do not show your identity, broker details, balances or other personal data unless you choose to.

Business partners (white-label and private-label). OneSkill licenses its algo software to other fintech companies. If you use another company's product that runs on our technology, that company decides why and how your data is collected and is responsible for it, and its own privacy policy applies. We handle that data only on that company's instructions under an agreement, and we do not use it for our own marketing.

Distribution services (Authorised Person). OneSkill Capital Edfintech Pvt. Ltd. distributes financial products as an Authorised Person. Under SEBI rules, we cannot charge a client for both research and distribution, directly or indirectly. Free users can invest in SEBI-regulated products through our AP service until they buy a paid research subscription. Once they do, this option is disabled permanently, even if the subscription later ends. They can then connect their own broker account to our research and algo tools, and we do not charge any direct or indirect commission on it. To apply this rule, the two companies may check, between themselves, only whether you hold a paid research subscription or a distribution account. Non-SEBI products (loans, insurance and travel) and taxation services are not affected.

9. Cookies and similar technologies

We use essential cookies to keep you signed in and secure the site, and analytics cookies to understand how the site is used. You can block non-essential cookies in your browser; blocking essential cookies may stop you from logging in.

10. How long we keep your data

We keep personal data only for as long as needed for the purpose it was collected, and then delete or anonymise it. Some records must be kept longer by law. KYC records, client agreements, risk profiles, research and advice records and related communications are kept for the period required by the SEBI (Research Analysts) Regulations, the Prevention of Money Laundering Act and other applicable laws (currently not less than five years, and longer if a law, inquiry or dispute requires). If you ask us to delete your data, we will delete what we are allowed to delete and tell you what we must retain and why.

11. Security

We protect personal data with encryption in transit, hashed credentials, role-based access, activity logging, regular security reviews and staff confidentiality obligations. No online system is completely secure. If a personal-data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

12. Your rights

You may, by writing to our Grievance Officer:

• ask for a summary of the personal data we hold about you and who we have shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, subject to the retention duties in Section 10;
• withdraw your consent at any time;
• nominate another person to exercise these rights on your behalf if you die or become unable to act;
• raise a grievance about how we handle your data.

We may verify your identity before acting on a request, and we respond within the time the law allows.

If you are outside India. Depending on where you live (for example the European Economic Area, the United Kingdom or other places with data-protection laws), you may have additional rights, such as to object to or restrict processing, to receive your data in a portable format, and to complain to your local data-protection authority. Where those laws apply to us, we process your data on lawful grounds such as your consent, our contract with you, our legal obligations and our legitimate interests (for example fraud prevention). To exercise these rights, write to the Grievance Officer in Section 14.

13. Children

Our education content and courses can be used by anyone, of any age. Our research, taxation and algo services are only for adults aged 18 and above.

If you are under 18, a parent or legal guardian must register you or give consent before we collect your personal data, and we may ask to verify this. For children, we collect only the data needed for the course, we do not track or monitor behaviour for advertising, we do not send targeted advertising or marketing, and we do not process data in a way that could harm a child's well-being. A parent or guardian can ask to see, correct or delete a child's data by writing to the Grievance Officer in Section 14. If you believe a child's data has reached us without proper consent, write to us and we will delete it.

14. Grievance Officer and complaints

• OneSkill Education Pvt. Ltd. (education and research services): Mandeep Singh Chhabra, Principal Officer and Grievance Officer — mandeepchhabra.ra@gmail.com · +91-7668953001
• OneSkill Capital Edfintech Pvt. Ltd. (taxation and distribution services): Jivesh Kumar Ghai, Grievance Officer — support@oneskillcapital.com
• Address: 521 Kanwali Road, Near Balliwala Chowk, Dehradun 248001
• Hours: 10:00 AM to 6:00 PM IST (Indian time), on working days

We acknowledge every complaint within 48 hours and aim to resolve it within 7 working days. If you are not satisfied, you may:

• complain about our investment-related services to SEBI through the SCORES portal (https://scores.sebi.gov.in), or use the Online Dispute Resolution platform (https://smartodr.in);
• complain about data handling to the Data Protection Board of India, once you have used our grievance process, as the law provides.

15. Links to other sites

Our site may link to other websites or services (for example, KRAs, DigiLocker or payment pages). They have their own privacy policies, and we are not responsible for them.

16. Changes to this Policy

We may update this Policy to reflect changes in law or our services. We will post the new version here with a revised "Last updated" date and, for material changes, notify you by email or in the app. Please review it periodically.

17. Contact us

OneSkill Education Pvt. Ltd. (education: support@oneskilledu.com; research and financial services under Capital Markets by OneSkill: support@oneskillcapital.com) and OneSkill Capital Edfintech Pvt. Ltd. (taxation and distribution services: support@oneskillcapital.com), 521 Kanwali Road, Near Balliwala Chowk, Dehradun 248001, India · +91-7668953001

Registration granted by SEBI and certification from NISM in no way guarantee the performance of the intermediary or provide any assurance of returns to investors. Investments in the securities market are subject to market risks. Read all related documents carefully before investing.