Privacy Policy | Eklavya

1. Who this policy covers

This policy applies to anyone who creates an account on Eklavya, whether you access it directly or through a school/institution that has adopted the underlying learning platform Eklavya is built on top of. If you are under 18, this policy is written for your parent or guardian to read together with you.

2. What we collect, and where it comes from

Every fact in your career profile is tagged with a source so its origin is never ambiguous:

Source tag	What it means	Examples
manual	You typed or selected it yourself	Age, education level, location, interests, skills, achievements, journal entries
llm_extracted	Our AI pulled it out of a conversation you had with it during onboarding	Academic records, interests, and skills mentioned in a chat
lms_sync	Derived automatically from your activity on the learning platform	Course completions, quiz scores, mock-interview performance
social	Inferred from your activity in Eklavya's community features	Group memberships based on declared interests

We also collect standard account information (name, email, login method) and, if you sign up with Google, the basic profile information Google shares with us during sign-in.

3. Age and parental consent (DPDP Act, 2023)

Before we build out anything beyond a bare account, we ask you to declare your age. If you are under 18:

We do not collect academic records, interests, skills, achievements, or journal entries until a parent or guardian has provided consent.
Consent is recorded against your account and can be withdrawn by contacting us (see Section 9).
Automatic syncing of your course activity into your career profile is also paused until consent is recorded.
We do not knowingly target advertising at children, and Eklavya carries no advertising today.

Where this is still a work in progress: our current consent mechanism records that consent was given, but does not yet independently verify that the person giving it is actually the account holder's parent or guardian (for example, via a confirmation link emailed to the parent). Treat this section as describing our intent and design direction, not a completed, audited compliance guarantee.

4. How we use your data

To build and continuously update your career profile and completeness score.
To run our matching engine and surface scholarships, colleges, internships, and jobs relevant to you.
To power the conversational onboarding assistant and other AI features you choose to use.
To operate community features (interest groups, posts) you choose to participate in.
To maintain platform security and prevent abuse (for example, rate-limiting how often any one account can call our AI features).

We do not sell your personal data. We do not use your journal entries or AI conversation transcripts for anything other than building your own profile — they are not shared with other users, teachers, or administrators under any circumstance, including platform administrators.

5. AI features and conversation data

When you use Eklavya's conversational onboarding, your messages are sent to a third-party AI provider (OpenAI or Anthropic, depending on configuration) to extract structured profile information. We instruct the AI to treat your messages strictly as information to extract from, never as instructions to follow, as a safeguard against manipulation of the assistant.

Raw conversation transcripts are retained for a limited period (currently 30 days) after which they are automatically deleted — only the structured facts extracted from them (tagged llm_extracted) remain in your profile after that.

If your institution has not yet provided AI access, or you've used your monthly allowance, you may be asked to provide your own API key for a third-party AI provider to continue using AI features. Keys you provide are encrypted before storage and are never visible to teachers, administrators, or other students.

6. Who can see your data

You can see everything in your own profile at all times.
Nobody else — including platform administrators — can see your journal entries or AI conversation transcripts, without exception.
Your recommended opportunities and match scores are visible only to you.
If you post in a community group, that post is visible to other members of that group (or, for ungrouped posts, to other Eklavya users).
If you're affiliated with a school through the underlying learning platform, that school's administrators can see your enrollment and academic activity within their own school's courses — but not your Eklavya career profile, journal, or AI conversations.

7. Data retention and deletion

We keep your profile data for as long as your account is active. Raw AI conversation transcripts are deleted automatically after 30 days.

Students can delete their account themselves from the Account tab in the app. This permanently removes your login and everything linked to it — profile, career records, journal, progress, and messages you sent — and cannot be undone. Teacher and administrator accounts own shared content (courses, exams, audit history) and are deleted by the platform administrator on request instead. Some records may be kept where the law requires it.

8. Security

Data is stored using row-level access controls so that, even at the database layer, most tables can only be read by their owning user. Sensitive credentials (encryption keys, institutional AI provider keys) are never hardcoded in our code or written to logs.

9. Service providers and where your data is stored

Eklavya relies on the following third parties to operate. Each processes data on our behalf only as needed to provide the service:

Provider	What it does for Eklavya
Supabase	Hosts the database and handles sign-in. Your account, profile, and all stored records live here (Asia-Pacific region).
Render	Runs Eklavya's application server (Singapore region). Requests pass through it to reach the database.
Google	Signs you in ("Continue with Google"). We receive your name, email address, and profile picture as Google provides them.
OpenAI or Anthropic	Processes messages you send to AI features so they can respond, as described in Section 5.

This means your data is processed outside India. We do not sell it to any of these providers or anyone else.

10. Your rights and how to reach us

You (or, for a minor, their parent/guardian) can:

Get a copy of your data — use Download my data in the Account tab.
Delete your account — use the Account tab (students), as described in Section 7.
Correct your data — edit or remove any profile entry directly in the app.
Withdraw parental consent, ask a question, or raise a complaint — email privacy@shoonyaorigins.com. This is also our point of contact for grievances, and we will respond within a reasonable time.

11. Changes to this policy

We'll update the "Last updated" date at the top of this page whenever this policy changes, and, for material changes, make a reasonable effort to notify active users directly.