Privacy Policy

1. Who we are

Eduvy ("Eduvy", "we", "us", "our") is a multi-tenant Software-as-a-Service customer-relationship-management (CRM) platform for Indian college admissions. Eduvy is operated from India; you can reach us at infoeduvy@gmail.com and at https://eduvycrm.com.

Eduvy provides colleges and educational institutions ("Colleges") with tools to engage prospective students ("Leads") through AI-assisted and human voice calls, WhatsApp and SMS messaging, lead management, and counsellor workflows. The Eduvy Counsellor mobile application is a tool for a College's authorised counselling staff ("Counsellors") to work the leads assigned to them.

This Policy explains what personal data we handle, why, on whose behalf, and the rights available to you. It is published in compliance with India's Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000 and rules made thereunder, and is aligned with the disclosure requirements of the Google Play Store and the Apple App Store.

2. Our role: Data Fiduciary vs Data Processor

Under the DPDPA, responsibility for personal data depends on who decides the purpose of processing. For the Eduvy platform this split is important:

• Lead / prospective-student data is controlled by the College. The College is the Data Fiduciary (controller) for the personal data of its leads. Eduvy acts only as a Data Processor, handling that data on the College's documented instructions to deliver the service. Each College is responsible for having a lawful basis (including consent and DLT/telecom permissions) to contact its leads.
• Counsellor / platform-user account data is controlled by Eduvy and the College jointly. Counsellor accounts are created and managed by the College's administrator, not self-registered. Eduvy acts as a Data Fiduciary for the limited account and device data needed to operate the app securely.

If you are a lead and wish to exercise your rights, the College that contacted you is your primary point of contact; we will support and route such requests to that College. See Section 13.

3. Information we collect

3.1 Counsellor / platform-user data

When a College's administrator provisions a Counsellor account, and as the Counsellor uses the app, we process: name, work email, phone number (including the mobile number an administrator registers so the platform can ring the Counsellor for "ring-my-phone" calling), role and permissions, the College (tenant) you belong to, login credentials (stored only as a salted hash), authentication and device-refresh tokens, availability status, and your activity within the app (leads worked, notes, call outcomes, assistant queries).

3.2 Lead / prospective-student data (processed on the College's behalf)

On behalf of Colleges we process information about prospective students, which may include: name; phone number; email; program/course of interest; intended intake; current qualification and marks; location; budget signals; lead source (for example Meta lead ads, CollegeDunia, or manual upload); consent and Do-Not-Disturb (DND) status; lead score and score history; and the full interaction timeline (calls, messages, notes, and outcomes).

3.3 Call transcripts & conversation data

Calls are transcribed in real time to create a written record of the conversation. We process that transcript, the structured fields extracted from it, the detected language, and sentiment/quality signals. We do not store an audio recording of the call — only the transcript and the data derived from it, which are treated as sensitive personal data and are protected and retained under a defined retention policy.

3.4 Messaging data

For WhatsApp and SMS, we process message content, timestamps, delivery status, opt-in / opt-out status, and the message template used, in order to send and receive follow-ups within the permitted messaging window. Call and messaging context for the same lead may be combined so a later conversation can reference earlier ones.

3.5 Device & technical data

From the mobile app and web portal we collect: device model and OS version, app version, a push-notification token (to send you in-app notifications), IP address, network type, and crash, diagnostic, security, and audit logs. The app does not read your phone's call log or contacts, and does not record calls on your device.

3.6 Facebook / Meta Lead Ads data

A College may connect its own Facebook Page to Eduvy (Settings → Meta Lead Ads → "Connect with Facebook"). When a prospective student then submits that College's Facebook or Instagram Lead Ad form, we receive the personal data that student submitted — typically their full name, phone number, and email address — from Meta / Facebook. We receive it through Meta's Lead Ads leadgen webhook and the Facebook Graph API (GET /{leadgen_id}?fields=field_data,created_time), using a Page access token the College's administrator authorises during the Facebook connect. We use this data solely for that connecting College's own admissions follow-up (call, WhatsApp and SMS), store it in the College's tenant-isolated workspace, and never share it with other Colleges, sell it, or use it for advertising or to train advertising models. The College is the Data Fiduciary for this lead data and Eduvy processes it on the College's behalf. A College can pause or disconnect a Page at any time from the same screen to stop receiving further leads. See Section 14 for how this data is deleted.

4. App permissions

The Eduvy Counsellor app requests only the permissions its features need:

The app does not request access to your call log, phone state, SMS, contacts, location, or photos. It does not contain advertising and does not use advertising identifiers.

5. How we use information

• Place and route calls. Outbound AI-assisted calls and inbound calls; routing an inbound lead callback to an available Counsellor; and the Counsellor mobile calling modes — a normal phone call, an in-app VoIP call, or a "ring-my-phone" two-leg bridge where the platform calls the Counsellor's registered mobile and then connects the lead over the telephony trunk.
• Answer questions accurately. The AI voice and chat agents answer admission questions only from facts a College has reviewed and approved in its knowledge base, and hand off to a human Counsellor when there is no approved answer or the matter needs a person.
• Manage leads. De-duplicate, attribute to a source, score and prioritise leads, schedule follow-ups, and record outcomes on the lead timeline.
• Messaging. Send and receive WhatsApp and SMS follow-ups within permitted windows and only where opt-in applies.
• Operate & secure the service. Authenticate users, enforce per-College data isolation, prevent abuse, debug, and maintain audit and compliance records.
• Comply with law. Maintain consent, DND, AI-disclosure, and telecom (DLT) records as required.

We do not sell personal data, and we do not use lead transcripts or conversation data for advertising or for training third-party advertising models.

6. Legal basis & consent

We process personal data on the following bases under the DPDPA:

• Consent — for contacting leads and sending promotional messages. For lead data, the College is responsible for obtaining and evidencing this consent; Eduvy records consent events captured during calls.
• Performance of the service / legitimate uses — to operate Counsellor accounts and deliver the contracted service to Colleges.
• Legal obligation — to retain consent, telecom, and audit records as required by law.

Where processing is based on consent, the data principal may withdraw consent at any time (see Section 13); withdrawal does not affect processing already carried out lawfully.

7. Calls, transcription & telecom compliance

• AI disclosure. Automated (AI) outbound calls begin with a clear disclosure that the caller is an AI assistant calling on behalf of the named College, state the purpose, and capture the recipient's consent before proceeding.
• Transcription, not recording. We transcribe calls in real time to create a written record; we do not retain an audio recording of the call. The transcript and the data derived from it are personal data, protected and retained as described in Section 11.
• DND & calling hours. For automated outbound campaigns, numbers are screened against Do-Not-Disturb / NDNC registries before dialling, and calls respect TRAI calling-hour windows. Each College operates under its own DLT (telecom) registration as the principal entity; Eduvy operates as the platform / registered telemarketer.
• Counsellor-initiated calls. When a Counsellor manually dials their own assigned lead from within the app, that is a person-to-person call placed by the Counsellor; the College remains responsible for its lawful basis to contact that lead.

8. Children's data

Some prospective students may be under 18. The DPDPA treats anyone under 18 as a child and requires verifiable parental/guardian consent, and prohibits tracking, behavioural monitoring, and targeted advertising directed at children. Eduvy does not knowingly use children's data for advertising or profiling beyond what is necessary to respond to an admission enquiry. Colleges are responsible for obtaining verifiable parental consent where a lead is a child and for instructing Eduvy accordingly. If you believe a child's data has been processed without appropriate consent, contact our Grievance Officer (Section 17) and we will act with the relevant College to address it.

9. Sharing & service providers (sub-processors)

We share personal data only as needed to run the service. We do not sell or rent personal data. Recipients are:

• The College you interact with (the Data Fiduciary for lead data).
• Service providers (sub-processors), each bound by contract to protect the data and process it only on our instructions:

  Provider	Role
  Supabase	Managed PostgreSQL database, authentication, and file storage (call transcripts and uploaded prospectuses).
  LiveKit	Real-time voice infrastructure and SIP connectivity that runs the live call.
  Plivo	Cloud telephony — SIP trunking and the phone numbers (caller IDs) used for outbound and inbound calls — and WhatsApp Business messaging, SMS, and DLT (telecom) compliance.
  Sarvam AI	Speech-to-text and text-to-speech for Indian languages and Hinglish.
  Google (Gemini)	The large-language model that powers grounded conversation.
  Expo	Delivery of push notifications to the mobile app.

• Authorities, where required by law, regulation, or valid legal process; and a successor entity in the event of a merger or acquisition, subject to this Policy.

10. International transfers

Personal data is hosted on cloud infrastructure and is primarily processed in India. Certain processing — in particular AI speech and language processing by the providers listed above — may take place on servers located outside India. Where data is processed outside India, we rely on providers that offer appropriate contractual and security safeguards, consistent with the DPDPA and applicable rules.

11. Data retention

We retain personal data only as long as necessary for the purposes above or as required by law:

• Lead data & interaction timeline — for as long as the College maintains its account, or until the College instructs deletion, subject to legal retention requirements.
• Call transcripts & extracted conversation data — kept as part of the lead's interaction timeline and anonymised under the College's retention policy when no longer needed, or sooner once the College instructs deletion, unless a longer period is legally required.
• Counsellor account data — kept for the life of the account and deleted or anonymised within 30 days after offboarding.
• Consent, DND & audit records — retained for as long as required to demonstrate telecom and data-protection compliance.

12. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including: strict per-College data isolation enforced at the database layer (PostgreSQL row-level security); encryption of data in transit and at rest; credentials stored only as salted hashes; role-based, least-privilege access; and audit logging. No method of transmission or storage is completely secure; we work to protect your data and will notify affected parties and the Data Protection Board of India of a personal-data breach as required by law.

13. Your rights

Subject to the DPDPA, you have the right to:

• access a summary of the personal data we process about you and how;
• correct, complete, or update inaccurate or incomplete data;
• request erasure of your data where it is no longer needed;
• withdraw consent previously given;
• nominate another person to exercise your rights in case of death or incapacity;
• grievance redressal (see Section 17).

Leads: because the College is the Data Fiduciary for your data, please raise requests with the College that contacted you; you may also contact us at infoeduvy@gmail.com and we will route your request. Counsellors: contact your College administrator or our Grievance Officer. If you are not satisfied, you may complain to the Data Protection Board of India.

14. Account & data deletion

Counsellor accounts are provisioned and managed by your College's administrator — the app does not offer self-service account creation. To delete or deactivate a Counsellor account and its associated personal data, the College administrator can do so from the Eduvy admin portal, or you may request deletion by emailing infoeduvy@gmail.com from your registered email. We will verify and action such requests within 30 days, subject to legal retention obligations, and confirm once complete.

Lead data deletion: as lead data belongs to the College (Data Fiduciary), deletion is initiated by the College. On the College's instruction, or on a verified data-principal request routed to us, we delete or anonymise that data from our systems, subject to legal retention requirements.

Facebook / Meta Lead Ads data: personal data we received from Meta / Facebook Lead Ads (a lead's name, phone and email, and the College→Page connection token) is deleted or anonymised together with the College's lead data on the same basis described above. A College can stop all further collection immediately by disconnecting its Facebook Page in Settings → Meta Lead Ads, which removes the stored Page connection and access token. To request deletion of Facebook-derived data specifically, email infoeduvy@gmail.com with the subject line "Facebook data deletion" and the lead's phone number or email; we verify and action it within 30 days, subject to legal retention obligations, and confirm once complete.

To request deletion online, email infoeduvy@gmail.com with the subject line "Data deletion request". A standalone summary of how to request deletion is also published at https://platform.eduvycrm.com/data-deletion.html.

15. Cookies & web portal

The Eduvy web admin portal uses strictly necessary cookies / local storage for authentication and session management only. It does not use third-party advertising or cross-site tracking cookies. The mobile app does not use advertising identifiers.

16. Changes to this policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, provide a more prominent notice. Continued use of the service after an update constitutes acceptance of the revised Policy.

17. Grievance Officer & contact

In accordance with the DPDPA and the Information Technology Act, 2000, you can reach our Grievance Officer / Data Protection contact:

• Attention: The Grievance Officer, Eduvy
• Email: infoeduvy@gmail.com
• Response time: we aim to acknowledge within 72 hours and resolve within the statutory timeframe.

General contact: infoeduvy@gmail.com · Website: https://eduvycrm.com