Privacy Policy

This Privacy Policy explains how SASTAVA Growth System Private Limited ("SASTAVA", "we", "us") collects, uses, stores and protects personal data in connection with EdukshaIQ (the "Platform"), a student-potential and career-guidance system provided to schools and educational institutions. We are committed to handling personal data, and in particular the data of students who are children, responsibly and in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and rules made under them.

1. Who we are

EdukshaIQ is operated by SASTAVA Growth System Private Limited, having its registered office at 35/9, Desabandhu St, Ram Nagar, Coimbatore, Tamil Nadu 641009, India. For any privacy or data-protection question, contact our Grievance Officer at grievance@sastava.in.

2. Our role: processor for schools

EdukshaIQ is provided to schools. When a school uses the Platform, the school decides what student data is entered and for what purpose. In most cases the school acts as the entity responsible for that data (the Data Fiduciary) and SASTAVA processes it on the school's behalf and under its instructions (as a Data Processor). The school is responsible for obtaining the consents required from students and their parents or lawful guardians before student data is provided to us.

3. Information we collect

We collect the following categories of information:

• School and staff account data: names, roles, work email addresses and login credentials of principals, coordinators, teachers and administrators.
• Student data: name, class and section, roll number, date of birth, stream, subject marks, assessment responses, computed scores, goals, and career-guidance outputs generated for the student.
• Usage and technical data: log data, device and browser information, and actions taken on the Platform, used to operate and secure the service.

We practise data minimisation: we collect only what is needed to deliver the Platform. We do not collect government identifiers, financial account details, or sensitive health information from students through the Platform.

4. Students and children's data

We recognise that most students using EdukshaIQ are children. We treat their data with particular care:

• Student data is collected and processed on the basis of the school's authority and the consent that the school obtains from parents or lawful guardians.
• We do not use student data for advertising, and we do not engage in tracking, behavioural monitoring or profiling of children for marketing.
• We do not sell or rent student data to anyone.
• Assessment and guidance outputs are generated solely to support the student's learning and career guidance within the school.

5. How we use information

• To deliver assessments, compute scores and generate reports, goals and career guidance.
• To provide dashboards and insights to authorised school staff.
• To operate, secure, maintain and improve the Platform.
• To communicate with schools about the service.
• To comply with legal obligations.

6. Legal basis

We process personal data on the basis of consent obtained through the school and for the legitimate purposes permitted under the DPDP Act, including providing a service that the school and its users have requested. Where consent is the basis of processing, it may be withdrawn as described in the section on your rights below.

7. Artificial intelligence processing

EdukshaIQ uses artificial intelligence services (including Google's Gemini models) to generate assessment questions and to help produce reports and guidance. Content sent to these services is processed to deliver these features under the applicable provider terms. We design the Platform so that student personal identifiers are not embedded into the knowledge base used for retrieval, and we do not authorise the use of student data to train third-party foundation models.

8. How we share information

We share personal data only as follows:

• With the student's own school and its authorised staff.
• With service providers who help us run the Platform (for example, cloud hosting and database providers, and the AI providers noted above), under contractual confidentiality and security obligations.
• Where required by law, or to protect rights, safety and the integrity of the Platform.

We do not sell personal data.

9. Data security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, role-based access controls, tenant data isolation so that one school cannot access another school's data, and restricted administrative access. No system can be guaranteed to be completely secure, but we work to protect data against unauthorised access, alteration and disclosure.

10. Data retention

We retain personal data for as long as the school's account is active and for a reasonable period afterwards as needed to meet legal, accounting or operational requirements, after which it is deleted or anonymised. A school may request deletion of its data, subject to any legal retention obligations.

11. Your rights

Subject to applicable law, individuals (or the school or parent acting on a student's behalf) may request to access, correct or update, or erase their personal data, and may withdraw consent. To exercise these rights, contact our Grievance Officer using the details in Section 1. We will respond within the timelines required by law.

12. Cookies

We use only the cookies and similar technologies necessary to keep you signed in and to operate the Platform securely. We do not use advertising or third-party tracking cookies.

13. Grievance redressal

If you have a complaint about how your data is handled, contact our Grievance Officer at grievance@sastava.in. We will acknowledge and address complaints within the timelines required under applicable law.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and where appropriate notify schools.

15. Governing law

This Privacy Policy is governed by the laws of India. Any disputes are subject to the exclusive jurisdiction of the courts at Coimbatore, Tamil Nadu.