Privacy Policy & Data Governance

1. Information We Process

Depending on how you interact with our platform, we collect and process the following categories of personal data:

• Contact & Profile Details: Full name, verified mobile phone number, WhatsApp phone number, email address, company/institution name, and communication preferences.
• Enquiry & Commerce Data: Course inquiries, order cart items, delivery addresses, transaction references, support tickets, and service preferences.
• WhatsApp Business Message Data: Inbound and outbound message text, media attachments (images, PDFs), timestamps, message statuses (sent, delivered, read), and opt-in/opt-out consent timestamps.
• Technical & Log Information: IP address, device type, browser specifications, access timestamps, and session diagnostics necessary for cybersecurity and abuse prevention.

2. Legal Bases & Processing Purposes

We process personal data only where permitted by law, specifically for:

• Delivering requested services, course materials, product catalogs, and transactional order confirmations.
• Operating our omnichannel team inbox and conversational customer relationship management workflows.
• Routing incoming inquiries to qualified counselors, support agents, or automated assistants.
• Reconciling financial transactions and issuing GST-compliant tax invoices via our payment provider.
• Ensuring platform integrity, preventing fraud, and adhering to statutory legal obligations.

3. WhatsApp Cloud API & Opt-Out Compliance

Our WhatsApp communication infrastructure is powered exclusively by the official Meta Cloud API (v24.0) under Meta Platforms Inc. enterprise partner terms:

• Explicit Consent (Opt-In): We initiate outbound notifications (such as invoice receipts, appointment reminders, and shipping updates) only to users who have explicitly provided opt-in consent via our website forms, checkout, or prior communication.
• 24-Hour Customer Care Window: When you send a message to our official WhatsApp number, a 24-hour service window opens wherein our team and AI assistants may converse to resolve your query.
• Instant Opt-Out (STOP Keywords): You may opt out of promotional messages at any time simply by replying "STOP", "UNSUBSCRIBE", or "CANCEL" in the WhatsApp chat. Opt-out takes effect immediately.

4. Artificial Intelligence (AI) Processing & Guardrails

Our platform integrates Google Genkit and Gemini models to assist internal operations in summarizing customer context, drafting responses, and scheduling appointments:

• AI processing operates strictly under enterprise confidentiality agreements and customer data is NOT used to train public foundation models.
• Zero Payment Authority Invariant: AI models possess ZERO authority to declare payments received or issue receipts. Official transaction verification is exclusively performed via server-authoritative payment webhooks.
• Human agents maintain oversight and can take over live conversations at any point.

5. Payment Gateway & Financial Security

All commercial payments, course fees, and subscriptions are processed through Razorpay Software Private Limited:

• Zero Raw Card Storage: We do NOT collect, store, or process complete credit/debit card numbers, CVVs, or UPI PINs on our servers.
• All payment card data is tokenized directly via Razorpay's Level 1 PCI-DSS compliant checkout interface with 256-bit TLS encryption.
• Our databases store only non-sensitive transaction tokens (Payment ID, Order ID, amount, timestamp, and status) required for auditing and order fulfillment.

6. Data Sharing & Cloud Sub-Processors

We do not sell, rent, or monetize your personal information. We share data strictly with verified cloud infrastructure providers required to deliver our services:

• Hosting & Cloud Database: Google Cloud Platform / Firebase App Hosting & Cloud Firestore.
• Messaging Infrastructure: Meta Platforms, Inc. (WhatsApp Business Cloud API).
• Payment Processing: Razorpay Software Private Limited (RBI Authorized Payment Aggregator).
• AI Intelligence: Google Cloud Genkit / Gemini Enterprise API.

7. Technical & Security Safeguards

We maintain enterprise-grade security protocols, including:

• HMAC SHA-256 webhook signature verification on all incoming Meta and Razorpay payloads.
• End-to-end encryption for WhatsApp messages in transit.
• Role-Based Access Control (RBAC) restricting customer records strictly to authorized staff members.
• Automated audit logging of all sensitive administrative modifications.

8. Data Retention & Permanent Deletion

We retain personal data only for as long as necessary to fulfill active customer services, resolve inquiries, and comply with tax and legal requirements:

• WhatsApp conversation records are retained for a maximum of 24 months, after which they are automatically archived or purged.
• Financial transaction ledgers are retained as required by Indian accounting and taxation statutes.
• To request deletion of your personal data at any time, visit our User Data Deletion Page.

9. Your Statutory Rights & Grievance Officer

Under the Digital Personal Data Protection Act, 2023, you have the right to request access, correction, restriction, or erasure of your personal data.