Privacy policy (draft)

1. Who we are

StudentFlow is a journey planner for people going abroad to study, move, work, visit family or travel. In this policy, “we”, “us” and “StudentFlow” mean the operator of this website and service. [confirm: legal entity name, registered address] For the purposes of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described here.

2. What we collect

Account details: name, email address, mobile number and password (stored hashed).
Plan details you give us: destination country, university, course, intake, admission status, travel date and similar answers used to build your journey.
Documents you upload: for example a passport, offer letter or bank statement, only if you choose to upload them.
Messages and enquiries: what you send through the contact form, to a consultant or to the in-app assistant.
Orders and payments: what you book through us and its status. Card or bank details are handled by our payment partner and are not stored by us. [confirm]
Technical data: basic logs such as IP address, browser type and pages visited, used for security and to keep the service running.

3. Why we use it

To create your account and build and update your personal journey.
To show your tasks, deadlines and documents, and send reminders and service messages.
To process orders you choose to place with partner providers.
To reply to your enquiries and give you support.
To keep the service secure, prevent misuse and fix problems.
To improve StudentFlow, using aggregated or de-identified information where practical.
To send marketing messages only if you have opted in, which you can change at any time.

We ask for your consent in clear language, for specific purposes, at the point we collect your data — for example when you create an account or tick the box on the contact form. You can withdraw consent at any time. Withdrawing consent won’t affect what we did before you withdrew, but it may mean we can no longer provide parts of the service that need that data.

In some cases the law lets us use data without consent, for example to comply with a legal obligation. We will tell you if that applies.

5. Your documents

Uploaded documents are stored in private storage. They are not available through public links.
They are visible to you, to the consultant you chose to share with (you can stop sharing from your profile), and to StudentFlow admins, who can open any file when they need to. [confirm: staff access policy]
To suggest a document type and an expiry date, text-reading software on our own server reads your file. The file is not sent to anyone else for this.
Upload only what a step asks for. You can delete a document from your vault at any time. It is deleted from our storage and from your vault. Backups of our server are replaced on a schedule, so a copy can remain in an old backup until it is replaced. [confirm: backup period]
We never share your documents with a university, embassy or other third party on your behalf unless you ask us to.

We do not sell your personal data. We share it only where it is needed to run the service or you ask us to:

Partner providers (for example eSIM, insurance, accommodation, flights or forex providers) — only the details needed to complete an order you place.
Consultants you work with, for the students they manage.
Payment partners that process payments.
Infrastructure and communications providers, such as hosting, email and error monitoring, who process data on our behalf under contract.
AI service providers, only if an AI provider is switched on for the in-app assistant: your question and your last two questions (with phone numbers, email addresses and ID-like numbers removed first), plus your first name, destination, university, course, intake, travel date, open task titles and pending document names, are sent to the provider to write the answer. Uploaded documents are not sent. [confirm: provider agreements and where the data is processed]
Authorities, where the law requires it.

Each third party has its own privacy policy for how it handles data it receives from you directly.

7. How long we keep it

We keep your data while your account is active. When you close your account (Profile, then Delete my account; there is a 7-day wait in case you change your mind) we delete your plan, documents, messages and chats and anonymise your account, except records we are required to keep by law, such as order, payment and tax records, which stay without your personal details.

Some data is removed on a schedule: in-app notifications after 90 days, assistant chat messages after 12 months, WhatsApp message history after 90 days, contact-form and waitlist entries that never became an account after 24 months, IP addresses in our logs after 90 days, and accounts nobody has signed in to for 24 months (after a warning by email). [confirm: periods per data type, and how long accounting records must be kept]

8. Your rights

Under the DPDP Act you can, in the ways the Act provides:

ask for a summary of the personal data we process about you and who we shared it with;
ask us to correct, complete or update your data;
ask us to erase your data, unless we need to keep it by law;
withdraw your consent;
use our grievance process (below) and, if you are not satisfied, complain to the Data Protection Board of India;
nominate another person to exercise your rights if you die or become unable to.

You can download your data and ask for your account to be deleted yourself from your profile. For anything else, write to us through the contact page.

9. Security

We use reasonable safeguards, including private document storage, access controls, encrypted connections and logging of important actions. No system is perfectly secure, and we will tell you and the authorities about a data breach as the law requires. [confirm: final list of safeguards]

10. Cookies

We use essential cookies to keep you signed in and to protect forms against misuse. [confirm: whether analytics or marketing cookies are used; add a consent banner if so]

11. If you are under 18

Many students are under 18 when they plan their studies. The DPDP Act requires verifiable consent from a parent or lawful guardian before we process a child’s personal data. If you are under 18, please ask a parent or guardian to create or approve your account. [confirm: how parental consent is collected and verified]

12. Changes

If we change this policy in a way that matters, we’ll tell you in the product or by email and update the date at the top of this page.

13. Contact and grievances

For questions or complaints about your data, use the contact page. [add: name and contact details of the grievance officer or data protection contact]

Privacy policy