The data privacy agreement, before you ask a salesperson.

Who is who under the agreement?

The school is the Data Fiduciary under the Digital Personal Data Protection Act 2023 — it decides why and how personal data is processed. AI Nexus Innovations Hub Pvt Ltd, which develops and operates Edvation, is the Data Processor, acting only on the school’s documented instructions. The agreement names both, their registered addresses, and the school’s nominated contact.

What does it cover?

Twelve clauses, in this order. Each is written to be read by a school’s counsel without a call.

1. 01

   Purposes and instructions

   The purposes the school has notified to parents and students; we process for those and no other.

2. 02

   Categories of data and data principals

   Students, parents and guardians, staff — and the itemised data each category involves, mirrored from the product’s own consent screens.

3. 03

   Children’s data

   No tracking, no behavioural monitoring and no targeted advertising directed at children (s. 9(3)); verifiable parental consent before any child feature; student work never trains any model.

4. 04

   Sub-processors

   The published list at /trust/subprocessors is incorporated by reference; thirty days’ notice before any addition, with a right to object.

5. 05

   Data residency

   Databases, files and the message bus in AWS Mumbai (ap-south-1); speech recognition in Azure Central India; no transfer outside India without the school’s written instruction.

6. 06

   Security measures

   Encryption at rest and in transit, server-enforced role-based access, audit trails on every AI surface, and the security summary at /trust/security.

7. 07

   Data-principal rights

   Access, correction, erasure and grievance requests are fulfilled through the product’s own request executor within the statutory window; we assist the school, never answer for it.

8. 08

   Retention and deletion

   Data is kept for the period the school sets per purpose; on termination it is returned in an open format and deleted from every store within ninety days, with written confirmation.

9. 09

   Personal-data breach

   Notice to the school without undue delay and within seventy-two hours of confirmation, with what was affected and what was done; the school notifies the Board and the data principals as the Rules require.

10. 10

    Audit and assistance

    One audit per year on thirty days’ notice, or a completed due-diligence questionnaire on request; assistance with the school’s own compliance documentation.

11. 11

    AI processing

    Model providers are contractually barred from training on or retaining school data; every AI call is attributed to a user and priced from real usage; a named adult can read any child’s AI session.

12. 12

    Term, termination and liability

    Co-terminous with the service agreement; the data clauses survive until deletion is confirmed; liability is set in the service agreement, never reduced by this one.

What do we deliberately not claim?

We say designed for and aligned with the DPDP Act — never certified. We hold no SOC 2 or ISO 27001 certificate and do not claim one, and the agreement does not either. When a certificate exists, its number goes in the agreement and one linked badge goes in the footer; until then, nothing.

How do you get the signed agreement?

Write to info@edvation.ai with the school’s registered name and your DPO’s or principal’s details. We return the agreement filled for your school; the Grievance Officer at grievance@edvation.ai answers any question about it within 90 days, as the Rules require.

info@edvation.aigrievance@edvation.ai