Privacy Policy

This Privacy Policy explains how [Company Legal Name] ("AdmiTree", "we", "us"), which operates the AdmiTree platform, collects, uses, shares, stores and protects your personal data. We are the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and we also follow the Information Technology Act, 2000 and the SPDI Rules, 2011. Please read this together with our Terms & Conditions and Disclaimer.

1. Information We Collect

We collect only the data we need to run the platform. In practice this is:

Information you provide directly

• Account details: first and last name, email address, phone number, and a password (stored only as a secure one-way hash, never in plain text).
• Profile and academic details: date of birth, gender, city and state, school, board, education level, expected graduation year and target intake.
• Academic performance: board or subject marks, GPA, and test scores you enter (for example CUET, SAT, ACT, IELTS, TOEFL).
• Achievements and activities: extracurriculars, awards, olympiads, research papers, AP subjects, and student-council roles.
• Preferences: preferred countries, majors, budget range, and whether you need financial aid.
• Financial information: family income, where you choose to provide it, to estimate affordability and scholarship eligibility. This is sensitive personal data and is treated as such.
• Content you submit: essays and drafts you upload for feedback, application-tracker entries, chatbot messages, and support or contact-form messages.
• Sign-in with Google: if you choose "Continue with Google", Google shares your name, email address and Google account ID with us. We use them only to create your account and sign you in; we do not get your Google password or access to anything else in your Google account.

Information collected automatically

• Essential technical data: IP address and basic device or browser information, used for security, session management and fraud prevention.
• Essential cookies: a session cookie and, if you choose "remember me", a login token. See Section 7.

We do not currently run third-party advertising, behavioural-tracking or analytics pixels (such as Google Analytics or a Meta pixel). If we introduce optional analytics in future, we will ask for your consent first through our cookie banner, and we will not use behavioural tracking or targeted advertising on the accounts of children.

2. Why We Use Your Data and the Legal Basis

Under the DPDP Act we process your data on the basis of your consent, and for certain limited "legitimate uses" the Act permits. We use your data to:

• create and secure your account and log you in;
• generate college recommendations, admission-probability estimates, cost estimates and essay feedback;
• let you track applications and connect with student mentors (Senior Connect);
• process payments for paid services through our payment gateway;
• send you service and account communications;
• keep the platform safe, prevent misuse, and comply with law.

We use your data only for the purposes described here (purpose limitation) and collect only what those purposes need (data minimisation).

3. Third Parties and Cross-Border Processing

We do not sell your personal data. We share it only with the service providers (Data Processors) that make the platform work, under contract and only for the purposes above:

• Artificial-intelligence providers (important): to generate essay feedback, recommendations, admission-probability estimates and chatbot replies, we send the relevant content, which can include your essay text and profile details, to third-party large-language-model providers, currently Google (Gemini API) and Groq. These providers process the data on servers located outside India, so this involves a cross-border transfer. We share only what a given feature needs and we do not permit this data to be sold.
• Payments: Razorpay processes payments. Card and banking details are entered on Razorpay and are not stored by us.
• Email and hosting: our email-delivery and hosting providers, to send account emails and run the service.
• Legal and safety: where required by law, court order, or to protect the rights and safety of users or the public.
• Business transfer: in a merger, acquisition or sale of assets, subject to this Policy.

4. Cookies and Similar Technologies

We use two kinds of storage:

• Strictly necessary cookies (always on): a PHP session cookie to keep you logged in and secure, and an optional "remember me" login token. These are essential and cannot be switched off without breaking the site.
• Functional local storage: small amounts of data kept in your browser to run interactive features such as practice tests and dashboards.
• Optional cookies (off by default): if we add analytics or preference cookies later, they will load only after you select "Accept" in our cookie banner. Choosing "Reject" keeps only the strictly necessary cookies.

You are asked for your cookie choice through a banner on your first visit, and your choice is remembered. You can also control cookies in your browser settings.

5. How We Protect Your Data

We apply reasonable security practices, including:

• passwords stored only as bcrypt hashes, never in plain text;
• encryption in transit (HTTPS/TLS);
• parameterised database queries and cross-site-request-forgery protection on forms;
• access controls that limit who can see your data;
• collecting and keeping only what we need.

No online service can promise perfect security. Please use a strong, unique password and keep your login details private.

6. Data Breach

If a personal-data breach occurs, we will act to contain it and will notify the Data Protection Board of India and affected users as required by the DPDP Act.

7. Data Retention

We keep your personal data for as long as your account is active and for a reasonable period afterwards to meet legal, tax and fraud-prevention obligations, after which we delete or anonymise it. Financial and payment records may be retained for the period Indian tax and financial law requires. We keep a copy of the emails we send you (for example order confirmations and reminders) for 12 months so we can answer questions about them, then delete their content; emails containing one-time codes or password links are never stored. You can ask us to delete your account at any time (see Section 8). We are implementing automated deletion or anonymisation of long-inactive accounts.

8. Your Rights as a Data Principal

Under the DPDP Act you have the right to:

• Access: a summary of the personal data we hold about you and how it is processed;
• Correction and updating: fix data that is inaccurate, incomplete or out of date;
• Erasure: ask us to delete your personal data where we are no longer required to keep it;
• Grievance redressal: raise a complaint with our Grievance Officer (Section 10);
• Nominate: nominate another person to exercise your rights in the event of death or incapacity;
• Withdraw consent: withdraw consent you previously gave, without affecting processing already done.

To exercise any of these, email our Grievance Officer (Section 10) or write to hello@admitree.in. We acknowledge requests within 24 hours and aim to resolve them within 15 days. A full self-service data export and one-click deletion are being built; until then, requests are handled by our team.

9. Children's Data and Parental Consent

Indian law treats every person under 18 as a child. If you are under 18:

• you may use AdmiTree only with the verifiable consent of a parent or legal guardian;
• by creating an account and confirming the guardian-consent declaration at sign-up, you confirm that such consent has been obtained;
• we do not carry out behavioural tracking, behavioural monitoring, or targeted advertising directed at children;
• a parent or guardian can contact our Grievance Officer to review, correct or delete their child's data, or to withdraw consent.

We are strengthening this into a verifiable parental-consent workflow. If you believe a child's data has been collected without proper guardian consent, contact us and we will act promptly.

10. Grievance Officer and Data Protection Contact

In line with the DPDP Act and the IT Rules, 2021, you can reach our Grievance Officer:

• Name: [Grievance Officer Name]
• Email: grievance@admitree.in
• Address: [Company Legal Name], [India postal address]

We acknowledge every complaint within 24 hours and work to resolve it within 15 days. If you are not satisfied, you may escalate to the Data Protection Board of India. See our dedicated Grievance Officer page.

11. Changes to This Policy

We may update this Policy from time to time. We will post the new version here with a revised "Last updated" date and, for significant changes, notify you by email or an in-platform notice.

12. Contact Us

• Email: hello@admitree.in
• Grievance Officer: grievance@admitree.in
• Address: [Company Legal Name], [India postal address]