AnvyoAI
Legal
Data Protection
The operational detail behind the Privacy Policy: what is kept, for how long, who processes it, and how to make a request.
Scope
This page describes how Social House Learning handles personal information in the operation of AnvyoAI. It sits alongside the Privacy Policy and gives the operational detail: security, minors and requests.
SHL intends to operate in line with applicable Indian data protection law, including the Digital Personal Data Protection Act, 2023, and any other law that applies to its users. This page describes our practices. It is not a certification or a claim of compliance with any specific statute.
Roles
Data controller or fiduciary: SMHM SERVICES LLP
Data protection contact: info.socialhouselearning@gmail.com
Where a school enrols students, the respective roles and responsibilities of the school and SHL are set out in the written agreement between them.
Principles applied
- Data minimisation. Collect only what a feature genuinely needs.
- Purpose limitation. Use information for guidance, not for unrelated commercial purposes.
- Transparency. State what is collected, why, and for how long.
- Accuracy. Let users correct information that is wrong.
- Storage limitation. Delete or de-identify information once its purpose has ended.
- Security. Protect information with technical and organisational measures.
- Accountability. Keep records of processing and review them.
Categories of data
| Category | Examples |
|---|---|
| Account data | Name, email, grade |
| Academic context | Subjects, stream, board |
| Discovery responses | Activity answers, interest inputs |
| Generated outputs | Profile summaries, roadmaps, shortlists |
| Mentor conversations | Messages exchanged with the AI mentor |
| Technical and usage data | Device type, feature usage, logs |
| Support correspondence | Emails and form submissions |
Retention periods
| Category | How long it is kept |
|---|---|
| Account data, academic context, discovery responses and generated outputs | While the account is active, then deleted or de-identified within 90 days of closure or the end of a school programme |
| Mentor conversations | While the account is active, unless you delete them sooner, then deleted within 90 days of closure |
| Technical and usage logs | Up to 12 months, then deleted or aggregated |
| Support correspondence and website enquiries | Up to 24 months from the last message |
| Payment and invoice records | As long as Indian tax and accounting law requires, currently up to 8 years |
De-identified and aggregated information that can no longer be linked to a person may be kept to understand how the service is used.
Service providers
These categories of provider process personal information on our instructions and under written terms.
| Provider type | Purpose |
|---|---|
| Website hosting (Vercel Inc.) | Serving this website |
| Web fonts (Google Fonts) | Delivering the typeface used on this website |
| Platform hosting (Vercel Inc.) | Serving the AnvyoAI platform at app.anvyoai.com |
| Sign in, database and file storage (Google Firebase) | Account sign in, and storing profiles, roadmaps and saved work |
| AI models (Google Gemini) | Generating recommendations, summaries and mentor responses, as described on the AI Ethics & Safety page |
| Payment processor (Razorpay) | Taking payments for plans and credit top-ups |
| Error monitoring (Sentry) | Detecting and fixing technical errors in the platform |
| Email delivery (Resend) | Delivering website enquiries and sending account, billing and support emails |
| Website analytics (Vercel Web Analytics) | Cookieless, aggregated page-view statistics for this website |
A list of the specific providers currently in use is available on request from info.socialhouselearning@gmail.com.
Security measures
- Encryption of data in transit using current TLS
- Access control on internal systems, limited to staff who need it
- Separation of production data from development and testing environments
- Logging of administrative access to student information
- Vendor review before a new processor handles personal information
We do not claim that any system is perfectly secure, and we do not publish security certifications we do not hold.
Minors and guardians
Because AnvyoAI is built for Grades 9 to 12, most users are minors.
- Students under 18 use AnvyoAI with the consent of a parent or guardian, or through a school that has arranged consent as part of its written agreement with SHL
- Where a student signs up individually, consent from a parent or guardian is required before discovery activities begin
- A parent or guardian can ask to see, correct or delete a student's information, and can withdraw consent at any time
- No behavioural advertising or advertising profiling is applied to student accounts
- Sensitive categories that guidance does not require are not collected
Access, correction and deletion requests
Requests can be made by a student, or by a parent or guardian on a student's behalf.
- Send the request to info.socialhouselearning@gmail.com with the account email address
- We confirm receipt and verify the identity of the requester
- We complete the request, or explain why we cannot, within 30 days
- Where a request is refused, we explain the reason and the route to escalate
Security incidents
If an incident affects personal information, our process is to contain it, assess the scope, notify affected users and any authority required by applicable law, and record what happened and what changed afterwards.
Raising a concern
Concerns about data handling can be sent to info.socialhouselearning@gmail.com. If you are not satisfied with the response, you may approach the relevant supervisory authority in your jurisdiction.
Review of this page
This page is reviewed whenever our processing activities, service providers or the applicable law change. The effective date at the top of the page reflects the current version.