Legal
Data Protection
The operational detail behind the Privacy Policy: what is kept, for how long, who processes it, and how to make a request.
This document is a website draft prepared for Social House Learning. It is not legal advice. SHL should have the final text reviewed and approved by qualified legal counsel, and every placeholder completed, before this page is published to a live production site.
Scope
This page describes how Social House Learning handles personal information in the operation of AnvyoAI. It sits alongside the Privacy Policy and gives the operational detail: retention, security, sub-processors, minors and requests.
SHL intends to operate in line with applicable Indian data protection law and any other law that applies to its users. This page does not assert certification or compliance with any specific statute. That assessment is being completed with qualified counsel, and this page must be updated with the outcome before any compliance claim is published.
Roles
Data controller or fiduciary: [TO BE COMPLETED BY SHL]
Data protection contact: [TO BE COMPLETED BY SHL]
Grievance officer: [TO BE COMPLETED BY SHL]
Where a school enrols students, the respective roles and responsibilities of the school and SHL are set out in the written agreement between them.
Principles applied
- Data minimisation. Collect only what a feature genuinely needs.
- Purpose limitation. Use information for guidance, not for unrelated commercial purposes.
- Transparency. State what is collected, why, and for how long.
- Accuracy. Let users correct information that is wrong.
- Storage limitation. Delete or de-identify information once its purpose has ended.
- Security. Protect information with technical and organisational measures.
- Accountability. Keep records of processing and review them.
Categories and retention
| Category | Examples | Retention |
|---|---|---|
| Account data | Name, email, grade | [TO BE COMPLETED BY SHL] |
| Academic context | Subjects, stream, board | [TO BE COMPLETED BY SHL] |
| Discovery responses | Activity answers, interest inputs | [TO BE COMPLETED BY SHL] |
| Generated outputs | Profile summaries, roadmaps, shortlists | [TO BE COMPLETED BY SHL] |
| Mentor conversations | Messages exchanged with the AI mentor | [TO BE COMPLETED BY SHL] |
| Technical and usage data | Device type, feature usage, logs | [TO BE COMPLETED BY SHL] |
| Support correspondence | Emails and form submissions | [TO BE COMPLETED BY SHL] |
Security measures
- Encryption of data in transit using current TLS
- Access control on internal systems, limited to staff who need it
- Separation of production data from development and testing environments
- Logging of administrative access to student information
- Vendor review before a new processor handles personal information
Encryption at rest, backup and disaster recovery arrangements: [TO BE COMPLETED BY SHL]
We do not claim that any system is perfectly secure, and we do not publish security certifications we do not hold.
Minors and guardians
Because AnvyoAI is built for Grades 9 to 12, most users are minors.
- Consent mechanism for minors: [TO BE COMPLETED BY SHL]
- Age verification approach: [TO BE COMPLETED BY SHL]
- Guardian access and oversight: [TO BE COMPLETED BY SHL]
- No behavioural advertising or advertising profiling is applied to student accounts
- Sensitive categories that guidance does not require are not collected
Access, correction and deletion requests
Requests can be made by a student, or by a parent or guardian on a student's behalf.
- Send the request to [TO BE COMPLETED BY SHL] with the account email address
- We confirm receipt and verify the identity of the requester
- We respond within [TO BE COMPLETED BY SHL]
- Where a request is refused, we explain the reason and the route to escalate
Sub-processors
Hosting and infrastructure: [TO BE COMPLETED BY SHL]
Database and storage: [TO BE COMPLETED BY SHL]
Email delivery: [TO BE COMPLETED BY SHL]
AI providers: [TO BE COMPLETED BY SHL]
Analytics: [TO BE COMPLETED BY SHL]
This list must name the actual providers before publication, and must be updated when a provider is added or removed.
Security incidents
If an incident affects personal information, our process is to contain it, assess the scope, notify affected users and any authority required by applicable law, and record what happened and what changed afterwards.
Notification timelines under applicable law: [TO BE COMPLETED BY SHL]
Raising a concern
Concerns about data handling can be sent to the grievance officer at [TO BE COMPLETED BY SHL]. If you are not satisfied with the response, you may approach the relevant supervisory authority in your jurisdiction.
Legal review status
Every placeholder on this page must be completed, and the full set of policy documents must be reviewed and approved by qualified legal counsel, before AnvyoAI collects information from any real student.