Privacy Policy

1. Scope and who we are

This Privacy Policy applies to Unio's websites, learning-management system, student and educator applications, assessment and career tools, AI study and grading features, and related support services (together, the "Platform").

The Platform is operated by Eigenmind Pvt Ltd ("Unio", "we", "us" or "our"), an Indian company. This policy covers students, parents and guardians, teachers, institutional administrators, individual subscribers, website visitors and people who contact us.

We follow applicable Indian privacy and information-technology law and are preparing for the phased requirements of the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. We apply the user protections described here even where a particular statutory provision is not yet in force.

2. Our privacy commitments

• We collect data for identifiable educational, operational, safety or legal purposes—not because it may be useful someday.
• We do not sell personal data, psychometric data or student records.
• We do not use student data for third-party advertising or build advertising profiles.
• We do not permit an AI provider to train its general-purpose models on identifiable student data submitted through Unio.
• We do not use an identifiable student's psychometric profile to market to them, price a service differently, or provide it to recruiters.
• We restrict access by role and institution. A school or coaching institute cannot browse another institution's data.
• We explain material automated outputs and provide a route for human review.
• We honor valid access, correction, consent-withdrawal and deletion requests, subject to limited legal and safety exceptions.

3. Schools, families and Unio

If a school, coaching institute, board or other organization provides the account or decides why student data will be used, that institution is responsible for its instructions, notices and permissions. Unio processes the data to provide the contracted service and follows the institution's authorized instructions.

If a person signs up for Unio directly, Unio decides the purposes described in this policy. For a child, the parent or lawful guardian controls consent where the law requires it. Institutional access does not remove a student's or parent's privacy rights; we may coordinate a request with the institution so records are not changed or disclosed to the wrong person.

4. Data we collect

The exact fields depend on the user's role, enabled modules and institution. We do not collect every item below from every person.

The Platform does not request access to a device's contacts, precise location, advertising identifier or health records for its ordinary operation. Camera, microphone or file access is used only when a user deliberately chooses a feature that needs it—such as uploading an answer sheet or recording a voice message—and the operating system may ask for permission first.

5. How data reaches us

• From you: when you register, answer questions, upload work, send a message, make a payment or contact support.
• From your institution: when it creates an account, imports a roster, records attendance or grades, or uploads educational records.
• From a parent or guardian: when they create or manage a child's account, give consent or request a report.
• From Platform activity: when the service records progress, timestamps, authentication events and technical logs necessary to operate securely.
• From a service provider: for example, payment status returned by Razorpay. We do not buy student profiles from data brokers.

6. How we use data

• Provide accounts, courses, homework, assessments, attendance, fees, calendars, messages and support.
• Grade work, generate feedback, calculate academic or psychometric results, and show progress to authorized users.
• Personalize explanations, practice, remediation, concept sequencing and career guidance.
• Send service messages, security alerts, reminders and communications selected by the user or institution.
• Protect accounts, prevent abuse, investigate errors, maintain audit records and enforce our terms.
• Comply with law, accounting requirements, court orders and valid government requests.
• Evaluate feature quality and improve Unio using access-controlled operational data and, where practical, de-identified or aggregated information.

We will seek an additional permission before using identifiable student information for a materially different purpose, unless the use is required or otherwise permitted by law.

7. AI and automated outputs

• Purpose: AI is used for study assistance, question or content generation, document extraction, grading, feedback, classification, learning recommendations and report drafting.
• Provider training: Google Cloud states that it does not use customer data to train or fine-tune its AI models without the customer's permission or instruction. Unio does not grant that permission for identifiable student data.
• Unio model development: Unio does not use identifiable student submissions, conversations or psychometric profiles to train a general-purpose model. We may test and improve Unio's scoring rules and educational systems using restricted operational data, de-identified examples or separately consented research data.
• Human review: AI-generated grades, explanations, psychometric narratives and career suggestions can be incomplete or wrong. Teachers and other authorized users can review and correct educational outputs.
• No binding life decisions: Career matches and psychometric descriptions are guidance, not medical or psychological diagnosis, admission decisions, employment screening or guarantees of future performance.
• Questions and challenges: A student, parent or educator may ask for an explanation or human review by contacting us or the responsible institution.

8. Children's privacy

Many Unio users are under 18. We treat student information as deserving heightened protection, regardless of whether a particular field is legally categorized as sensitive data.

• For direct-to-family use, we require parent or lawful-guardian involvement and verifiable consent where applicable before processing a child's personal data.
• For institution-managed use, the institution must have lawful authority, give required notices and obtain any necessary parent or guardian consent. An institution's contract with Unio is not, by itself, a substitute for parental consent where the law requires parental consent.
• We do not serve targeted advertising, conduct cross-service behavioral tracking, sell children's data or provide psychometric profiles to recruiters.
• We do not use processing that is likely to cause a detrimental effect on a child's wellbeing.
• Parents and guardians may request access, correction or deletion of a child's information after appropriate identity and relationship verification.

9. When data is shared

We share personal data only in the following circumstances:

• Within the institution: with authorized teachers, administrators, students and parents according to their roles.
• With a parent or guardian: for the child linked to that verified parent or guardian.
• With service providers: only to run the Platform, process a requested payment, deliver a communication or perform an AI operation.
• With professional advisers: where necessary for confidential legal, security, accounting or audit work.
• For legal and safety reasons: where disclosure is required by law or reasonably necessary to protect users, investigate fraud or defend legal rights.
• In a corporate transaction: under confidentiality and data-protection safeguards, with notice where required.
• With your specific direction or consent: when you ask us to export or send information to another party.

We do not publish identifiable student results or use identifiable student stories in sales material without the appropriate permission.

10. Service providers

These providers process data for a defined operational purpose. They do not receive a licence to sell it or use it for their own advertising. Not every provider or feature applies to every institution or user.

The Platform supports different email, SMS and WhatsApp providers—including Google Workspace/Gmail, Brevo, SendGrid, Twilio, MSG91 or Whapi—so an institution's enabled provider may vary. Contact us if you need the current provider list for a particular deployment.

We require providers that handle personal data for us to apply protections consistent with this policy and applicable law. We remain responsible for choosing and overseeing our processors.

11. Advertising, cookies and tracking

• Unio does not display third-party advertising.
• Unio does not sell personal data or share it for cross-context behavioral advertising.
• Our current mobile applications do not include an advertising SDK or request an advertising identifier for ordinary operation.
• The marketing website may use Google Analytics to measure aggregate visits and conversions. Private investor-room links use first-party slide, active-time, download and source-link events.
• Tracked investor-room links use Microsoft Clarity session analytics to help us understand viewing behavior and diagnose presentation problems. Clarity receives opaque deck, share and session tags—not the internal recipient label.
• The authenticated web Platform uses necessary cookies or local storage for login, session security and preferences. These are not advertising cookies.

Investor-room links are bearer links: anyone who receives the link can open it. We use separate sessions, device clusters, referrer and coarse technical context to recognise likely forwarding, but we do not claim that these signals identify the forwarded viewer.

12. Storage and security

Primary application databases and uploaded media are intended to be hosted in Google Cloud's Mumbai region. Some AI and communication processing may use regional or global service endpoints as explained below.

• Encryption in transit and encryption at rest using the cloud provider's standard controls.
• Role-based permissions, authenticated access and logical separation between institutions.
• Restricted administrative access, secret management, audit logging and environment separation.
• Backups, recovery controls, security monitoring and incident-response procedures proportionate to the service.
• Reviews of vendors and access needs before personal data is provided to a new processor.

No internet service can promise absolute security. If we become aware of a personal-data breach, we will investigate, contain it and notify affected people and authorities when applicable law requires notification.

13. Retention

We keep personal data only while it serves the purpose for which it was collected, the account or institutional service remains active, or law and legitimate safety needs require retention. Contractual instructions may set a shorter period.

We periodically review whether retained information is still needed. We do not treat the indefinite commercial value of a student profile as a reason to keep it forever.

14. Your choices and rights

Depending on the applicable law and how the account was created, you may:

• ask whether we process your personal data and request a copy or summary;
• correct inaccurate or incomplete information;
• withdraw consent for future processing as easily as reasonably possible;
• ask us to delete personal data that is no longer needed;
• object to or request human review of an automated educational output;
• opt out of optional promotional messages without losing service messages;
• raise a grievance and, where applicable, nominate another person to exercise rights in the event of death or incapacity; and
• complain to the competent data-protection authority after using our grievance process.

Send a request from the email associated with the account to support@unioedtech.com. We may verify identity, guardian status or institutional authority before acting. We aim to acknowledge requests promptly and respond within 30 days, or within the period required by applicable law. We do not discriminate against a user for exercising a privacy right.

15. Account and data deletion

A user may request deletion of the account and associated personal data by using an in-product deletion option where available or by emailing support@unioedtech.com with the subject "Account deletion request".

• Direct accounts: after verification, we will delete or irreversibly de-identify the account data unless a limited record must be retained by law, for payment reconciliation, fraud prevention, security or legal claims.
• Institution-managed accounts: we may route or coordinate the request with the institution that controls the educational record. We will not use that coordination to obstruct a valid request.
• Other people's records: we may retain content necessary to preserve another user's rights or an institution's required academic record, while removing or restricting the requester's identifiers where appropriate.
• Backups: residual copies may remain inaccessible in backup systems until overwritten in the ordinary cycle.

Deleting an Unio account does not automatically cancel an App Store, Play Store or payment-provider subscription. Those subscriptions must also be cancelled through the provider that manages the billing relationship.

16. International processing

Unio is based in India and intends to keep primary application records and uploaded files in India. Some providers—particularly global AI, email, messaging, support or app-distribution services—may process limited data outside India or through a global endpoint.

Where personal data is processed across borders, we limit the data to the service need, use contractual and technical safeguards, and comply with applicable transfer restrictions. Institutional contracts may impose stricter residency terms; those terms control for that deployment.

17. Changes to this policy

We may update this policy when the product, providers or law changes. The date at the top will show the latest revision. If a change materially expands how we use personal data, we will provide a prominent notice and obtain fresh consent where required. We will not treat silence as consent where affirmative consent is required.