Nexutor.AI Private Limited ("Nexutor.AI", "we", "us", or "our") is committed to protecting the privacy of students, parents, and other users of our website, web application, and related services (collectively, the "Platform"). We recognize that we handle personal data of children and other individuals and that this data must be processed with a very high degree of care and responsibility.
This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you use Nexutor.AI, and how we comply with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
By using Nexutor.AI, or by providing personal data to us, you acknowledge that you have read and understood this Privacy Policy. For users under 18 years of age, parental or legal guardian consent is required before we process their personal data.
1
Definitions
- "Personal Data"—Any data about an individual who is identifiable by or in relation to such data, consistent with the definition under the DPDP Act.
- "Digital Personal Data"—Personal data in digital form.
- "Data Principal"—The individual to whom the personal data relates; in the case of a child, this includes the child and their parent or lawful guardian.
- "Child"—An individual who has not completed 18 years of age.
- "Data Fiduciary"—Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data; for the purposes of this Policy, Nexutor.AI is the Data Fiduciary for data it controls.
- "Processing"—The entire lifecycle of personal data — collection, storage, use, sharing, disclosure, and deletion.
- "Sensitive Personal Data or Information (SPDI)"—Has the meaning set out in the SPDI Rules and includes, among other things, passwords, financial information, medical records and history, and biometric information.
2
Scope and Applicability
This Privacy Policy applies to:
- •Students (including children under 18 years of age) who use Nexutor.AI through their school or college
- •Students who sign up directly, with or without initial involvement of an institution
- •Parents and legal guardians who provide consent or interact with the Platform
- •Teachers, counsellors, school administrators, and other institutional users
- •Visitors to our website
This Policy applies to all digital personal data we process in India and, where applicable, to data transferred outside India in accordance with applicable law.
3
Categories of Data We Collect
Depending on how you use the Platform, we may collect the following categories of personal data:
3.1 Student identification and contact data
- •Name, date of birth, age, gender
- •Class/grade, school/college name, board, stream
- •Contact information (email address, mobile number where applicable)
3.2 Parent / guardian data (for children under 18)
- •Name of parent or legal guardian
- •Relationship to the child
- •Contact information (email address, mobile number)
- •Records of consent and communications in relation to the child's data
3.3 Education and career-related data
- •Academic background (streams, subjects, exam plans, years)
- •Career interests, preferences, aspirations, and self-reported goals
- •Responses to psychometric and interest assessments
- •Roadmap data (milestones created, progress, completion status, reflections)
3.4 Usage and interaction data
- •Chat logs and interactions with the AI career counselor and other AI modules
- •Actions on the Platform (pages visited, buttons clicked, time spent) with special safeguards for child users
3.5 Device and technical data
- •IP address, device type, browser type, operating system
- •Log information (access times, error logs)
We do not collect this data with the intention of profiling children for marketing or targeted advertising.
3.6 Sensitive Personal Data
We generally do not intend to collect financial information, biometric data, or detailed medical records from students through the Platform. If any Sensitive Personal Data is collected, we will process it only with explicit, informed consent and enhanced security measures. We do not collect payment card numbers directly; payments are processed through third-party payment gateways.
4
Legal Bases and Purposes of Processing
4.1 Legal bases
- •Consent: For most student and parent data, we rely on free, specific, informed, unconditional and unambiguous consent.
- •Parental consent for children: For individuals below 18, we obtain verifiable parental or legal guardian consent before processing.
- •Legitimate educational use: In limited cases, we may process data to comply with legal requirements or for legitimate educational purposes.
4.2 Purposes of processing
- •Providing core services — Administering accounts, providing assessments, AI-based career guidance, and personalized roadmaps
- •Improving student outcomes — Tailoring recommendations and aggregating anonymized insights for institutions
- •Platform operation and security — Monitoring performance, preventing fraud, implementing child safety measures
- •Research and analytics — Using de-identified or aggregated data to improve product quality
- •Legal compliance — Complying with obligations under the DPDP Act, IT Act, and SPDI Rules
We do not use children's personal data for behavioural tracking, targeted advertising, or profiling for marketing purposes.
5
Use of AI and Google Gemini
Nexutor.AI uses artificial intelligence (AI) technologies to provide personalized guidance, including Google Gemini models accessed via secure APIs.
5.1 What data is sent to AI services
- •Chat prompts and messages that you enter in the AI counselor or similar interfaces
- •Relevant profile and assessment summaries strictly necessary for appropriate responses
We minimise the personal data shared with AI models and avoid including direct identifiers where not needed.
5.2 Role of Google and other providers
Google and similar cloud providers act as data processors on our behalf. They are bound by their own privacy commitments and contractual obligations to protect personal data and not to use it for advertising or profiling of our users.
5.3 Your choices
If you do not wish your data to be processed by AI models, certain features may not be available. We will provide non-AI alternatives for critical functions wherever reasonably possible.
6
Children's Privacy and Parental Consent
6.1 Definition of child
Under the DPDP Act, a "child" is any person who has not completed 18 years of age. Nexutor.AI is designed specifically for school and college-going students, many of whom are children under this definition.
6.2 Parental / guardian consent
Before processing any personal data of a child, we will obtain verifiable consent from a parent or legal guardian through mechanisms such as:
- •Requiring the parent/guardian to confirm an account and provide consent when the student signs up
- •Email or OTP-based verification sent to the parent or guardian
- •Confirmation via the school or institution where existing consent processes apply
6.3 Special protections for children's data
- •We will not engage in tracking, behavioural monitoring, or targeted advertising directed at children
- •We will not process children's data in any manner likely to cause detrimental effects on their wellbeing
- •We design interfaces in child-friendly language with visual or simplified explanations
7
How We Collect Data
- •Direct input: When a student, parent, teacher, or administrator creates an account, fills out forms, completes assessments, or uses the chat and dashboard features
- •Institutional import: Where a school or college provides limited student data for enabling accounts and cohort analytics
- •Automatically: Through cookies and similar technologies for Platform performance and security (not for advertising or cross-site tracking of children)
8
Cookies and Tracking Technologies
We may use cookies and similar technologies to:
- •Keep users logged in and maintain sessions
- •Remember preferences (language, theme)
- •Measure engagement at a high level to improve the Platform
For child users, cookies are restricted to functional and strictly necessary purposes only. Users and parents can manage preferences via browser settings.
9
Sharing and Disclosure of Personal Data
We do not sell personal data to third parties.
We may share personal data in the following limited circumstances:
- •Service providers / processors — Trusted third-party vendors (cloud hosting, AI providers, analytics, email/SMS gateways, payment gateways) bound by contractual obligations
- •Educational institutions — Schools and colleges for individual and aggregated student insights, subject to consent
- •Legal obligations and safety — To comply with applicable laws, regulations, or enforceable governmental requests
- •Business transfers — In connection with a merger, acquisition, or sale, subject to equivalent privacy obligations
10
Cross-Border Data Transfers
Our Platform may use infrastructure located in India or other countries, including cloud regions used by Google for running AI models. Where personal data is transferred outside India, we ensure compliance with the DPDP Act and require service providers to provide a comparable level of data protection.
11
Data Security
We implement reasonable security practices including:
- •Access controls, authentication, and role-based permissions
- •Encryption in transit and at rest where appropriate
- •Secure coding practices and regular security reviews
- •Logging and monitoring of access to personal data
- •Employee and contractor confidentiality obligations and training
In the event of a data breach, we will take appropriate remedial measures and comply with notification obligations under Indian law.
12
Data Retention
- •Student and parent data will typically be retained for the duration of use plus a reasonable period thereafter
- •Assessment results and roadmap data may be retained in anonymized or aggregated form for research and improvement
- •Records of parental consent may be retained longer if required by law
When data is no longer required, we will delete or anonymize it using reasonable measures.
13
Rights of Data Principals
Under the DPDP Act, Data Principals have the following rights:
- •Right to Information — Obtain a summary of personal data being processed, purposes, categories, and sharing details
- •Right to Correction and Updating — Request correction, completion, or updating of inaccurate or incomplete data
- •Right to Erasure — Request erasure of personal data processed on the basis of consent
- •Right to Withdraw Consent — Withdraw consent at any time with the same ease with which it was given
- •Right to Grievance Redressal — Lodge a complaint with our Grievance Officer and escalate to the Data Protection Board of India
For children, these rights may be exercised by the parent or legal guardian acting on their behalf.
14
Exercising Your Rights
To exercise your rights or manage consent, you may use in-product controls where available or contact us using the details provided below. We may need to verify your identity before processing your request and will respond within a reasonable time frame.
15
Third-Party Links
The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of third-party sites before providing them with any personal data.
16
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and provide additional notice where required. Continued use of the Platform after such changes indicates your acceptance of the revised Policy.
17
Contact
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact:
You may also escalate unresolved grievances to the Data Protection Board of India once it is operational, as per the DPDP Act.
18
Governing Law and Jurisdiction
This Privacy Policy is governed by the laws of India, including the DPDP Act, the Information Technology Act, 2000, and the SPDI Rules, as amended from time to time. Any disputes shall be subject to the exclusive jurisdiction of the competent courts in India.
19
Acceptance of this Policy
By creating an account on Nexutor or allowing your child to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described here, in accordance with the DPDP Act, the Information Technology Act, 2000, the SPDI Rules, and other applicable Indian laws.