Privacy Policy
Privacy Policy
How CavenX collects, uses, and protects personal data for schools, universities, colleges, and their students, faculty, and staff — including end-to-end encrypted communications and DPDP Act 2023 compliance.
Last updated: June 27, 2026
CavenX ("we", "our", or "us") provides an AI platform for educational institutions in India and internationally. This Privacy Policy explains how we handle personal data when you use our website, applications, institutional workspaces, AI services, and communication channels and rooms.
Commercial Services: When a school, university, or college deploys CavenX, the institution is typically the data controller for student, faculty, and staff data. CavenX acts as a data processor under the institution's direction. Institution-specific policies may also apply.
End-to-end encryption: Communications between students, teachers, and non-teaching staff in CavenX channels and rooms are end-to-end encrypted by default. We cannot read the content of those messages. See our Security Policy.
1. Collection of Personal Data
We do not sell or share your personal information. We do not run advertising on our website or app, and we do not use your data for behavioural advertising.
Data you provide
- Identity & contact: Name, email, phone, role (student, teacher, faculty, admin), institution affiliation
- Account & profile: Login credentials, preferences, institution provisioning data
- Payment: Billing details for optional individual student or scholar subscriptions only. Card and UPI payments are processed by Razorpay; CavenX does not store full payment credentials on its servers.
- AI inputs & outputs: Prompts, assignments, research queries, and generated responses used within the platform
- Communications metadata: For E2E channels and rooms — delivery metadata only, not message content
- Support & feedback: Messages you send to our team
Data collected automatically
- Device & technical: IP address, browser, device type, operating system, time zone
- Usage: Features used, pages viewed, session timestamps, error logs
- Cookies: Essential cookies only by default. Market selection changes the regional URL and is not stored in a preference cookie. Analytics and site-measurement technologies are loaded only after you opt in via the Privacy Settings control (shown on your first visit and available anytime in the site footer), where you can accept, reject non-essential, or manage choices at any time. We honor Global Privacy Control (GPC) opt-out signals as a “reject” choice.
2. Uses of Personal Data
We use personal data only where permitted by applicable law, including:
- Contract: To provide, maintain, and secure the Services for institutions and users
- Legitimate interests: To improve reliability, prevent abuse, and protect platform security — balanced against your rights
- Consent: For optional marketing or features requiring explicit opt-in
- Legal obligation: To comply with law, regulation, or valid legal process
Zero-training guarantee: CavenX does not use institutional data, student inputs, faculty research, or AI outputs to train public AI models — contractually guaranteed with every model provider.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Provide AI, workspace, and institutional features | Identity, inputs/outputs, institution data | Contract |
| Deliver E2E communications infrastructure | Metadata, keys, account data — not E2E message content | Contract |
| Process optional individual subscriptions | Payment, identity | Contract |
| Security, fraud prevention, Trust & Safety | Technical logs, reports, metadata | Legitimate interests / legal obligation |
| Product improvement (aggregated analytics only) | De-identified usage statistics — never institutional content | Legitimate interests |
We do not use identifiable institutional or student inputs/outputs for model training. Limited exceptions apply only where you explicitly opt in, or where de-identified safety-review materials are required to enforce our Terms — never for training public models on institutional data.
3. How We Disclose Personal Data
We may disclose personal data to:
- AI model providers: To route requests — under contractual zero-training and data-processing agreements
- Infrastructure providers: India-hosted hosting, storage, and security vendors
- Your institution: Where CavenX is deployed under institutional administration
- Professional advisers: Lawyers, auditors, insurers under confidentiality
- Legal requirements: Courts, regulators, or law enforcement when required by valid process
- Corporate transactions: Merger or acquisition, with notice where required
We do not sell personal data.
4. Rights and Choices
Depending on your location, you may have rights to:
- Access and receive a copy of your personal data
- Correct inaccurate data
- Delete data (subject to institutional and legal retention requirements)
- Object to or restrict certain processing
- Withdraw consent where processing is consent-based
- Data portability where technically feasible
Submit requests to privacy@cavenx.com. We may verify your identity before responding. Institutions may administer requests on behalf of their users.
5. Data Transfers
For Indian institutions and Indian residents, personal data is stored and processed exclusively within India in compliance with the DPDP Act, 2023. We do not transfer Indian institutional or student data outside India without a valid legal basis and appropriate safeguards.
For users outside India, data may be processed in India or other jurisdictions with appropriate contractual protections.
6. Data Retention & Security Controls
We retain personal data only as long as necessary to provide the Services, comply with law, resolve disputes, and enforce agreements. Institutions may request deletion subject to contractual and legal requirements.
Aggregated or de-identified analytics may be retained longer. Such data cannot reasonably identify individuals or institutions and is never used to train public AI models on institutional content.
7. Security
We implement TLS 1.3, AES-256 at rest, access controls, monitoring, and institutional data isolation. Channels and rooms use end-to-end encryption by default. Details are in our Security Policy.
8. DPDP Act 2023 — Supplemental Disclosures for India
These disclosures apply to residents of India and institutions deploying CavenX in India, read together with the rest of this Policy. Where there is a conflict for Indian users, this section prevails.
CavenX complies with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) from day one of deployment.
| Requirement | How CavenX Implements It |
|---|---|
| Consent-driven data handling | Explicit consent for students and staff. Parental consent for minors under 18. |
| Data minimization | Only necessary academic and institutional data collected — no surplus profiling. |
| Right to erasure | Students, faculty, and institutions can request complete deletion at any time. |
| Data localization | 100% inference, storage, and backups within Indian jurisdiction. |
| Zero-training guarantee | Institutional and student data never used to train public AI models — contractually guaranteed with every model provider. |
| Institutional data ownership | Schools, universities, and colleges retain absolute ownership. CavenX claims no rights. |
Indian users may contact our Grievance Officer at privacy@cavenx.com for DPDP-related requests.
9. Supplemental Disclosures for Canada
Canadian residents may have additional rights under applicable provincial privacy laws. Contact privacy@cavenx.com to exercise rights or withdraw consent. We will respond as required by applicable Canadian law.
10. Supplemental Disclosures for Brazil
Brazilian residents may have rights under the LGPD. Contact privacy@cavenx.com to exercise applicable rights. Our legal bases and retention practices described above apply equally to Brazilian users unless local law requires otherwise.
11. Changes to This Policy
We may update this Privacy Policy. Material changes will be posted on this page with an updated date. Continued use after changes constitutes acceptance where permitted by law.
12. Contact Information
Privacy inquiries: privacy@cavenx.com
General contact: hello@cavenx.com
Registered office: CavenX, Gorakhpur, Uttar Pradesh, India 273007