Privacy Policy

1. Collection of Personal Data

We do not sell or share your personal information. We do not run advertising on our website or app, and we do not use your data for behavioural advertising.

Data you provide

• Identity & contact: Name, email, phone, role (student, teacher, faculty, admin), institution affiliation
• Account & profile: Login credentials, preferences, institution provisioning data
• Payment: Billing details for optional individual student or scholar subscriptions only. Payment processors and methods are shown at checkout; CavenX does not store full payment credentials on its servers.
• AI inputs & outputs: Prompts, assignments, research queries, and generated responses used within the platform
• Communications metadata: For E2E channels and rooms — delivery metadata only, not message content
• Support & feedback: Messages you send to our team

Data collected automatically

• Device & technical: IP address, browser, device type, operating system, time zone
• Usage: Features used, pages viewed, session timestamps, error logs
• Cookies: Essential cookies only by default. Market selection changes the regional URL and is not stored in a preference cookie. Analytics and site-measurement technologies are loaded only after you opt in via the Privacy Settings control (shown on your first visit and available anytime in the site footer), where you can accept, reject non-essential, or manage choices at any time. We honor Global Privacy Control (GPC) opt-out signals as a “reject” choice.

2. Uses of Personal Data

We use personal data only where permitted by applicable law, including:

• Contract: To provide, maintain, and secure the Services for institutions and users
• Legitimate interests: To improve reliability, prevent abuse, and protect platform security — balanced against your rights
• Consent: For optional marketing or features requiring explicit opt-in
• Legal obligation: To comply with law, regulation, or valid legal process

Zero-training guarantee: CavenX does not use institutional data, student inputs, faculty research, or AI outputs to train public AI models — contractually guaranteed with every model provider.

We do not use identifiable institutional or student inputs/outputs for model training. Limited exceptions apply only where you explicitly opt in, or where de-identified safety-review materials are required to enforce our Terms — never for training public models on institutional data.

3. How We Disclose Personal Data

We may disclose personal data to:

• AI model providers: To route requests — under contractual zero-training and data-processing agreements
• Infrastructure providers: India-hosted hosting, storage, and security vendors
• Your institution: Where CavenX is deployed under institutional administration
• Professional advisers: Lawyers, auditors, insurers under confidentiality
• Legal requirements: Courts, regulators, or law enforcement when required by valid process
• Corporate transactions: Merger or acquisition, with notice where required

We do not sell personal data.

4. Rights and Choices

Depending on your location, you may have rights to:

• Access and receive a copy of your personal data
• Correct inaccurate data
• Delete data (subject to institutional and legal retention requirements)
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Data portability where technically feasible

Submit requests to privacy@cavenx.com. We may verify your identity before responding. Institutions may administer requests on behalf of their users.

5. Data Transfers

For Indian institutions and Indian residents, personal data is stored and processed exclusively within India in compliance with the DPDP Act, 2023. We do not transfer Indian institutional or student data outside India without a valid legal basis and appropriate safeguards.

For users outside India, data may be processed in India or other jurisdictions with appropriate contractual protections.

6. Data Retention & Security Controls

We retain personal data only as long as necessary to provide the Services, comply with law, resolve disputes, and enforce agreements. Institutions may request deletion subject to contractual and legal requirements.

Aggregated or de-identified analytics may be retained longer. Such data cannot reasonably identify individuals or institutions and is never used to train public AI models on institutional content.

7. Security

We implement TLS 1.3, AES-256 at rest, access controls, monitoring, and institutional data isolation. Channels and rooms use end-to-end encryption by default. Details are in our Security Policy.

8. DPDP Act 2023 — Supplemental Disclosures for India

These disclosures apply to residents of India and institutions deploying CavenX in India, read together with the rest of this Policy. Where there is a conflict for Indian users, this section prevails.

CavenX complies with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) from day one of deployment.

Indian users may contact our Grievance Officer at privacy@cavenx.com for DPDP-related requests.

9. Supplemental Disclosures for Canada

Canadian residents may have additional rights under applicable provincial privacy laws. Contact privacy@cavenx.com to exercise rights or withdraw consent. We will respond as required by applicable Canadian law.

10. Supplemental Disclosures for Brazil

Brazilian residents may have rights under the LGPD. Contact privacy@cavenx.com to exercise applicable rights. Our legal bases and retention practices described above apply equally to Brazilian users unless local law requires otherwise.

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be posted on this page with an updated date. Continued use after changes constitutes acceptance where permitted by law.

12. Contact Information

Privacy inquiries: privacy@cavenx.com

General contact: hello@cavenx.com

Registered office: CavenX, Gorakhpur, Uttar Pradesh, India 273007