Privacy Policy

Account data: your name and email when you sign in with Google (we receive an authentication token, not your Google password).

Profile & goals: board, class/level, exam targets, profession, language, resume text and any details you add — used to personalise responses.

Conversations & memory: your chats, the durable facts and open commitments the Service learns from them, and proofs you submit for verification.

Usage data: queries, feature usage, device/browser type, and approximate region for security and rate-limiting.

Payment data: processed by Razorpay; we receive transaction status, never your full card number.

We do not ask for or auto-fill passwords, card numbers, Aadhaar, PAN, or other government identifiers through the agent. We do not knowingly collect data from children under 13. We do not run third-party advertising or sell your data.

To provide and personalise the Service (answers, plans, memory, proof verification), to operate the agent on pages you instruct, to process payments, to maintain security and prevent abuse, to comply with law, and to improve the Service. We rely on your consent and on legitimate, specified purposes under the DPDP Act.

Account, profile, conversation, and proof data are stored with Supabase(managed Postgres). Some preferences (e.g. local profile, memory cache) live in your browser's storage on your device. We use trusted processors strictly to run the Service:

· Microsoft Azure OpenAI and other model providers (Google, Anthropic) to generate responses — under enterprise terms where your data is not used to train their models;
· Razorpay for payments; · Vercel for hosting; · Pinecone for educational-content search. Connectors you add yourself are governed by their own providers.

Your prompts and the context needed to answer them are sent to AI model providers to generate a response. The agent additionally sends the page text and, when needed, a screenshot of the page you are acting on. This content is processed transiently to fulfil your request and is not used to train models or retained beyond what is needed to provide the Service.

If you choose to connect your Google account, EduAstra requests only the minimum access needed for the features you use: Google Calendar (to create and manage events you ask Astra to add) and, where enabled, Gmail compose (to create draft emails on your behalf — EduAstra never sends email automatically; you review and send every draft yourself).

We access this data only to provide those user-facing features at your request. Your Google access and refresh tokens are encrypted at rest (AES-256-GCM) and are never exposed to your browser or shared with third parties. You can disconnect Google at any time from Settings or at myaccount.google.com/permissions, which revokes our access and deletes the stored tokens.

Limited Use disclosure.EduAstra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train AI or machine-learning models, do not sell it, do not use it for advertising, and do not transfer or disclose it except as necessary to provide or improve the features you requested, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.

When you use Astra voice mode (/voice), we silently build a voice fingerprint via Azure Speaker Recognition so Astra can recognise you across sessions. Your voice profile is linked to your account and only used for speaker identification — never for training, advertising, or sale. You can delete your voiceprint at any time from Settings → Connections → Voice ID, which also deletes the profile from Azure. We also save short summaries of each voice session (topic, action you committed to, emotional snapshot) so Astra can recall what you discussed earlier — this is voice memory. You can wipe all voice memory at any time from the same screen.

When you tap camera or share screeninside Astra voice mode, we capture a snapshot every ~2 seconds while video is active and pass it to Astra so she can refer to what you're showing her (your code, a document, the world). Every frame is screened by Azure AI Content Safety before storage; frames flagged for hate, sexual, violence, or self-harm content are blocked and never reach Astra. Stored frames are hard-deleted after 7 days(both the image and the database row) by an automated job — this retention is fixed and not extendable. Camera and screen share are off by default; you control them with the buttons in the voice page and can stop video at any time. Frames are private to your account and never used for training, advertising, or sale.

If you opt in to WhatsApp delivery in Settings → Connections, we send a daily task to your registered number at the time you choose. Your phone number is stored encrypted at rest (AES-256-GCM) and only decrypted in memory at send time. We record the timestamp, source, and IP of your consent for DPDP / GDPR compliance. You can revoke consent at any time from Settings or by replying STOP on WhatsApp, which immediately stops outbound messages and marks your consent as revoked. Inbound replies are stored to grade your proof submissions and routed to the captain layer; we do not share them with third parties beyond the Meta WhatsApp Business infrastructure required to deliver and receive messages.

When a proof you submit passes verification it is saved to your private record. It becomes public only if you explicitly choose to publish it. You can keep records private, publish them, or delete them at any time.

We keep account, conversation, and record data while your account is active and for as long as needed for the purposes above or as required by law. You can delete chats, memory facts, open loops, and your profile from Settings; deleting your account removes associated personal data within a reasonable period, except where retention is legally required.

You have the right to access, correct, and erase your personal data, to withdraw consent, and to nominate a representative. Much of this is self-service in Settings; for anything else, email us and we will act within the timelines required by law. You may also raise a grievance with our contact below.

The Service is intended for users 18+, or 13–18 with verifiable parental/guardian consent and supervision. We do not knowingly process the data of children under 13; if you believe a child has provided data, contact us and we will delete it.

We use access controls, encryption in transit, row-level security on our database, and reputable infrastructure providers. No system is perfectly secure; we cannot guarantee absolute security, and you use the Service at your own risk to that extent.

Some processors operate outside India. Where data is transferred abroad, we rely on providers that offer appropriate safeguards, consistent with the DPDP Act and applicable rules.

We update this policy whenever the Service changes in a way that affects your data. The "Last updated" date will change and material updates will be highlighted on the Service.

For privacy questions, data requests, or grievances, contact our Grievance Officer at privacy@eduastraai.com (or support@eduastraai.com). We respond within the timelines required by Indian law.