Privacy Policy

1. Introduction

Cravex ("we", "us", "our") operates a WhatsApp-based college assistant platform for VTU-affiliated engineering colleges. This Privacy Policy explains how we collect, use, and protect information when you use our service.

By using Cravex, you agree to the collection and use of information as described in this policy. We do not sell, rent or trade personal information to third parties.

2. Information we collect

We collect information necessary to provide the service:

• WhatsApp phone number (used as your unique identifier)
• Name, branch, division and semester (provided during registration)
• Messages sent to the bot (processed to generate responses)
• Attendance records uploaded by teachers
• Internal marks entered by teachers
• Voice note transcriptions (processed, not permanently stored as audio)
• USN (University Seat Number) if provided by your teacher

3. How we use your information

• To provide AI-powered responses to your academic questions
• To display your attendance and marks when you request them
• To calculate and display your academic risk score
• To send college announcements broadcast by your teachers
• To alert parents when attendance falls below VTU's 75% threshold
• To improve the accuracy of our AI responses via response caching

4. WhatsApp and Meta

Our service operates through the WhatsApp Business API provided by Meta Platforms, Inc. Messages sent to Cravex are transmitted through Meta's infrastructure. Meta's own privacy policy governs your use of WhatsApp. We only process message content to generate responses and do not share message content with third parties beyond what is necessary to operate the service (e.g. Google Gemini AI for generating responses).

5. Third-party AI services

We use Google Gemini AI to generate responses, transcribe voice notes, and extract text from uploaded documents. Message content may be sent to Google's API for this purpose. Google's API data usage policies apply. We do not use your data to train AI models.

6. Data storage

Your data is stored on Supabase (PostgreSQL), hosted on AWS infrastructure in the ap-south-1 region (Mumbai, India). We retain your data for the duration of your college's active subscription. Attendance and marks records are retained for one academic year. Cached AI responses are retained for 90 days.

7. Data security

We implement industry-standard security measures including encrypted database connections, service role key authentication for all database operations, row-level data isolation between colleges, and rate limiting to prevent abuse. No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Student data and FERPA

Student academic records (attendance, marks, risk scores) are only accessible to the student themselves, their college's authorized teachers, and college admins. We do not share individual student data across colleges. Master admin access is limited to platform-level oversight only.

9. Parent notifications

If your teacher has linked a parent phone number to your account, that parent may receive automatic WhatsApp notifications when your attendance falls below 75% or your internal marks are below 60%. This is a feature explicitly enabled by your college administration.

10. Your rights

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Opt out of parent notifications (contact your college admin)

To exercise any of these rights, contact your college admin or email us directly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify colleges of significant changes via the broadcast feature. Continued use of the service after changes constitutes acceptance of the updated policy.