Privacy Policy

Last updated: July 5, 2026

This Privacy Policy explains what personal data Aven Academy by Kartexa ("Aven", "we", "us") collects, why, how long we keep it, and the rights you have over it. It's written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, for visitors in the European Economic Area or UK, the General Data Protection Regulation ("GDPR") — the two frameworks that most directly apply to how we operate. If you're outside both regions, the same practices and protections described here still apply to you.

1. Who we are

Aven Academy is operated by Kartexa, based in Unnao, Uttar Pradesh, India. Under the DPDP Act we act as a Data Fiduciary for the personal data described below; under GDPR we act as the Data Controller. For any privacy question, correction, deletion, or complaint, contact us using the details in Section 11 — the same contact handles day-to-day support and privacy/grievance requests, since Aven is a small team without a separately staffed privacy office.

2. Information we collect

• Account information: if you create an Aven account, we store your name, email address, phone number, and a securely hashed password (we never store your password in plain text). You can sign in with that password, or, if you prefer, request a one-time code emailed to you instead.
• Contact details from the quiz flow: name, email address, and phone number, collected before you start the Career Finder or Stream Finder.
• Quiz responses: your answers to the Career Finder's personality questions and AI-generated simulation scenarios, and/or the Stream Finder's academic-interest questions, depending on which tool you use.
• Generated results: your 4-letter personality type and career report from the Career Finder, your recommended academic stream from the Stream Finder, and — if purchased — your Premium Career Suite report.
• Resume file & extracted content: if you use Resume Review, we store the file you upload and the text/data our system extracts from it, so we can generate and show you feedback. The uploaded file itself is automatically deleted after 3 days; the extracted text and your review (including ATS score) stay saved to your account indefinitely so you can revisit them anytime under Resume History.
• Location data — IP-based (always collected): when you submit the contact form, we automatically resolve your IP address to your approximate country, state/region, city, postal/PIN code, latitude and longitude, and time zone, using third-party IP-geolocation lookup services. This is not an editable field — it happens on our server, not something you type in. We use it to make career suggestions more locally relevant (for example, surfacing government-exam or region-specific careers) and to understand our audience.
• Location data — precise/GPS-based (only with your permission): your browser may separately prompt you to share your device's precise location. If you allow it, we resolve your city, state, country, postal code, and time zone from those coordinates and store it alongside the IP-based location. This is entirely controlled by your browser's own permission prompt — we never bypass it, and you can deny or revoke it any time in your browser's site settings without losing access to Aven.
• Device & technical data: IP address, internet service provider, device type, operating system, browser and its user-agent string, and timestamps — collected automatically for security, anti-abuse, and analytics.
• Email verification data: a temporary one-time code sent to confirm your email. We store only a hashed version with a short expiry — never the plain code — plus whether/when your email was verified.
• Report retrieval codes: if you use "Get my report back" to look up a previous report by email, we send a one-time access code to that email to confirm you own the inbox before showing any results.
• Payment data: if you purchase a paid report, PayPal or Razorpay processes your payment directly — we never see or store your card, UPI, or bank details. We keep the transaction ID, amount, and timestamp for bookkeeping, receipts, and support.
• Partner program data: if you apply to Aven's partner program, we collect your name, email, and phone, verify your email with a one-time code before your application is reviewed, and — if approved — track referral activity and commission amounts tied to your unique link.
• Site analytics: basic, aggregate traffic data (page visited, referring page, device type, approximate timestamp) to help us understand usage. We do not use Google Analytics, Meta Pixel, or similar third-party trackers — this analytics data stays on our own servers.
• Cookies & local storage: we use a session cookie to keep you logged in, and your browser's local storage to remember your light/dark theme preference. We don't use advertising or cross-site tracking cookies.
• Abuse reports & contact messages: if you use Report Abuse or Contact Us, we store what you submit (and your email, if given) to review and respond.

3. Children's data

Aven's Career Finder and Stream Finder are widely used by students who may be under 18. Under the DPDP Act, anyone under 18 is legally a "child," and we're required to have a parent or guardian's awareness and consent before processing a child's personal data, and to never use a child's data for behavioral tracking or targeted advertising. In practice: our signup and quiz-entry forms ask you to confirm you're 18 or older, or that a parent/guardian is aware of and consents to your use of Aven. We don't run targeted advertising or behavioral tracking on anyone, of any age. If you're a parent or guardian and believe your child has used Aven without your awareness, contact us (Section 11) and we'll delete their data.

4. How we use your information

• To generate and show your personality type, career-match results, and Premium Career Suite report, tailored to your region where relevant.
• To create and manage your account, and let you log in and see your past reports.
• To process payments and deliver purchased reports.
• To review and manage partner applications and track referral commissions.
• To let our team review submissions through an internal, password-protected admin dashboard.
• To contact you about your results, or with relevant opportunities, where you've consented.
• To detect and prevent abuse of the service (spam, bots, fraud, payment abuse).
• To improve quiz content, AI prompts, and regional recommendations over time.

5. Legal basis for processing (GDPR)

If GDPR applies to you, we rely on: consent (the checkbox you tick before starting a quiz, creating an account, or applying as a partner — withdrawable any time via Section 11); contract (processing needed to deliver a report or service you've paid for); and legitimate interest (fraud/abuse prevention, basic site analytics, keeping the service secure) — balanced against your rights, and never used for anything you'd find surprising or intrusive.

6. How your data is processed by AI

To generate your simulation scenarios and career report, your personality type, dichotomy scores, scenario answers, and general country/region (not your precise coordinates, name, email, or phone number) are sent to a third-party AI processing partner, so results are culturally and regionally relevant. We don't publicly name our AI infrastructure providers, as this is proprietary to our service, but our data-handling commitments in this policy apply regardless of which partner is in use. AI-generated output can be wrong or incomplete — see our Terms of Service for details.

7. Where your data is stored & international transfers

Our servers and primary database are located in India. Some of our infrastructure providers — including our AI processing partner, email delivery, and payment gateways (PayPal, Razorpay) — may process data on servers outside India, including in the United States or European Union, as part of their standard global operations. Where we transfer personal data internationally, we rely on the receiving provider's own compliance framework (such as standard contractual clauses, where applicable) and only share the minimum data necessary for that provider to do its job — for example, our AI partner receives your quiz answers and general region, never your name, email, phone, or precise location.

8. How long we keep your data

We keep account, lead, and report data for as long as your account is active, plus a reasonable period afterward for legal, tax, and dispute-resolution purposes (typically up to 7 years for payment/financial records, consistent with Indian tax record-keeping requirements). Verification codes are deleted automatically shortly after they expire (within 15 minutes of being sent) or are used. If you request deletion (Section 10), we erase or anonymize your data within a reasonable time, except where we're legally required to retain specific records (e.g. completed payment records for tax purposes).

9. Who we share your data with

• Service providers acting on our behalf (Data Processors under both DPDP and GDPR): our hosting provider, email delivery provider, AI processing partner, and payment gateways (PayPal, Razorpay) — each only receives the data it needs to do its specific job.
• Partners, only in aggregate, anonymized form (e.g. "3 referrals converted this month") — never your name, contact details, or quiz answers.
• Legal authorities, if required by valid legal process, or to protect the rights, safety, or property of Aven or our users.
• We do not sell your personal data, to anyone, ever.

10. Your rights

If the DPDP Act applies to you (you're in India, or Aven is offering you goods/services), as a Data Principal you have the right to: access a summary of the personal data we hold about you and how it's processed; correct or update inaccurate or incomplete data; erase data that's no longer needed for the purpose it was collected; withdraw consent at any time, as easily as you gave it; nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and file a complaint with us first, and if unresolved, with the Data Protection Board of India.

If GDPR applies to you (you're in the EEA or UK), as a Data Subject you additionally have the right to: restrict how we process your data in certain circumstances; receive your data in a portable, machine-readable format; object to processing based on legitimate interest; not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (note: Aven's AI-generated career report is a suggestion for your own reflection, not an automated decision made about you — nothing is decided or withheld from you based on it); and lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us using Section 11, or — for account deletion specifically — use the "Request account deletion" button on your Profile page. We respond to verified requests within a reasonable time, generally within 30 days.

11. Contact & grievance officer

For any privacy question, data rights request, or complaint, reach us at: Tap to reveal privacy/support email
or on WhatsApp: +91 95599 96399.

This same contact serves as our Grievance Officer / point of contact under the DPDP Act. If you're not satisfied with our response, DPDP Act complaints can be escalated to the Data Protection Board of India, and GDPR complaints to your local supervisory authority.

12. Security

We use industry-standard measures to protect your data: passwords and verification codes are stored as one-way hashes, not plain text; connections to Aven are encrypted (HTTPS); payment details are never handled or stored by us directly; and access to the admin dashboard is restricted and password-protected. No system is 100% secure, but we take reasonable, ongoing steps to keep your data safe and will notify affected users and, where legally required, the Data Protection Board of India, of any breach that poses a real risk to you.

13. Changes to this policy

We may update this Privacy Policy from time to time as our service or the law evolves. Material changes will be reflected in the "Last updated" date above, and where appropriate, we'll notify registered users directly.