Data & Compliance

EVISIONARY TECH WORKS PRIVATE LIMITED (EVIT) is committed to secure and responsible education technology. This page summarizes our approach to data governance, security, student privacy, and compliance. It complements our Privacy Policy and Terms of Use.

We design our policies with reference to applicable laws and recognized principles, including, where relevant:

• India’s Digital Personal Data Protection Act and its Rules;
• India’s Information Technology Act and intermediary obligations, where applicable;
• GDPR data-protection principles for users where applicable;
• contractual obligations with our service providers;
• education-sector privacy expectations.

We do not claim formal certification under any of these frameworks unless it has been independently verified.

Our governance practices include:

• data minimization — collecting only what we need;
• purpose limitation — using data only for stated purposes;
• access control and role-based access;
• audit trails for sensitive actions;
• retention controls and secure deletion.

Student learning records, assignment submissions, and progress data are handled with care. For minors, guardian involvement may be required. Tutor access is limited to the learners and courses they are assigned, and administrators provide oversight under least-privilege principles.

EVIT enforces a role-based access model:

• user — default role on signup;
• student — granted after trial approval/enrollment;
• tutor — access scoped to assigned classes and courses;
• parent — linked guardian access where enabled;
• admin — manages content, access, and operations.

The default signup role is user. The student role is granted only after approval, course access is controlled through enrollments, and administrators manage content and access. Authorization is enforced on the server and in the database.

Our security controls include:

• Supabase Auth for authentication;
• PostgreSQL row-level security (RLS) policies;
• server-side authorization independent of the client;
• secure, HttpOnly session cookies;
• private storage buckets with short-lived signed URLs for private files;
• audit logging of sensitive actions;
• protection of secrets via server-only environment variables.

We never expose service credentials to the browser, and we do not overclaim external certifications.

We store the following categories of data:

• profile and account data;
• course and curriculum data;
• learning progress;
• assignments and submissions;
• support requests;
• security and audit logs.

We work with the following categories of providers. “Planned” entries are not yet integrated and are shown for transparency.

Depending on provider infrastructure and legal requirements, some processing may occur outside India. Where this happens, we seek to ensure appropriate safeguards consistent with applicable law.

Our incident-response approach follows these stages:

• Detect — monitor for anomalies and security events;
• Investigate — assess scope and impact;
• Contain — limit further exposure;
• Notify — inform affected users/regulators where required;
• Remediate — fix the root cause;
• Document — record lessons learned.

You can request the following, subject to verification and applicable law:

• access to your data;
• correction of inaccurate data;
• deletion of your data;
• withdrawal of consent where applicable;
• grievance redressal.

Requests can be sent to privacy@evit.org.in and are routed to the appropriate team.

Data protection: privacy@evit.org.in. Grievance officer: grievance@evit.org.in.

Our compliance posture evolves with our product and the law. This page is reviewed periodically and must be validated by qualified legal counsel before being relied upon for regulatory or contractual purposes.