Privacy Policy

1. Introduction and Our Role

This Privacy Policy explains how MarshallRidge Consulting Private Limited ("ElevateU", "we", "us" or "our") collects, uses, discloses and protects your personal data when you use the ElevateU platform at https://www.marshallridgeconsulting.in. We are committed to handling your personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

For most purposes we act as a Data Fiduciary in respect of your personal data. Where we process personal data on behalf of an institution (for example, under an Institution licence), we act as a Data Processor for that institution. In this Policy, "you" refers to the Data Principal whose personal data we process.

2. Categories of Personal Data We Collect

• Account data: your name, email address, password and subscription/plan details.
• Profile data: information you provide about your education, college, field of study, interests and career preferences.
• Assessment data: your responses to psychometric self-assessments and the results, scores and reports generated from them (such as the Student DNA Report).
• Activity data: academics, skills, goals, wellness check-ins, resume content and your interactions with the AI counselor and other features.
• Usage and technical data: limited technical information such as device and browser type and approximate usage of features, used to operate and improve the Service.

3. How We Collect Personal Data

We collect personal data directly from you when you register, complete your profile, take assessments, use features or contact support. Some technical data is collected automatically as you use the Service. Where you use the Service through an institution, we may receive certain data from that institution.

4. Purposes of Processing and Lawful Basis

We process your personal data to provide and personalise the Service, including to deliver assessments and reports, power the AI counselor, track your progress, manage your subscription and respond to your requests. We also process data to maintain security, comply with law and improve the Service.

Our lawful basis for processing under the DPDP Act is primarily your consent, which you provide when you create an account and use the relevant features, and, where applicable, certain legitimate uses permitted by law. You may withdraw your consent at any time as described below; withdrawal does not affect processing carried out before withdrawal.

5. AI Processing

When you use the AI career counselor or other AI-powered features, your prompts and relevant context (which may include profile and assessment information) are transmitted to our third-party AI model provider, Google (the Google Gemini API), in order to generate responses. We share only the data reasonably necessary to provide the feature. You should avoid entering sensitive information you do not wish to be processed by the AI provider.

6. Where Your Data Is Stored

The ElevateU application currently stores most of your application data (including assessment answers, academics, goals and similar content) locally in your own web browser using browser local storage. Our backend services run on Cloudflare Workers infrastructure. As a result, much of your data remains on your device under your control, and clearing your browser storage may delete that data.

7. Sub-Processors and Disclosures

We engage trusted third parties to help us operate the Service. These include:

• Cloudflare — hosting and infrastructure (Cloudflare Workers).
• Google — AI model processing via the Google Gemini API.
• Our payment partner — processing of subscription payments.

We may also disclose personal data where required by law, to enforce our terms, or to protect the rights, safety and security of ElevateU, our users or the public.

8. Your Rights as a Data Principal

Subject to the DPDP Act, you have the right to:

• access a summary of the personal data we process about you and how it is processed;
• request correction and completion of inaccurate or incomplete personal data;
• request updating of your personal data;
• request erasure of your personal data where it is no longer necessary;
• nominate another individual to exercise your rights in the event of death or incapacity; and
• readily available grievance redressal in respect of our processing.

9. How to Exercise Your Rights

You can exercise most rights instantly and for free inside the app at Profile → Privacy & Data: download a full copy of your data (right to access & portability), correct your profile, set a nominee, or permanently delete your account and all associated data (right to erasure / withdrawal of consent).

You may also submit a request through the form on our Contact page, or by writing to our Data Protection Officer / Grievance Officer at contact@marshallridgeconsulting.in. We acknowledge requests on receipt and respond within 30 days. We may need to verify your identity before acting on a request.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or where required by law. Our standard retention schedule is:

• Account & profile data: for the life of your account. Accounts inactive for 36 months are automatically erased.
• On account deletion or withdrawal of consent: your account and all associated content are erased immediately (this cascade also removes them from our database).
• Security & audit logs: up to 24 months.
• Usage/analytics events: up to 18 months.
• Grievance & data-request records: up to 36 months (as proof of redressal).
• Transaction & invoice records: retained as long as required under tax and accounting law.

11. Security Measures

We implement reasonable technical and organisational security practices designed to protect personal data against unauthorised access, use, alteration or loss, consistent with the SPDI Rules. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children

The Service is intended only for users aged 18 years or older. We do not knowingly collect personal data from anyone under the age of 18. If you believe a person under 18 has provided us with personal data, please contact contact@marshallridgeconsulting.in so we can take appropriate action.

13. Cookies and Local Storage

We use cookies and browser local storage to operate the Service, remember your preferences and store application data on your device. For details, please see our Cookie Policy.

14. International Data Transfers

Some of our sub-processors (including Cloudflare and Google) may process data on servers located outside India. Where personal data is transferred outside India, we do so in accordance with applicable law, including any restrictions notified under the DPDP Act.

15. Grievance Officer and Data Protection Officer

In accordance with applicable law, you may contact the following officers regarding your personal data and any grievances:

Data Protection Officer

• Name: Data Protection Officer
• Email: contact@marshallridgeconsulting.in

Grievance Officer

• Name: Grievance Officer
• Email: contact@marshallridgeconsulting.in
• Address: Unit No. 52, 2nd Floor, C-39A, Gami Industrial Park, MIDC, Thane, Navi Mumbai, Maharashtra 400705, India

16. Changes to this Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where the changes are material, notify you through the Service.

17. Contact Us

For any questions about this Privacy Policy or our data practices, contact us at contact@marshallridgeconsulting.in.