Eduvgo Privacy Policy

Eduvgo is an AI-powered study abroad platform operated by Overseas Arena. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website (eduvgo.com), student dashboard, agent platform, CMS tools, and all related services (collectively, the "Services"). By using our Services, you agree to the practices described here.

This policy applies to all visitors, students, education agents, CMS administrators, and anyone interacting with our Services — including through our integrations with Meta (Facebook/Instagram), Google, HeyGen, and WhatsApp Business.

Company: Overseas Arena  ·  Platform: Eduvgo  ·  Website: https://www.eduvgo.com

Privacy enquiries: privacy@eduvgo.com  ·  General support: support@eduvgo.com

For all data-related requests — access, correction, deletion, or complaints — email privacy@eduvgo.com with the subject line identifying your request type. We acknowledge all enquiries within 24–48 business hours and respond fully within 30 days.

3.1 Information You Provide Directly

Students: Full name, email address, phone number, WhatsApp number, country of origin, academic qualifications (degree level, grades, GPA), standardised test scores (IELTS, TOEFL, GRE, GMAT, SAT, Duolingo, etc.), preferred study destinations and subject areas, budget range and funding preferences, and profile photo (optional).

Agents & Consultants: Full name, business name, email, phone, professional credentials and certifications, specialisation countries and subjects, billing details (processed by our payment provider — card numbers are never stored by us), and linked social media or website URLs.

All Users: Password (stored as a bcrypt hash — never plain text), messages sent through our platform, feedback and ratings submitted, and all support communications.

3.2 Information Collected Automatically

• Device & Technical Data: IP address, browser type and version, operating system, device type.
• Usage Data: Pages visited, features used, search queries within the platform, clicks, session duration, and navigation paths.
• Log Data: Server access logs, error reports, request timestamps, and referring URLs.
• Cookie Data: Session identifiers, authentication tokens, preference cookies, and analytics identifiers. See Section 9 for full details.

3.3 Information From Third Parties

• Google OAuth: Your name, email address, and profile picture when you sign in via Google.
• Meta (Facebook / Instagram): Campaign data, ad performance metrics, and lead form submissions when an agent connects their Meta Ads account. People who submit a Facebook or Instagram lead form have their name, email, and phone synced into the agent's Eduvgo CRM.
• Google Analytics 4 & Search Console: Website performance data accessed on the agent's behalf via OAuth when they connect these services. We do not retain copies beyond live API display.
• HeyGen: Avatar IDs and video outputs returned after agents upload images or video for AI avatar creation.
• WhatsApp Business: Lead WhatsApp numbers and messaging metadata when agents connect WhatsApp Business for lead communication.

Core Service Delivery

• Creating and managing your account and providing access to the Services.
• Matching students with programmes, universities, and countries based on academic profile, preferences, and budget.
• Generating AI-powered study abroad recommendations and Profile Evaluations.
• Facilitating communication between students and education consultants, including scheduling and booking management.

Agent & CMS Operations

• Processing agent subscription payments and managing billing cycles.
• Enabling Meta Ads campaign creation, management, lead form deployment, and lead syncing into the Eduvgo CRM.
• Providing analytics dashboards — Meta Ads performance, GA4, Google Search Console insights — within the agent's dashboard.
• Powering the AI Visibility Engine: sitemap generation, robots.txt management, llm.txt, and SEO tooling.
• Enabling AI video generation, avatar creation, and marketing content generation for agent campaigns.

Communication

• Sending transactional emails: account creation confirmation, password reset, booking confirmations, billing receipts.
• Notifying students of new programme matches, agent messages, and platform activity.
• Sending marketing communications to users who have opted in. Opt out at any time via "Unsubscribe" in any email, or by emailing privacy@eduvgo.com.

Safety, Security & Legal Compliance

• Detecting, preventing, and responding to fraud, abuse, and unauthorised access.
• Enforcing our Terms of Service and other legal agreements.
• Complying with applicable laws, regulations, and lawful government requests.
• Maintaining audit logs for security and dispute resolution purposes.

Improvement & Research

• Analysing usage patterns (using aggregated, de-identified data) to improve existing features and develop new ones.
• Monitoring platform performance and resolving technical issues.
• We do not use personal data from students, agents, or leads to train any AI model. All AI processing happens via third-party APIs under data processing agreements that prohibit training on customer data.

Where required by applicable law (GDPR, UK GDPR, India DPDPA 2023), we process personal data on these legal bases:

• Contract: Account creation, providing the Services you requested, and payment processing.
• Legitimate Interests: Security monitoring, fraud prevention, analytics on aggregated data, improving our Services, and direct marketing to existing users — where not overridden by your rights.
• Consent: Marketing emails, analytics cookies, AI avatar creation from your likeness or voice, and WhatsApp marketing. Consent may be withdrawn at any time without affecting prior lawful processing.
• Legal Obligation: Retaining financial records, responding to lawful government requests, and fulfilling statutory requirements.

Indian residents (DPDPA 2023): We process your personal data on the basis of consent or legitimate uses as defined in the Act. You have the right to access, correct, and erase your data, and to nominate a representative to exercise these rights on your behalf.

We do not sell your personal data to any third party, ever.

Between Students & Agents: When a student books a consultation or sends an enquiry, their name, contact details, and relevant academic profile are shared with the engaged agent. Students control which agents they contact.

Service Providers (Data Processors): We engage trusted vendors under written data processing agreements: Vercel (hosting), Anthropic / Claude API (AI features), HeyGen (video and avatar), Google (analytics and search), Meta (advertising platform), and our payment processor. None may use your data for their own purposes beyond providing the contracted service.

Legal Requirements: We may disclose data if required by law, court order, or governmental authority, or to protect the rights, property, or safety of Eduvgo, our users, or the public.

Business Transfers: In a merger, acquisition, or sale of assets, your data may transfer to the acquiring entity. We will provide at least 30 days' notice before your data becomes subject to a materially different privacy policy, and you will have the option to request deletion before the transfer.

7.1 Meta (Facebook & Instagram)

When an agent connects their Meta account, we access campaign data, ad sets, ad creatives, performance metrics, and lead form submissions on their behalf. People who submit a Facebook or Instagram lead ad form have their name, email, and phone synced into the agent's Eduvgo CRM. Agents are the data controllers for these leads; Eduvgo processes this data as their data processor. Meta's own data practices are governed by Meta's Privacy Policy.

7.2 Google Services

Google OAuth enables sign-in. GA4 and Search Console data is accessed via the agent's OAuth token for display in the Eduvgo dashboard. We do not retain or re-process this data beyond live display. IP addresses sent to GA4 are anonymised.

7.3 HeyGen (AI Video & Avatar)

Agents who create AI avatars upload images or video to HeyGen for processing. This data may constitute biometric data under applicable law and requires your explicit consent. You may withdraw consent and delete your avatar at any time via Settings → AI Studio → Delete Avatar. Contact HeyGen directly to confirm deletion from their servers.

7.4 WhatsApp Business

Agents can message leads via WhatsApp from within Eduvgo. Messaging is processed through Meta's WhatsApp Business Platform and is subject to Meta's WhatsApp Business Terms of Service. We store lead WhatsApp numbers and message delivery status within the agent's CRM.

AI Profile Evaluation: Student academic data is sent to Anthropic's Claude API to generate personalised programme recommendations. This data is used solely for your recommendations and is not used to train AI models. Students may clear evaluation history at any time: Profile → AI Profile Evaluation → Clear Evaluation History.

AI Content Generation: Agent prompts for image or copy generation are processed via AI APIs. Prompts and outputs are not retained for AI training purposes. Generated images are stored in the agent's account until deleted.

AI Avatar & Voice: Agents creating AI avatars submit images or video (biometric data) to HeyGen. This requires explicit consent. Consent may be withdrawn and the avatar deleted at any time. We do not share your avatar or voice model with any other user or third party without your explicit consent.

AI Visibility Engine: Generates robots.txt, llm.txt, sitemaps, and SEO recommendations for agents' websites. No personal student data is involved. The analysis uses the agent's own website URL and content configuration.

• Essential / Session Cookies: Authentication tokens, session management, CSRF security. Required for the platform to function. Cannot be disabled while using the Services.
• Preference Cookies: Store your display settings and dashboard preferences across sessions.
• Analytics (Google Analytics 4): Aggregate usage statistics to understand how visitors use the site. IP addresses are anonymised. Opt out via cookie banner or browser settings.
• Meta Pixel: Placed only on pages where an agent has configured Meta conversion tracking. Governed by Meta's cookie policy.

You can manage cookie preferences via the cookie settings link in our website footer. Disabling essential cookies will prevent you from logging in and using the platform.

• Student accounts & profiles: Duration of account + 30 days after deletion request is processed.
• Agent accounts & business data: Duration of account + 7 years (legal and financial compliance).
• Financial & billing records: 7 years from transaction date (statutory obligation).
• Meta Ads leads (CRM): Until deleted by the agent, or 30 days after account closure.
• AI avatar & voice data: Until consent is withdrawn + 30 days for deletion.
• Server & access logs: 90 days rolling.
• Marketing email consent records: Until unsubscribe + 7 years (consent audit trail).
• Backup copies: Deleted within 90 days of primary data deletion (backup rotation cycle).

• Access: Request a copy of all personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Ask us to permanently delete your personal data. See our Data Deletion Policy for the full process and any legal retention exceptions.
• Restriction: Ask us to pause processing while a dispute or review is pending.
• Portability: Receive your personal data in a structured, machine-readable format (CSV or JSON).
• Object: Object to processing based on legitimate interests — including direct marketing, which you may object to at any time.
• Withdraw Consent: Where processing is consent-based, withdraw at any time without affecting prior lawful processing.
• Automated Decisions: Request human review of any automated decision that significantly affects you.

To exercise any right, email privacy@eduvgo.com with "Data Rights Request — [Right Type]" as the subject. We respond within 30 days. EEA/UK residents may also lodge a complaint with their national supervisory authority.

Your data may be processed in countries outside your home country — including India, the United States, and the European Union — where our infrastructure providers and third-party processors operate. Safeguards include Standard Contractual Clauses (SCCs) for EEA/UK transfers, and Data Processing Agreements with all third-party processors (Anthropic, Google, Meta, HeyGen, Vercel).

Our Services are not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with data without parental consent, contact privacy@eduvgo.com immediately and we will delete it promptly. Students aged 16 and above may use our student features, reflecting the typical age range for international university applications.

We implement industry-standard security measures: TLS/SSL encryption for all data in transit; bcrypt hashing for passwords (never stored in plain text); role-based access controls restricting production system access to authorised personnel; API keys and credentials stored as environment variables, never in source code; and regular security assessments. In the event of a data breach likely to result in risk to your rights, we will notify you and the relevant supervisory authority within legally required timeframes. To report a security vulnerability, contact security@eduvgo.com.

We may update this Privacy Policy periodically. For material changes, we will notify registered users by email at least 14 days before changes take effect and post a notice on our website. The "Last Updated" date reflects the most recent revision. Continued use of our Services after the effective date constitutes acceptance of the revised policy.

Eduvgo Privacy Team — Overseas Arena
Email: privacy@eduvgo.com
Website: https://www.eduvgo.com
Response time: Acknowledgement within 24–48 hours; full response within 30 days.