Privacy information
Privacy is part of the workflow, not a public profile.
This page explains the platform's intended information boundaries in plain language. It is not a substitute for a jurisdiction-specific privacy notice or legal advice. Before production use, the platform owner must publish verified controller details, retention periods, legal bases, contact channels and applicable rights procedures.
Information entered into a workspace
Depending on enabled features, a user may provide identity and contact details, academic history, test attempts, study preferences, application data, documents, consent choices and workflow notes. Staff and partner accounts also have membership, assignment and audit records.
Why the platform uses it
Information supports account security, student-owned records, admissions coordination, university review, consent-scoped referrals and lender-specific loan cases. The actual purpose must be limited to the role and workflow that needs the information.
Who may see it
Access is intended to require authenticated identity, an active role and organization membership, permission and record-level scope. Students do not see finance commission records. An agency or bank does not receive full student access merely because it has a referral or loan case.
Documents and sensitive data
Uploaded files are intended for private storage outside public web directories. Document version grants are explicit. Do not upload information that is not requested for an enabled workflow; production retention, deletion and backup policies must be configured and published.
Consent and access changes
Partner access may require a bounded student consent and, for files, a specific version grant. Withdrawal or expiry should stop future access through the relevant authorization checks. Audit history may be retained to explain prior access or decisions.
Security and service providers
Authentication and application data are designed around self-hosted services and MySQL. Email delivery may use the configured Zoho Mail/ZeptoMail integration; SMS remains unavailable until an actual provider is configured and verified. Secrets must remain in protected environment configuration.
Before production
The owner must complete and review a legally accurate notice covering the operating entity, jurisdictions, retention and deletion schedules, subprocessors, international transfers, data subject requests, breach handling and support contact. No legal compliance certification is claimed here.