Data Collection Policy

This Data Collection Policy defines the categories of personal and non-personal data collected by EduVerse™, the legal basis and purpose for each collection, and the controls in place to ensure data minimisation, accuracy, and lawful processing in compliance with the Indian IT Act 2000, GDPR (for EU/EEA users), and COPPA (for users under 13).

This policy supplements EVP-PP-01 (Privacy Policy) and provides a granular technical inventory of all data points collected by the platform.

This policy applies to:

• All data collected through the EduVerse™ web application and APIs
• All user roles: visitors, students, tutors, and administrators
• All data collected automatically (technical/device data) and manually (form submissions)
• All personnel and third-party processors handling collected data

4.1 — Visitor Data (Pre-Registration)

4.2 — Account Registration Data

4.3 — Know Your Student (KYP) Onboarding Data

4.4 — Usage & Behavioural Data

4.5 — Payment & Billing Data

EduVerse™ clearly distinguishes between mandatory and optional data at point of collection.

• Mandatory: Refusal to provide mandatory data will prevent access to the relevant feature or service. Core registration data (name, email, grade, board) is mandatory for platform access.
• Optional: Optional data (e.g., profile photo, father/mother name) may be provided at the user's discretion and does not affect core service access.
• Consent-gated mandatory: Geolocation (EUWA §3) and timezone (EUWA §4) are mandatory as conditions of platform use, collected under explicit clickwrap consent.

EduVerse™ adheres to the principle of data minimisation: we collect only data that is adequate, relevant, and limited to what is necessary for the specified purpose.

• No collection of racial, ethnic, religious, or political data.
• No health or medical data collected unless voluntarily disclosed for disability accommodations.
• Payment card data never touches EduVerse™ servers — processed entirely by gateway SDKs.
• Analytics data is aggregated and anonymised before any internal reporting.

Data collection requiring explicit consent:

• Geolocation data (EUWA §3): Collected under clickwrap consent. Browser Geolocation API permission prompt is also displayed. Users may deny browser-level permission; the EUWA geolocation field will then capture approximate IP-based location only.
• Timezone data (EUWA §4): Collected automatically via Intl.DateTimeFormat API after EUWA consent.
• Face photo / biometric-class data: Collected with explicit in-app consent during KYP onboarding. Stored as profile image, not processed for biometric identification.
• Marketing communications: Opt-in only; separate consent required.

All data processors are contractually bound to process data only for specified purposes and to maintain appropriate security standards.

Users are responsible for keeping their account information accurate and up to date. EduVerse™ provides self-service profile editing for most personal data fields. For data that cannot be self-edited (e.g., Student ID, consent records), contact support.

This policy is reviewed annually or when significant changes to data collection practices are made. Changes that expand the scope of data collection require user re-consent via the EUWA mechanism. The revision history above documents all changes to this document.