Data Deletion Policy

This Data Deletion Policy establishes the rights of EduVerse™ users to request erasure of their personal data, the procedures for processing such requests, retention exceptions, and the timeline for completion. This policy is compliant with GDPR Article 17 (Right to Erasure), the Indian IT Act 2000, and the Digital Personal Data Protection Act 2023 (DPDPA).

This policy applies to:

• All registered users (students, tutors, administrators) requesting personal data erasure
• All personal data collected and stored by EduVerse™ as detailed in EVP-DCP-01
• Data deletion requests received via self-service, email, or formal grievance channels

Upon a valid deletion request, the following data categories are permanently removed:

The following data is exempt from deletion and will be retained for the periods stated, notwithstanding a deletion request:

Consent records are never deleted as they form the legally binding audit trail of the User's clickwrap agreement per EVP-CLP-01. These records contain no ongoing personal risk as they are stored in an append-only, access-restricted collection.

Method 1 — Self-Service (Recommended)

For the fastest processing, use the in-platform account deletion flow:

1. Log in to your EduVerse™ account.
2. Navigate to Settings → Account → Privacy & Security.
3. Scroll to "Delete My Account" and click it.
4. Confirm your identity via password, passkey, or OTP.
5. Select a deletion reason (optional) and confirm.
6. You will receive an email acknowledgement within 24 hours.
7. Your account is deactivated immediately; full data purge completes within 30 days.

Grace Period: You may cancel a pending deletion by logging back in within 30 days.

Method 2 — Email Request

If you cannot access your account, submit a written request:

Email requests are processed within 14 business days of identity verification.

Method 3 — OAuth Provider Revocation

If you signed in via Google OAuth, also revoke third-party access:

• Google: myaccount.google.com → Security → Third-party apps → EduVerse → Remove access

Note: Revoking OAuth access does NOT delete your EduVerse™ data. You must also complete Method 1 or 2.

Before requesting deletion, you may request a machine-readable export of your personal data (GDPR Art. 20 — Right to Portability):

• Email er.chintanbhatt@gmail.com with subject: "DATA EXPORT REQUEST — [Your Email]"
• Data will be provided in JSON or CSV format within 30 days
• Includes: profile data, KYP data, session history, payment references, and progress records

To protect against unauthorised deletion requests, EduVerse™ requires identity verification for all deletion requests. Accepted verification methods:

• Authentication via the in-platform deletion flow (password/passkey)
• Government-issued photo ID (for email requests)
• Account ownership verification (access to the registered email address)

We will not process deletion requests where identity cannot be verified, to prevent malicious account deletion by third parties.