Privacy Policy

1. About This Policy

Oxbrivy ("we", "us", "our") operates the platform at oxbrivy.com that helps universities and graduate schools manage graduate-school applications. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000.

2. Data We Collect

We collect personal data you provide directly and data generated by your use of the platform:

• Account data — name, institutional email address, password (stored hashed), and role (administrator, reviewer).
• Applicant data — submitted application materials including personal statements, CVs, transcripts, score reports, and recommendation letters uploaded or emailed into the platform.
• Communication data — emails sent to or from your apply.oxbrivy.com inbox, including headers, body text, and attachments stored in our system.
• Usage data — IP addresses, browser type, pages visited, timestamps, and actions taken within the platform (collected via server logs and analytics).
• AI-generated data — structured summaries, scores, and tags generated by our AI models from submitted application materials.

3. How We Use Your Data

• To provide and operate the Oxbrivy platform and its features.
• To process, store, and display application materials for authorised reviewers.
• To send transactional emails and notifications related to the platform.
• To improve platform performance, fix bugs, and develop new features.
• To comply with legal obligations under applicable Indian law.
• To detect and prevent fraud, abuse, and security incidents.

4. Legal Basis for Processing

Under the DPDPA 2023, we process personal data on the basis of your consent (given when you create an account or submit an application) and our legitimate interest in operating a secure and reliable platform. Institutional administrators using the platform on behalf of a university may process applicant data pursuant to a separate data-processing agreement.

5. Data Sharing

We do not sell your personal data. We share it only with:

• Cloud infrastructure providers (Supabase for database and storage, Amazon Web Services for email and file storage, Vercel for hosting) — bound by data-processing agreements.
• AI model providers — we may send anonymised or pseudonymised application text to AI APIs for analysis; we do not share applicant names or contact details with AI providers unless necessary.
• Authorised institutional users — reviewers and administrators at the institution that submitted or received the application.
• Legal authorities — where required by law, court order, or to protect the rights and safety of our users.

6. Data Retention

We retain application data for the duration of the admissions cycle plus two years, unless a longer retention period is required by law or agreed with the institution. Account data is retained while the account is active and for 90 days after deletion. You may request earlier deletion (see Section 8).

7. Data Security

We implement industry-standard technical and organisational measures to protect personal data, including encryption at rest and in transit, role-based access controls, and regular security reviews. No system is completely secure; please notify us immediately at admin@oxbrivy.com if you believe there has been a security incident.

8. Your Rights

Under the DPDPA 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Withdraw your consent to processing (where consent is the legal basis).
• Request erasure of your personal data, subject to legal retention obligations.
• Nominate a person to exercise your rights on your behalf.
• File a complaint with India's Data Protection Board.

To exercise any of these rights, email us at admin@oxbrivy.com. We will respond within 30 days.

9. Cookies and Tracking

We use strictly necessary session cookies to keep you logged in and to protect against cross-site request forgery. We may use analytics cookies to understand aggregate platform usage. You can disable non-essential cookies in your browser settings.

10. Children's Privacy

Oxbrivy is intended for use by adults (18 years and older). We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via a notice on the platform or by email. Continued use of the platform after a change constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or complaints:
Oxbrivy
Email: admin@oxbrivy.com
Website: oxbrivy.com