Privacy Policy

Effective date: 17 August 2026 · Last updated: 17 August 2026

This Privacy Policy explains how Educator by ChitraYantra (the “Service”), operated by ChitraYantra Technologies Private Limited, Kolkata, India (“we”, “us”), collects, uses, shares, and protects personal data in connection with the Service at educator.chitrayantra.com.

The Service is interview grooming for education institutes: a college or university runs a live AI interview as timed practice for its students and receives coaching feedback. Two groups of people are covered by this policy, and we address them separately below:

• Users: faculty members, institute administrators, and their team members who hold accounts and use the Service.
• Students: the students an education institute enrols in a practice interview session.

1. Roles: who is responsible for what

For user account data (your email, login, usage of the Service), we are the data controller.

For student data, the education institute that creates the practice session is the data controller: it decides which students sit an interview and why, it is responsible for the lawful basis and for telling students what runs during the session and what their institute will see, and we act as its processor on the same documented instructions. A practice interview is coursework feedback, not an employment decision, and no student result is ever sent to an employer by us.

If you are a student and have questions about why you were enrolled, the institute that enrolled you is your first point of contact. You can also reach us directly at privacy@chitrayantra.com and we will help route or fulfill your request.

2. Personal data we process

2.1 User account data (we are the controller)

• Account details: email address, hashed password (managed by our authentication provider), institute name and membership, and role within it (administrator or faculty). Accounts are provisioned by us on request rather than by public self-service sign-up, so the details we hold are the ones your institute gives us when the account is opened.
• Usage and security data: authentication events, IP address, rate-limit counters, actions taken in the app (e.g. creating a session), and administrative audit logs.
• Billing data: credit balances and credit consumption per institute.
• Communications: emails you send us at our contact addresses.

2.2 Student data (we are the processor)

• Identification: only what the institute enrols — the student’s name and the institute’s own reference for them (typically a roll number), together with the department and the year or semester the institute assigns to the session. We do not ask an institute for a student’s resume, and the interview itself identifies the student to the model by an opaque reference rather than by their roll number.
• Video interview data: the audio/video recording of the session, the interview transcript, a small number of sampled webcam still frames, and the derived advisory signals, including the “real-person” / liveness signal. It is not facial recognition or biometric identification, and it does not create or store a faceprint, voiceprint, or any biometric identifier used to identify a person.
• Delivery read (where the institute enabled it): an advisory score and a coaching note on how the student presented, covering what they said, how they sounded, visible engagement, posture and gestures, and consistency across the conversation. This is generated for teaching feedback, is shown only to the student’s institute, and never changes the score their answers earned. It is not facial recognition, creates no faceprint or voiceprint, and is not used to identify anyone. The institute is the data controller and is responsible for telling students that the analysis runs.
• Derived analysis data: the graded practice report: per-question feedback, competency readings, an overall score, and any note a faculty member adds. Students are never shown a score.

We do not independently collect information. We process only the data provided by institutes and students. We do not ask for, and our Terms prohibit users from submitting, special categories of data (such as health, religion, or sexual orientation).

3. Where student data comes from

Student data enters the Service only in these ways:

• A faculty member creates a practice session and shares the class link; a student registers with their name and the institute’s own reference for them.
• A student opens the session link and sits the interview, which produces the recording, transcript, and derived readings described above.

The course material a faculty member supplies (the written curriculum and any uploaded file) is used to generate the interview topics. It is teaching material, not personal data about a student. We never search for or profile students on our own initiative.

4. Purposes and legal bases

Automated decision-making: the Service produces advisory scores and reports; it does not make academic or placement decisions. Our Terms require that a human reviews any decision that affects a student.

4.1 Fairness

Our analysis and scoring are based on the interview the student actually gave, against the rubric built from the institute’s own course material. The Service does not use, and instructs its models to ignore, protected characteristics such as gender, race or ethnicity, age, religion, nationality, disability, marital or family status, or a profile photo.

5. Subprocessors and sharing

We share personal data only with the categories of service providers needed to run the Service:

• All subprocessors are bound by data-processing agreements. A current list of named subprocessors is available to customers and data subjects on request at privacy@chitrayantra.com.
• Our model providers (including the AI subprocessors that power the live interview, currently OpenAI and Google) are bound by agreements that prohibit using submitted data (including interview recordings, transcripts, and sampled frames) to train their models.
• We do not sell personal data, and we do not share it for cross-context behavioral advertising. We run no advertising trackers.
• We may disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy continues to apply to data collected before the change).

6. International transfers

Our subprocessors may process data in the United States and other countries. Where data about people in the EEA, UK, or Switzerland is transferred to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, as implemented in our agreements with each subprocessor.

7. Retention

• Student practice data: a practice interview belongs to the academic record its institute keeps. Recordings, transcripts, derived readings, and graded reports are retained while the institute’s account is active, and are deleted when the institute deletes the session or the student, when it asks us to delete them, or within 90 days of the account closing. An institute that wants a shorter, fixed window applied to its sessions can ask us to set one.
• Account data: retained while your account is active and deleted or anonymized within 90 days of account closure, except where we must keep records longer (e.g. billing and audit records required by law).
• Security and audit logs: retained for up to 12 months.

8. Security

• Every institute’s data is isolated by tenancy checks enforced in the application on every read and write: each request is resolved to the institute the signed-in user belongs to, and queries are scoped to it. One tenant cannot reach another’s records.
• Uploaded documents and interview recordings are stored in a private bucket, namespaced per institute, and served only through short-lived signed URLs.
• Practice-interview links are unguessable tokens, stored only as a hash, time-limited, and single-purpose.
• All traffic is encrypted in transit (TLS); data is encrypted at rest by our storage providers.
• Sign-in sessions expire one hour after sign-in and are not silently renewed, so an unattended or copied session cannot stay valid.
• Server-side credentials are never exposed to the browser; privileged administrative actions are recorded in an audit log.
• Access to production systems is limited to personnel who need it to operate the Service.

No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify affected controllers and authorities as required by law. Security researchers can reach us at security@chitrayantra.com.

9. Your rights

9.1 If you are in the EEA, UK, or a similar jurisdiction

You may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing, including processing based on legitimate interest;
• data portability;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Note that the Service is designed for human review and does not make academic or placement decisions;
• lodge a complaint with your supervisory authority.

For student data, requests are honored by, or in coordination with, the controlling institute. Email privacy@chitrayantra.com and we will respond within 30 days; if a request must be fulfilled by the controller, we will forward it and tell you who the controller is.

9.2 If you are a California resident

Under the CCPA/CPRA you have rights to know, access, correct, and delete personal information, and to opt out of “sale” or “sharing.” We do not sell or share personal information as those terms are defined in the CCPA. We do not use or disclose sensitive personal information for purposes requiring a right to limit. You will not be discriminated against for exercising your rights. Submit requests to privacy@chitrayantra.com; we may need to verify your identity before acting.

10. Cookies

The signed-in Service uses only the cookies it needs to function. There are no advertising cookies anywhere, and no analytics on any page that holds student data:

11. Minors

The Service is built for higher education, where students are usually adults, but an institute may enrol a student who is a minor under local law. An institute that does so is the data controller and is responsible for obtaining whatever parental or guardian consent its law requires, and for giving the notices that law requires, before the student sits an interview. Account holders must be 18 or older; the student sitting the practice interview does not hold an account.

If you believe a minor’s data has been submitted without the required consent, contact privacy@chitrayantra.com and we will delete it.

12. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced in the app or by email at least 14 days before they take effect, and the “Last updated” date above will change. Continued use of the Service after a change takes effect constitutes acceptance.

13. Contact

The Service is operated by ChitraYantra Technologies Private Limited, Kolkata, West Bengal, India, which is the data controller for user account data and the processor for student data.

Privacy questions and requests: privacy@chitrayantra.com
General contact: see our Contact page.