Privacy Policy

AI Tathastu is a platform focused on AI and machine-learning learning journeys, skills intelligence, evidence-based learner profiles, projects, academic records and career development. This Policy describes processing connected with the AI Tathastu website and features expressly named here. Separately operated products, including independent learning, meetings, examination or recruiting products, need their own or expressly coordinated notices and operator disclosures. Institutional customer arrangements may have additional notices.

Depending on what you choose to use, we may process (a) account and authentication identifiers; (b) name, contact details, school/university, course, academic dates, marks and degree; (c) uploaded resumes and their document text, OCR and hyperlink evidence; (d) technical skills, employment, internships, projects, books, research, awards and certifications; (e) public account links and permitted imports from technical or research platforms; (f) learning goals, lesson progress, assessment results and interaction with EORA; (g) consent choices, reviews, source-verification history and audit events; and (h) necessary session, device, server and security information. We do not request unnecessary identity documents or sensitive third-party data for routine CV uploads. Information present in a CV can include data you did not intend to provide; review and minimize it before upload.

Data may come from you, an uploaded file, your institution acting within its agreed role, an authorized connected account, a permitted public API or a technical service. We use it to operate accounts, parse and organize CVs, provide reviewable suggestions, verify evidence where requested, support AI/ML learning recommendations, connect authorized public profiles, provide security and customer support and satisfy applicable obligations. Where specific optional processing requires consent, we will provide a separate, specific choice. Not all features or integrations are active for every account.

Text-native PDF/DOCX processing and selective OCR can operate without an external generative model. Uploaded files and processing artifacts may be stored before a student reviews suggestions. Extraction does not establish truth or ownership. Candidate fields remain separate from student-confirmed and independently verified information. See Resume Processing Notice.

If you separately authorize eligible AI-assisted features, selected text, prompts or contextual information may be sent to an approved AI vendor. Vendors have different training, retention, age and transfer terms; some configurations may be unsuitable for personal CV data. No blanket 'never used for training' statement is made until the actual vendor, account tier and contract are confirmed. We will not treat a general CV upload checkbox as permission for external AI. See AI Processing Notice.

A URL discovered in your resume is a reference, not a connected account, verified identity or permission to scrape. Additional retrieval requires the applicable per-provider authorization and a permitted technical method. Only requested, permitted fields should be fetched; other people's personal information may be redacted or excluded. See Digital Sources Notice.

The application uses or is configured for hosting/infrastructure such as Vercel, a Python document extractor on Render, Neon PostgreSQL and optional Upstash Redis. Depending on active functions, authorized recipients may include OAuth providers, cloud infrastructure, email/support service providers and explicitly selected AI providers. Possible configured AI vendors include Groq, Cerebras, Google Gemini, OpenRouter, Mistral and SambaNova. Actual recipients, geographic regions, contracts, subprocessors and retention depend on verified deployed settings and must be listed in the Service Provider Register. Processing outside India may occur; applicable transfer restrictions will be assessed.

We use necessary authentication/session mechanisms and may store theme or preferences in browser storage. Analytics, advertising, preference or third-party cookies must be specifically inventoried before being described as active. You can review controls in Cookie Policy and Cookie Settings. Nonessential technologies requiring permission are not enabled before that permission.

Uploaded CVs are not automatically made public. A profile's visibility to faculty, institution administrators, mentors, recruiters or other users depends on the feature and your applicable sharing arrangement. Disclose the audience before access is enabled. We do not describe personal data as 'sold' or 'never shared' without verifying actual practices. We may disclose information when lawfully required and record the basis and scope.

We retain each category only as needed for its stated purpose and applicable legal or security requirements. The applicable periods, deletion triggers, processing copies, backups and exceptions will be provided in Retention and Deletion, after auditing live storage. Withdrawal may stop future optional processing but cannot reverse a past completed inference or erase other parties' independently held records. Legal/security records may be retained when required.

We apply appropriate organizational and technical safeguards, including authenticated access, separation of users and institutional scopes, secret management, validation of uploaded documents and secure access to external services. These practices must be checked against the current deployment; no online system is guaranteed to be completely secure. See Security.

India's DPDP framework treats persons under 18 as children for applicable provisions. Age-aware processing, legally required verifiable parent/guardian authorization and restrictions on tracking/behavioural monitoring or targeted advertising must be implemented before their applicable commencement. Third-party model terms may restrict use in products likely accessed by minors. See Children and Guardian Notice.

Subject to applicable law and verified identity/authority, you can request access or information, correction, updating, erasure and grievance redressal, and withdraw particular optional permissions. Requests can be made via Privacy Requests or Awaiting Verification: email. Describe any legal exceptions and timeframe in the published rights process. Permissions may be independently revoked without disabling unrelated features where feasible.

We may revise this Policy and notify users of material changes as legally required. New incompatible or optional uses may require fresh permission. Contact Awaiting Verification: privacy contact to ask questions or make a request.