Privacy Policy

1. Who we are

StudAI Edutech Private Limited operates Zolra and is the contact for personal-data processing described here. Our registered address and official support and grievance channels appear below. This policy explains practices; it is not a certification of regulatory compliance.

2. Scope

This policy applies to the Zolra website, accounts and platform services, including startup operating tools, network features, hiring, mentoring, fundraising and workspace workflows. Third-party websites, sign-in providers and payment services have their own privacy practices. Organization participants may also have responsibilities for information they contribute or receive.

3. Personal data we collect

What we hold depends on the features you use and information you provide. Categories include:

• Account identity: name, email, member type, authentication records, account status and verification information; phone and contact details where supplied.
• Professional profiles: bio, skills, education, career history, location, social links, resumes, portfolios and founder, mentor, investor or company information.
• Startup and workspace information: startup context, team information, goals, evidence, documents, roles, sharing permissions, incubator and program activity.
• Interactions: posts, connections, messages, job listings and applications, mentor bookings, session notes and actions, fundraising and Deal Room activity.
• AI and workflow information: prompts, selected context, generated outputs, recommendations, decisions, feedback and outcome records.
• Billing and support information: transaction identifiers, plan and subscription status, amounts, currency, billing records and support correspondence.
• Technical and usage information: IP addresses, device or browser details where recorded, access and error logs, product events, consent records and privacy preferences.

Do not submit sensitive or confidential information unless needed for the intended feature and permitted sharing context.

4. How data is collected

Data comes from you when you register, edit a profile, upload content, communicate or request support; from activity generated while using the service; from authorized workspace participants; and from service providers such as sign-in and payment providers. Google sign-in can provide identity information such as your name and email. Professional and social profile links are information you provide. Cookies and browser storage support sessions, preferences and selected application state.

5. Why we process data

• Account and authentication data: establish accounts, sign you in, recover access and secure sessions.
• Profiles and professional evidence: support discovery, matching, applications and relevant introductions.
• Startup and workspace context: provide operating tools, collaboration, permissioned sharing and progress workflows.
• Communications and mentor or hiring records: deliver the interactions you initiate and maintain their history.
• AI context and feedback: provide requested assistance, summaries and recommendations and evaluate those features.
• Transaction and subscription data: confirm payment, provide purchased access, reconcile records and resolve disputes.
• Technical events and support information: diagnose problems, prevent abuse, provide support and improve the service.
• Consent and legal records: manage choices and meet applicable legal, accounting and regulatory obligations.

6. AI processing and human control

AI-assisted features may process profile information, startup context, documents, messages or other workflow information relevant to the feature. Relevant context and prompts may be sent to external model infrastructure. Production AI processing uses AWS Bedrock with Anthropic Claude and Amazon Titan models; it is not accurate to say that all context remains only in Zolra's own database.

Context access depends on the feature and permissions. Human review remains important: outputs can be wrong and are not professional advice. Proposals and consequential workflow changes require the applicable human action rather than being automatically treated as accepted decisions. Avoid entering unnecessary personal data, trade secrets or payment credentials into prompts.

This policy does not promise that every AI input is anonymous or make an unconditional guarantee about model-provider retention or training. Provider terms and the applicable processing arrangement also govern model infrastructure.

7. Cookies and similar technology

Necessary authentication cookies, including server-managed httpOnly cookies and a session marker, help maintain sign-in and access checks. Browser local and session storage can remember preferences, selected workspaces, journey information and cached application state.

The cookie and storage notice only records that you have dismissed it. Dismissal neither grants consent to optional tracking nor controls authenticated first-party product events or error monitoring, which operate separately from the notice. The root application does not currently load third-party site-analytics trackers.

You can manage browser storage in your browser and supported visibility, messaging, email, search and matching preferences in Settings. These preferences do not provide a general analytics opt-out or disable required security and transaction records. Removing necessary session cookies may stop sign-in from working. See the Cookie Policy.

8. Payment information

Razorpay handles sensitive payment instrument details in its payment flow. We receive relevant transaction and subscription metadata to confirm payments, provide access, reconcile accounts and handle disputes. Our ordinary integration does not intentionally store complete card credentials, CVV, PIN or OTP. Never send these to support. Payment-provider privacy practices also apply; StudAI Edutech Private Limited remains the merchant providing Zolra services.

9. How personal data is shared

Data is shared as needed to operate the features you use, including with:

• AWS: production cloud hosting, database, caching, object storage and Bedrock AI processing.
• Razorpay: payment processing and associated reconciliation or disputes.
• SendPulse: configured SMTP delivery of service emails, with relevant recipient and message data.
• Google: authorized sign-in flows.
• Sentry: configured error and performance monitoring; technical event data may contain identifiers or contextual information and is not guaranteed anonymous.
• Other participants and authorized workspace users where a profile, application, communication, session or sharing action requires it.
• Authorities or professional advisers where needed for a lawful request, legal obligations, safety or dispute resolution.

A business transfer may require transfer of relevant service records subject to applicable law and notice requirements. We do not sell personal data as a product. Sharing for a requested service is distinct from selling data.

10. Profile and public visibility

Visibility depends on the resource and available controls: information may be private, visible to members or connections, or intentionally public. Profile fields, public startup or job listings and public posts can be seen by their intended audiences. Do not put confidential information in public fields. An action such as applying, messaging or sharing a document sends relevant information to its recipient. Settings cannot undo every recipient's prior access or copies already made.

11. Startup and workspace data

Team roles, resource permissions and explicit sharing govern access to startup and organizational data. Incubator participation and investor status do not automatically authorize access to confidential startup or Deal Room information. Paid plans are not permission to read private data. Workspace administrators and invited participants receive information according to their authorized role and the relevant collaboration. Consider both the audience and sensitivity before sharing.

12. Retention and account deactivation

We retain information as needed to provide the service, maintain security and handle legal, accounting or dispute obligations. Different records have different purposes; this is not a promise that every record is deleted immediately when you stop using the service.

Settings deactivation marks your account inactive; it does not itself anonymize or erase all personal data. A separate account-deletion process anonymizes base account identity, clears selected profile and knowledge fields, deactivates the account and invalidates sessions. Neither process immediately erases every role-specific record, workspace record, uploaded file, billing record, log or backup.

Scheduled cleanup rules target deactivated accounts after more than 30 days and AI conversations older than 180 days. Accounts with invoice, subscription, payment or policy-acceptance evidence are excluded from automatic account purge; those records are handled separately subject to applicable financial and legal obligations and data-rights requests. These are cleanup rules, not a guarantee that all jobs run successfully or that every associated record, file or backup is erased by those times. We do not promise a universal automated retention or backup-deletion schedule.

To request erasure of particular data or understand a retained record, contact us. We assess applicable legal obligations and any other participants' rights before removal.

13. Security measures and limits

We use measures such as password hashing, session controls, server-side access checks and restricted service access to reduce risk. Production services use AWS infrastructure; security also depends on configuration, operations and your account practices. No online system is risk-free. We do not claim end-to-end encryption, a particular encryption algorithm for every data store, or ISO, SOC, HIPAA or PCI certification. Report suspected security problems through our official support channel without accessing other people's data.

14. Your rights and controls

• Access and export: Settings provides Download My Data for a machine-readable JSON account export. It includes supported account-owned records, such as selected profile, activity, billing and session data and messages you sent. It is not a complete export of every role, workspace, uploaded object, received message, internal log, third-party record or backup; contact us for additional access requests.
• Correction: edit supported profile and account information, or contact us about records you cannot update.
• Preferences and consent: use the available privacy preferences in Settings or contact us to withdraw consent for a particular purpose. Withdrawal may limit the related feature and does not remove processing required by law or invalidate earlier lawful processing. Discovery and matching preferences do not disable all AI processing across the service.
• Deactivation and erasure: deactivate through Settings to stop account use. Request erasure, additional anonymization or clarification of retained data through support; Settings deactivation and complete deletion are not interchangeable.
• Grievances and other applicable rights: contact our designated grievance contact for a complaint or a request under applicable Indian data-protection law, including a nomination request where applicable.

Use supported notification preferences or unsubscribe links to stop the optional marketing updates covered by those controls. Necessary transactional and security emails may still be sent.

We may need proportionate identity checks before disclosing or changing personal data. We do not promise access to another person's private information or a particular outcome for every request. See Grievance Redressal for escalation.

15. Children's data and eligibility

The published service policy requires users to be at least 16; users under 18 must have parent or guardian consent. This is not a claim that Zolra currently collects a date of birth or operates a verified parental-consent system. Applicable legal protections for children remain relevant and may require further checks or restrictions. If you are a parent or guardian concerned about a child's account or data, contact us so we can investigate and address it under applicable law.

16. International processing

Production application infrastructure uses AWS ECS, RDS, ElastiCache and S3 in ap-south-1 (Mumbai, India). Bedrock processing uses us-east-1 (United States). Other providers may process relevant information outside India according to their infrastructure and service arrangements. Do not assume every record stays in India. International processing remains subject to applicable legal requirements.

17. Changes to this policy

The effective date, last-updated date and policy version above identify this policy. Material changes will be communicated as required, and additional consent will be sought where needed. A future change of legal operator must be treated as a legal and operational change, not as permission to silently rewrite historical transaction or consent records.

18. Privacy and grievance contact

For privacy requests, email the official contact with "Privacy request" in the subject. Share only the information necessary to identify the request.

For the complaint process and escalation, visit Grievance Redressal.