Global Privacy Policy & Cookie Policy

1. Overview, Role & Data Ownership

edvora.chat (“Edvora”, “we”, “us”, or “our”) provides an enterprise AI admissions conversion platform built for colleges, universities, and post-secondary educational institutions (“Institutional Partners”).

Under global data protection legislation (including the UK GDPR, EU GDPR, Canada PIPEDA, and US State Privacy Laws), our Institutional Partner is the Data Controller who determines what prospective student inquiries to solicit, while Edvora acts as the Data Processor / Service Provider that processes data strictly on the institution's documented instructions.

2. Cookie Policy & Consent Management (US, UK, Canada & Global)

We implement a multi-jurisdictional consent management framework. For visitors from the UK, EU, and Canada, non-essential cookies and tracking scripts are blocked by default until explicit prior consent is granted. For visitors from the United States, we provide clear notice at collection and immediate opt-out rights.

3. FERPA Higher-Education Data Protection & Tenancy Isolation

For US institutions subject to the Family Educational Rights and Privacy Act (FERPA, 34 CFR Part 99):

• School Official Status: Edvora acts as a designated “School Official” with legitimate educational interests, performing admissions advising and inquiry services that would otherwise be handled by institutional staff.
• Direct Control: Edvora operates under the direct control of the college with respect to the use, maintenance, and deletion of education records and applicant inquiry files.
• Row-Level Tenant Scoping: All database queries strictly enforce isolation (WHERE organization_id = ?). Student records from University A are mathematically inaccessible to University B.

4. Zero Foundation Model Training Guarantee

We provide an absolute contractual guarantee: Your institution's uploaded course catalogs, viewbooks, fee tables, and student conversational transcripts are NEVER used to train, refine, or fine-tune public AI foundation models (e.g. OpenAI, Anthropic, Google). All AI inference occurs through zero-data-retention enterprise API endpoints.

5. US State Privacy Disclosures (CCPA / CPRA & State Acts)

Under the California Consumer Privacy Act as amended by the CPRA:

• No Sale or Sharing of Personal Information: Edvora does NOT sell personal information and does NOT share personal data for cross-context behavioral advertising.
• Global Privacy Control (GPC): Our web platforms and widgets honor automated GPC browser signals as an immediate opt-out of optional telemetry.
• Consumer Privacy Rights: Students and parents have the right to know what personal information is collected, request correction or complete erasure, and not be discriminated against for exercising their rights.

6. UK & EU GDPR Compliance (PECR, Art. 13 & 14)

• Lawful Basis: We process prospective student lead data under Consent (Art. 6(1)(a)) and Performance of a Contract / Legitimate Interests (Art. 6(1)(b)/(f)) for admissions dispatch.
• Data Subject Rights: Right to Access (Art. 15), Right to Rectification (Art. 16), Right to Erasure / Right to be Forgotten (Art. 17), and Right to Data Portability (Art. 20) in structured JSON/CSV format.
• Institutional Self-Service: Institutional administrators can fulfill erasure and export requests instantly via the Edvora College Console.

7. Canada PIPEDA & CPPA (Bill C-27) Compliance

Edvora complies with the 10 Fair Information Principles of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA): Accountability, Identifying Purposes, Meaningful Consent, Limiting Collection, Limiting Use, Disclosure & Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

8. Data Security, Encryption & Retention

All data in transit is encrypted using TLS 1.3. Institutional secrets, API keys, and database backups are encrypted at rest using AES-256. Student lead records are retained according to the retention window configured by the institution (defaulting to the duration of the active admissions recruitment cycle).

9. Privacy Inquiries & Data Protection Officer

For compliance inquiries, Data Subject Access Requests (DSAR), or to request a signed Data Processing Addendum (DPA), please contact: