1. DPDP Act 2023 Compliance & Data Fiduciary
In strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), College Karo operates as a lawful Data Fiduciary. We ensure total transparency, purposeful data minimization, and high-standard encryption for all student data.
Purpose Limitation: Personal information (Student Name, Email Address, Phone Number, State, and City) is collected during career counseling and is shared with authorized partner colleges and universities post-counseling solely to fill and process official admission forms, verify eligibility, and provide Bihar Student Credit Card (BSCC) Scheme Help & Guidance.
Zero Third-Party Advertising: We strictly DO NOT sell, rent, trade, or share your personal data with third-party advertisers, telemarketing agencies, or data brokers.
Institutional Admission Sharing: Student details (Name, Email, Phone number, and Location: State/City) are shared strictly and securely with verified partner colleges and universities following counseling for the sole purpose of completing college admission forms and enrollment.
2. Data Categories Collected & Shared
We adhere to strict data minimization principles and collect only necessary information required to facilitate higher education admissions:
Contact & Identity (Collected & Shared for Admissions): Full Name, Phone Number, Email Address, State, and City/District. Shared with designated colleges/universities after counseling to initiate and complete admission application forms.
Academic Preferences: Preferred course (B.Tech, BCA, MBA, BBA, Poly, etc.), current eligibility status, and college choices.
Financial Aid Inquiries: Bihar Student Credit Card (BSCC) Scheme Help & Guidance eligibility preferences and educational financial aid requirements.
No Sensitive Document Storage on App: College Karo does not require, upload, or store government ID cards (like Aadhaar/PAN) or original marksheets on public servers.
3. Your Rights as a Data Principal
As per Chapter III of India's DPDP Act 2023, you and your legal guardians hold enforceable rights over your personal data:
Right to Access (Section 11): You have the right to request a summary of personal data held by us and the list of partner institutions with whom it has been shared.
Right to Correction & Erasure (Section 12): You have the right to correct inaccurate data or request deletion of your account and personal records via the "Delete Account & Erase Data" button in Account Settings / DPDP Rights page. Upon request, your active session is revoked immediately, and all database records are permanently purged after a 30-day statutory retention period.
Right to Withdraw Consent (Section 6(4)): You can withdraw consent for counseling calls or WhatsApp updates at any time with immediate effect.
Right to Nominate (Section 14): You have the right to nominate any other individual to exercise your data rights in the event of death or incapacity.
4. Protection of Minors (Below 18 Years)
Under Section 9 of the DPDP Act 2023, the processing of personal data of students under 18 years of age is subject to heightened protections:
Parental/Guardian Consent: Application submissions for candidates below 18 must be made under the guidance and affirmative consent of a parent or legal guardian.
No Detrimental Processing: We never engage in behavioral tracking, profiling, or targeted commercial advertising directed at minors.
5. Grievance Redressal & Data Protection Officer
In accordance with Section 13 and Section 8(9) of the DPDP Act 2023, any data concern, grievance, or erasure request can be lodged directly with our designated Grievance Officer:
🛡️ Designated Grievance & Data Protection Officer
Officer Name:
Raushan Ravi (Founder & DPO)
Official Email:
Helpline Phone:
+91 99551 77661
Postal Address:
Ghutiya Mor, Chandauti Block, Gaya, Bihar (823001)
Resolution SLA:
Acknowledgment within 48h; resolution within 30 days.
6. Refund and Financial Policy
College Karo operates strictly as an informational and educational guidance platform. Please note the following regarding financial transactions:
No Financial Transactions: The College Karo application does not collect, receive, or process any college tuition fees, admission fees, or semester charges.
Direct Institutional Payments: All official fees must be remitted directly to the authorized accounts of the respective college/university.
Refund Governed by College Norms: Any refund or seat cancellation requests are governed exclusively by the policy and timetable of the institution where you secured admission.
7. Third-Party Services & Data Processors
College Karo uses the following trusted third-party services to operate the app. Each service has its own Privacy Policy and processes data under our instructions as Data Processors:
Google Firebase Analytics (Google LLC): Collects anonymous app usage data — screens visited, session duration, and device type — to improve app performance. No personally identifiable information (name, phone, email) is sent to Firebase Analytics. Firebase Privacy Policy →
Google Firebase Crashlytics (Google LLC): Collects crash reports, stack traces, and device state at the time of an app crash to help us fix bugs. Crash data does not include your name, phone, or email. Firebase Privacy Policy →
Supabase (Supabase Inc.): Serves as our secure backend database and authentication provider. Your profile data (name, phone, email, state, district) and admission application data are stored on Supabase's encrypted Postgres infrastructure hosted in Singapore (ap-southeast-1). Supabase Privacy Policy →
Google Sign-In (Google LLC): Used for secure one-tap authentication. We only receive your Google name and email from Google OAuth — no passwords are stored by College Karo. Google Privacy Policy →
Data Retention: Your profile and application data is retained for a maximum of 2 years from last activity, or until you request deletion (whichever is earlier). Anonymous analytics data is retained for 14 months per Firebase default settings. Crash logs are retained for 90 days.
8. Data Security & Encryption
We implement industry-standard security measures to protect your personal data:
Encryption in Transit: All data transmitted between the app and our servers uses TLS 1.2+ (HTTPS) encryption.
Encryption at Rest: Data stored in Supabase is encrypted at rest using AES-256.
Row-Level Security (RLS): Database access is strictly controlled — each user can only access their own data. Admin data access is restricted to authorized personnel only.
No Backup on Device: The Android app has
allowBackup=false — your app data is never backed up to Google Drive or third-party cloud without your explicit action.
Jurisdiction: Any legal disputes, claims, or regulatory notifications arising under DPDP Act 2023 shall be subject to the exclusive jurisdiction of the competent courts in Sherghati, Gaya - 824211, Bihar, India.