Privacy Policy

StudyPermit.com ("StudyPermit.com", "Platform", "we", "us" or "our") is an education-technology and study-abroad services platform operated by Study Permit Dot Com, with its office at 4B/1, Tilak Nagar, New Delhi - 110018, India. The primary privacy contact is itteam@studypermit.com.

Depending on the activity and applicable law, StudyPermit.com may act as a Data Fiduciary for personal data processed for its own purposes, and may use Data Processors to perform services on its behalf.

Independent universities, lenders, payment providers, immigration authorities, government agencies and other third parties process data under their own legal obligations and privacy notices. Where such an organisation determines its own purposes and means of processing, its privacy practices are separate from ours.

• Identity & contact information: name, date of birth, gender where relevant, photograph, nationality, address, email, mobile number, passport details and other identifiers required for a requested service.
• Academic & professional information: schools, colleges, universities, marksheets, transcripts, certificates, degrees, test scores, academic history, gaps, employment history, CV, experience letters and professional qualifications.
• Application & immigration information: programme preferences, admission applications, offer letters, statements of purpose, visa or permit information, application status, travel or immigration history, refusals where relevant, and supporting documentation.
• Financial information: education-loan requirements, sponsor information, income or financial-support evidence, transaction information and other data reasonably required for a separately requested financial service.
• Technical & security information: IP address, device and browser data, session information, login events, timestamps, audit trails, security events and service logs.
• Communications & service records: enquiries, counselling notes, support requests, consent instructions and application-related correspondence.

• Create and maintain your student profile and account.
• Provide counselling, eligibility assessment and programme or institution recommendations.
• Prepare, review and facilitate authorised applications to educational institutions.
• Verify your identity, academic records and supporting documentation.
• Facilitate scholarships, education loans, visa or study-permit support, accommodation or other optional services you separately request.
• Provide customer support, communicate application status and resolve grievances.
• Protect accounts, prevent fraud, investigate security events and maintain auditability.
• Comply with applicable legal, tax, accounting, cybersecurity and regulatory obligations.
• Improve service quality and platform performance using appropriately limited data.
• Send promotional communications only where an appropriate legal basis and your choice exist.

Where processing is based on consent, we present the personal data requested and the specified purpose in clear, plain language. Consent requires a clear affirmative action and is not bundled with materially unrelated optional purposes.

You may withdraw consent at any time using the mechanism made available on the Platform. Withdrawal affects future processing based solely on that consent and does not invalidate processing already lawfully carried out. We may continue to retain information where required by law or where another lawful basis for retention applies.

StudyPermit.com may use algorithms or artificial intelligence to assist with programme matching, eligibility screening, document classification, information extraction, completeness checks and workflow recommendations. AI-assisted outputs are informational or operational aids and do not guarantee admission, scholarship, visa, loan, employment, work authorisation or permanent residence. Final decisions are made by the relevant independent institution or authority.

We disclose personal data only where reasonably necessary for the service you requested, for platform operations, or where permitted or required by law. Recipient categories may include:

• Universities, colleges and other educational institutions selected or authorised by you.
• Credential evaluation and document-verification providers.
• Banks, non-banking financial companies or education-loan providers where you separately request such assistance.
• Payment gateways and transaction processors.
• Cloud, communications, cybersecurity, CRM, analytics and other technology service providers acting under appropriate contractual controls.
• Professional advisers such as auditors, accountants and legal advisers, subject to confidentiality obligations.
• Government, regulatory, judicial or law-enforcement authorities where disclosure is legally required.
• Overseas institutions or service providers where an international transfer is necessary for the study-abroad service you expressly requested.

Study-abroad services may require personal data to be sent to organisations outside India, such as foreign universities or service providers you select. International transfers are limited to the relevant purpose and remain subject to applicable Indian law, including any restrictions or requirements notified by the Central Government.

Where the Digital Personal Data Protection framework applies, a person under 18 years of age is treated as a child unless a notified exemption applies. We obtain verifiable parental or lawful-guardian consent before processing a child's personal data where required, and do not undertake prohibited behavioural monitoring or targeted advertising directed at children.

Documents may be requested to:

• Assess academic eligibility and programme fit.
• Verify identity and qualifications.
• Prepare or validate authorised university or college applications.
• Identify missing admission requirements.
• Assess scholarship eligibility where requested.
• Prepare visa or study-permit support documentation where requested.
• Facilitate an education-loan application where separately requested.
• Protect the Platform and institutions against document fraud.

Documents may be uploaded by you, provided by an authorised parent or guardian, received from an educational institution or verification provider, or obtained through another lawful and disclosed source.

We may perform reasonable authenticity and consistency checks, including review for alteration, conflicting data, incomplete records, duplicate files or other indicators of irregularity. A verification check by StudyPermit.com does not guarantee acceptance by a university, government authority, lender or other independent recipient.

You are responsible for the authenticity and accuracy of the documents and information you provide. We may seek clarification, request replacement records, decline to submit a document reasonably suspected to be fraudulent, or suspend services where serious authenticity concerns arise. Student documents are accessible only to personnel and systems with a legitimate need for the relevant service, and download, export and external disclosure are limited and logged where technically appropriate.

We retain personal data only for as long as necessary for the specified purpose, our relationship with you, a legal obligation, a security need, a dispute requirement, or another lawful basis. Storage capacity alone is never a reason for indefinite retention. Our default retention schedule is:

Where a law, regulatory direction, contractual obligation or lawful government order requires a minimum period, we retain the necessary records for that period even if the operational purpose ends earlier. Deleted information may remain temporarily in protected backups until the normal backup cycle expires; backups are not restored for routine business use.

You may request deletion through the Platform or at itteam@studypermit.com. We may verify your identity and ask for your registered email, mobile number, application reference or another reasonable identifier to locate your account. Deletion may not apply where retention is required for legal compliance, fraud prevention, an active transaction, a government or legal requirement, defence of legal claims, or accounting/tax/audit obligations.

We maintain risk-based technical and organisational safeguards proportionate to the sensitivity and volume of personal data we process, including:

• Encryption: TLS/HTTPS for data in transit, with appropriate protection for sensitive data at rest and for encryption keys and secrets.
• Access control: role-based access, least privilege, strong authentication, multi-factor authentication for privileged users, and periodic access reviews.
• Document security: access to student files restricted by job function, with download and export permissions limited and logged where appropriate.
• Logging & monitoring: administrative actions, authentication events, consent events, API activity and security events are logged and protected against unauthorised alteration.
• Secure development: code review, dependency management, secret scanning and security testing ahead of material releases.
• Vendor security: processors are assessed by risk and bound by confidentiality, security, incident-notification and deletion/return obligations.

Under existing CERT-In directions, we report specified cyber incidents within six hours of becoming aware of them, maintain a designated point of contact, and retain ICT system logs for a rolling period of 180 days within Indian jurisdiction. Our incident-response process covers detection, containment, investigation, remediation, recovery and, where applicable, user and regulatory notification.

Subject to the commencement and applicability of relevant law, you may have rights to obtain information about how your data is processed, seek correction or updating, request erasure, withdraw consent, raise a grievance and make a nomination. Requests may be submitted through the Platform or to itteam@studypermit.com. Reasonable identity verification may be required before a request is fulfilled.

We use essential cookies for authentication, security and session management, and may use analytics or marketing technologies where appropriate notice and consent are provided. You are given a practical way to manage non-essential cookies and promotional communications.

Privacy and grievance matters may be submitted to:

This channel covers:

• Questions about how your personal data is processed.
• Correction, updating or erasure requests.
• Consent withdrawal or permission-management issues.
• Suspected unauthorised access, document misuse or security events.
• Account-access concerns or inaccurate records.
• Complaints about privacy notices, communications or service handling.

We aim to acknowledge a grievance within 3 business days and resolve ordinary matters within 30 days, subject to complexity and any shorter or longer period required by law. If you remain dissatisfied, further escalation may be available under applicable law.

India's Digital Personal Data Protection Act, 2023 and its 2025 Rules are being brought into force in phases, and some private-sector obligations are not yet operative. We have written this policy to already reflect that framework and will update it as further provisions come into effect.

This Privacy Policy may be updated to reflect changes in law, regulatory guidance, technology, integrations or services. We will communicate material changes through appropriate channels. Privacy questions may be directed to itteam@studypermit.com.