This Privacy Policy (“Policy”) governs the collection, processing, storage, use, disclosure, and handling of information in connection with the software platform, applications, and related services operated under the brand name ONETUZA, which is owned and operated by Mekhos AI Labs Private Limited, a company incorporated under the laws of India (“Mekhos”, “we”, “us”, or “our”). This Policy is framed in accordance with applicable laws of India, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 (“IT Act”), and all rules, regulations, notifications, and subordinate legislation issued thereunder, as amended from time to time.
For the purposes of this Policy, the educational Institution subscribing to, licensing, or deploying the Services (“Institution”) is designated as the Data Fiduciary within the meaning of the DPDP Act, as it determines the purpose and means of processing personal data relating to students, teachers, and other authorised users.
Mekhos AI Labs Private Limited, operating the platform under the brand name ONETUZA, acts as a Data Processor, processing personal data strictly on documented instructions received from the Institution and within the scope of contractual arrangements entered into with the Institution. Mekhos does not independently determine the purposes of processing personal data.
By accessing or using the Services, the Institution and its authorised users acknowledge and agree that personal data may be processed in accordance with this Policy and the Institution’s documented instructions. This Policy applies solely to data processed by Mekhos in the course of providing the Services and does not apply to third-party platforms or services not owned or controlled by Mekhos, even where such services may be integrated or referenced.
The Institution acknowledges and agrees that it is solely responsible for obtaining all consents required under applicable law, including Verifiable Parental Consent in respect of personal data relating to minors, prior to onboarding students or authorised users onto the Services. Mekhos assumes no responsibility or liability for the Institution’s failure to obtain such consent or to otherwise comply with its obligations as a Data Fiduciary.
In the course of providing the Services, Mekhos may process institutional identifiers, authorised user information, curriculum-linked academic records, student-generated academic work, timestamps, academic interaction logs, system access metadata, audit logs, and derived academic indicators, strictly in accordance with the Institution’s instructions. Such data may include personal data as defined under applicable law. Mekhos does not knowingly collect or process personal data unrelated to educational, institutional, or system-operational purposes.
All processing undertaken by Mekhos is limited to purposes necessary for the provision, operation, maintenance, security, and compliance of the Services, including enabling academic visibility for the Institution, supporting institutional review of academic progression, maintaining system integrity, responding to authorised institutional requests, and complying with applicable legal and regulatory requirements. Mekhos does not process personal data for advertising, behavioural targeting, commercial resale, or other non-educational exploitation.
Mekhos may generate and present academic indicators at a cohort or group level, where outputs are derived from aggregated academic interaction data and individual student identities are not exposed. These indicators are intended solely to assist the Institution in academic planning, resource allocation, and pedagogical oversight.
No automated processing performed by Mekhos is intended to produce legal or similarly significant effects on any individual student without human review and decision-making by authorised personnel of the Institution.
Individual academic judgments, interventions, or decisions remain under the sole authority of the Institution and its educators.
Mekhos may process personal data in identifiable or pseudonymized form solely for the purposes specified by the Institution. Where pseudonymization is employed, re-identification keys are subject to strict access controls and are used only to the extent necessary for service delivery in accordance with institutional instruction. Such pseudonymized data continues to be treated as personal data under applicable law.
Separately, Mekhos may generate anonymized datasets by permanently and irreversibly removing identifiers and destroying any means of re-identification, such that the Data Principal can no longer be identified by reasonable means. Only data that has undergone such irreversible anonymization shall cease to constitute personal data under applicable law.
The Institution acknowledges that Mekhos may retain, use, analyse, and further process such anonymized data for internal purposes, including platform improvement, system reliability, security, research and development, performance optimisation, and statistical analysis, and that no Data Principal rights shall subsist in respect thereof following anonymization.
Mekhos may employ automated and assistive technologies, including analytical and language-based systems, to support the formatting, summarisation, or presentation of outputs generated under institutional instruction. Such technologies operate solely as assistive mechanisms and do not independently determine academic outcomes or override institutional authority.
Data processed by Mekhos is stored using infrastructure hosted on Amazon Web Services (AWS), with servers located within India. Mekhos implements reasonable technical and organisational safeguards designed to protect data against unauthorised access, loss, misuse, or alteration. While Mekhos endeavours to maintain appropriate security measures, no system can guarantee absolute security, and liability is limited to the extent required under applicable law.
Mekhos does not sell, license, or trade personal data. Data may be disclosed only to authorised users of the Institution, to service providers acting under contractual confidentiality obligations, or where disclosure is required under applicable law, regulation, court order, or lawful governmental request. Mekhos may also disclose data where necessary to protect its legal rights to enforce contractual obligations.
Data is retained only for as long as necessary duration as is required to fulfil the purposes specified by the Institution, comply with legal obligations, or meet contractual requirements. Upon termination or expiry of the Institution’s agreement, data handling, retention, or deletion shall be governed by the applicable contractual terms and legal requirements.
Any requests from Data Principals, including requests for access, correction, erasure, or grievance redressal, shall be routed through and authorised by the relevant Institution. As a Data Processor, Mekhos shall not independently alter or delete academic records without documented instructions from the Institution.
This Policy may be amended from time to time to reflect changes in law, regulation, or operational requirements. Continued use of the Services following such amendments constitutes acceptance of the updated policy, subject to applicable law.
This Policy shall be governed by and construed in accordance with the laws of India, and subject to applicable statutory provisions, the courts located in Bengaluru, Karnataka, shall have exclusive jurisdiction over all matters arising out of or relating to this Policy or the Services.