Privacy Policy

Effective date: 1 June 2025

This Privacy Policy describes how Hornbill Publications (“Oxbrivy”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you use our study-abroad advisory platform (“Service”). We are committed to protecting your privacy and complying with applicable data protection laws including the Digital Personal Data Protection Act, 2023 (India).

1. Information We Collect

a) Information you provide directly

• Account data: name, email address, phone number, date of birth.
• Academic profile: educational history, GPA, test scores (IELTS, TOEFL, GRE, GMAT, SAT), work experience.
• Study preferences: target countries, fields of study, degree level, budget range, scholarship needs.
• Documents: SOPs, CVs, LORs, and other application documents you create on the platform.
• Uploaded files: score reports, transcripts, and other documents uploaded to the Vault.
• Payment information: subscription transactions (card details are processed by Razorpay — we do not store them).
• Feedback and communications: messages, ratings, and support requests.

b) Information collected automatically

• Log data (IP address, browser type, pages visited, timestamps).
• Device information (operating system, device type).
• Usage analytics (features used, click events) via PostHog.
• Session data and cookies.

2. How We Use Your Information

• To provide, maintain, and improve the Service.
• To personalise program and scholarship recommendations using AI.
• To generate AI-assisted documents based on your profile.
• To send you service notifications, deadline reminders, and weekly digests (you may opt out at any time).
• To process subscription payments and manage billing.
• To respond to your support queries.
• To detect and prevent fraud and abuse.
• To comply with legal obligations.

3. Sharing of Information

We do not sell your personal data. We share data only with:

• Supabase — database and authentication infrastructure (EU/US data centres).
• OpenAI — AI processing for program recommendations and document drafting.
• Anthropic — AI processing for resume parsing.
• Razorpay — payment processing (PCI-DSS compliant).
• Resend — transactional email delivery.
• PostHog — privacy-safe product analytics.
• Legal authorities — when required by applicable law.

All third-party processors are bound by data processing agreements.

4. Data Retention

• Active accounts: data retained for the duration of the account plus 2 years.
• Deleted accounts: personal data permanently deleted within 30 days of deletion request, except where retention is required by law.
• Payment records: retained for 7 years as required by Indian tax law.
• Uploaded documents: retained until you delete them or your account is closed.

5. Your Rights

Under applicable data protection law (including India's DPDPA 2023), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your account and personal data.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — opt out of marketing communications at any time.
• Grievance redressal — raise a complaint with our Data Protection Officer.

To exercise these rights, email us at ceo@oxbrivy.com. We will respond within 30 days.

6. Cookies

We use essential cookies (for authentication and session management) and analytics cookies (PostHog, to understand how the Service is used). You can control cookies via your browser settings; disabling essential cookies may affect the functionality of the Service.

7. Data Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, row-level security on all database tables, and access controls. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you via email at least 15 days before any material changes take effect.

10. Grievance Officer

For privacy-related queries or to file a grievance under the DPDPA 2023, contact our Grievance Officer: