Aven AI Quiz ("the Portal", "we", "us", "our") is operated by Aven Academy, part of the Kartexa group of platforms, at aven.kartexa.com. This policy explains what personal data we collect from students, teachers, admins and visitors, why, how it's protected, and the rights you have over it.
Where India's Digital Personal Data Protection Act, 2023 ("DPDP Act") applies, we act as the Data Fiduciary and you (or, for a child, their parent/lawful guardian) are the Data Principal. Where the EU/UK General Data Protection Regulation ("GDPR") applies — for example if your institute or its students are based in the EU/UK — we act as the data controller for account and platform data, and equivalent rights under GDPR §7 (below) apply alongside your DPDP rights.
1. Information We Collect
Account details: name, email address, phone number (optional), password (stored as a one-way bcrypt hash, never in plain text), and class/section — provided by an admin/teacher when your account is created, or by you directly for an individual student signup.
Quiz & game activity: quizzes attempted, your answers, scores, time taken, and submission timestamps; live (Kahoot-style) game participation and results; AI-generated practice quizzes you request and the topics/files you submit to generate them.
Payment information (individual student plan only): a UPI transaction reference ID and a screenshot of your payment confirmation, submitted when signing up or renewing on the self-serve individual plan, used solely to verify and activate your subscription. Institute-level payments are processed by our payment gateway partners (Razorpay/PayPal) directly — we do not receive or store your card/bank details.
Support & report content: messages sent via the contact/demo forms, chatbot conversations, and any abuse reports you submit (including reports made about you by others).
Technical & security data: session/login state, IP address, and — only if you register one — the public key half of a passkey (WebAuthn) credential, which cannot be used to impersonate you and never leaves your device as a private key.
Cookies & local storage: strictly necessary session cookies to keep you logged in, and local device storage for preferences like dark/light theme. We do not use third-party advertising or cross-site tracking cookies.
2. Why We Process Your Data (Legal Basis)
Consent — for individual (self-serve) signups, payment verification, passkey registration, and any optional sharing (e.g. WhatsApp result-share).
Performance of a contract — for institute-managed accounts, processing is necessary to provide the Portal's core service to your institute under its agreement with us.
Legitimate interest — platform security (brute-force/IP-abuse protection, audit logs), fraud prevention, and service improvement, balanced against your rights.
Legal obligation — retaining certain records (e.g. payment verification, grievance logs) where law requires it.
3. Children's Data
Many users of this Portal are school-age students, including children under 18. Under the DPDP Act, processing a child's personal data requires verifiable consent from a parent or lawful guardian, and we do not undertake behavioural monitoring, tracking, or targeted advertising directed at children.
Institute-enrolled students: accounts are created and managed by the institute's teacher/admin as part of the institute's enrollment process, under an agreement between the institute and, where required, the parent/guardian. If your institute uses this Portal, please refer to your institute for how parental consent was obtained.
Individual (self-serve) student signups: if you are under 18 and signing up directly, a parent or guardian must complete or approve the signup and payment. We do not knowingly permit self-serve signup by a child without that consent, and we will remove any account found to lack it upon verification.
A parent/guardian may contact us at any time to review, correct, or request deletion of their child's data — see Section 9.
4. How We Use Your Information
To operate quiz scheduling, grading, live games, and performance dashboards for students, teachers and admins.
To generate performance reports and AI-assisted insights (strong/weak concept areas) based on your own quiz responses.
To generate AI quizzes from a topic or uploaded file you provide, and to power the support chatbot.
To verify individual-plan payments and activate/renew subscriptions.
To let you optionally share a specific result with a parent, teacher, or peer via a private link or WhatsApp — you choose the recipient; we never message your contacts automatically.
To maintain an internal audit log of sensitive actions (account/quiz changes, logins) and a record of abuse reports, for security and moderation purposes.
To detect and block brute-force login attempts, including a temporary ban on the offending IP address.
5. Sharing of Information & Processors
We do not sell or rent personal data. Quiz results are visible only to: the student themselves, their assigned teacher(s), and admins with a legitimate role-based need. A shareable result link exposes only that one specific attempt — never your full history or other students' data.
We share limited data with the following processors, solely to operate the Portal on our behalf, under contractual confidentiality obligations:
Groq, Inc. — receives the topic/text/image you submit for AI quiz generation, translation, or chatbot conversation, to generate a response. Groq's infrastructure may process this data outside India (cross-border transfer, see Section 7). No account credentials are ever sent to Groq.
Payment gateways (Razorpay/PayPal) — process institute-level subscription payments directly; we receive confirmation of payment, not full card/bank details.
Hosting infrastructure — stores application data on our behalf under a data-processing agreement.
WhatsApp (via wa.me links) — only when you tap a "Share on WhatsApp" button yourself; the message is composed on your own device.
We do not use your data for third-party advertising, and we do not sell personal data under any circumstance.
6. Data Storage & Security
Data is stored in structured, access-controlled files on our hosting infrastructure. Passwords are stored using industry-standard one-way hashing (bcrypt) and are never stored or transmitted in plain text. Access is role-restricted: teachers can only see students and results within their own assigned classes; subadmins are limited to the permissions granted by the main admin. Repeated failed login attempts from an IP address trigger an automatic, temporary block. Passkey (WebAuthn) sign-in stores only a public key — never anything that could be used to impersonate you if our systems were compromised.
7. International Data Transfer
Our hosting infrastructure and AI processing partner (Groq) may process data on servers located outside India, including in the United States. Where the DPDP Act applies, such transfers are made in accordance with Section 16 of the Act and any country-specific restrictions notified by the Government of India. Where GDPR applies, we rely on Standard Contractual Clauses or an equivalent recognised safeguard for any transfer of EU/UK personal data outside the EEA/UK.
8. Data Retention
Quiz question banks are retained indefinitely as academic content. Submission records are retained to support academic tracking and may be cleared periodically by an admin (e.g. at the start of a new term). Payment verification records (transaction ID, screenshot) are retained for as long as needed to resolve disputes and meet accounting/legal obligations, then deleted. Abuse reports and audit logs are retained for security/moderation purposes for a reasonable period, then purged. IP ban records expire automatically (24 hours per ban) but a history is kept for pattern detection.
9. Your Rights
Depending on where you're located, you have some or all of the following rights over your personal data:
Access — request a summary of the personal data we hold about you.
Correction / Rectification — request correction of inaccurate or incomplete data.
Erasure — request deletion of your account and associated data, subject to legal/academic record-keeping needs.
Grievance Redressal (DPDP) — lodge a grievance with our Grievance Officer (Section 11) and expect a response within the statutory timeline.
Nominate (DPDP) — nominate another individual to exercise your rights on your behalf in the event of death or incapacity.
Withdraw Consent — withdraw consent for any consent-based processing (e.g. individual signup) at any time, without affecting processing already carried out.
Data Portability, Restriction & Objection (GDPR) — request a portable copy of your data, ask us to restrict processing, or object to processing based on legitimate interest.
To exercise any of these rights, contact your institute's admin (for institute-managed accounts) or reach us directly —
10. Cookies
We use only strictly-necessary session cookies (to keep you logged in) and local device storage for preferences such as theme. These do not require consent under DPDP/GDPR as they're essential to the service. We do not use advertising or cross-site tracking cookies.
11. Grievance Officer & Data Protection Contact
In accordance with the DPDP Act, we have designated a Grievance Officer to address privacy-related complaints. For all privacy questions, data rights requests, or grievances — . We aim to acknowledge grievances promptly and resolve them within the statutory timeline.
12. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights, we will notify the Data Protection Board of India (where the DPDP Act applies) and/or the relevant supervisory authority (where GDPR applies) as required by law, and will notify affected users without undue delay where feasible.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected with an updated "Last updated" date above, and where required by law, we will seek fresh consent.
14. Contact Us
Questions about this policy, or to exercise your data rights —