Privacy Policy

Privacy Policy

Last updated: April 2026 | Effective: April 2026

Elevana (“we,” “our,” “us”) operates elevana.guru and its sub-products including Karka (LMS), Lekha (Document Generator), Disha (Career Guidance), and Marga (CRM). This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

This policy complies with: GDPR (EU), CCPA/CPRA (US/California), DPDPA 2023 (India), PDPL (UAE/Saudi Arabia), and Privacy Act 1988 (Australia).

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, phone number when registering on Karka LMS
• Lead Information: Name, email, phone, programme interest submitted via chatbot or forms
• Payment Information: Processed by Razorpay; we do not store card details
• Document Data (Lekha): All document generation happens in your browser. We do NOT collect, store, or transmit any data you enter in Lekha forms.

1.2 Information Collected Automatically

• Cookies: Session cookies, analytics cookies (Google Analytics), preference cookies
• Device Information: Browser type, operating system, screen resolution
• Usage Data: Pages visited, time spent, referral source
• IP Address: For security, rate limiting, and approximate geolocation

2. How We Use Your Information

• To provide and maintain our services (Karka LMS, dictionary, chatbot)
• To communicate with you about programmes, updates, and support
• To process enrolments and payments
• To improve our website and services
• To comply with legal obligations
• To prevent fraud and ensure security

3. Legal Basis for Processing (GDPR)

Purpose	Legal Basis
Account creation & LMS access	Contract performance
Marketing communications	Consent (opt-in)
Analytics & improvement	Legitimate interest
Legal compliance	Legal obligation
Lead capture (chatbot)	Consent

4. Data Sharing

We do NOT sell your personal data. We may share data with:

• Service Providers: Razorpay (payments), WordPress.com (hosting), Google (analytics), FluentCRM (email)
• Legal Requirements: When required by law, court order, or government request

5. Your Rights

All Users

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Object to processing
• Data portability (receive your data in a structured format)

EU/EEA Residents (GDPR)

• Right to restriction of processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority
• Right not to be subject to automated decision-making

California Residents (CCPA/CPRA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale/sharing of personal information (we do not sell data)
• Right to non-discrimination for exercising rights

Indian Residents (DPDPA 2023)

• Right to access, correction, and erasure of personal data
• Right to nominate another person to exercise rights
• Right to grievance redressal
• Right to withdraw consent

Australian Residents (Privacy Act 1988)

• Right to access and correct personal information
• Right to complain to the OAIC
• Right to anonymity where practicable

6. Data Retention

• Account data: Retained while your account is active + 30 days after deletion
• Lead data: 2 years from collection, then deleted
• Analytics data: Aggregated after 26 months (Google Analytics retention)
• Payment records: 7 years (as required by Indian tax law)

7. Data Security

We implement industry-standard security measures including:

• SSL/TLS encryption for all data in transit
• Hashed passwords (bcrypt) for Karka accounts
• Cookie-based sessions with HttpOnly and Secure flags
• Rate limiting on forms and APIs
• Regular security audits

8. International Data Transfers

Your data may be processed in servers located in the United States (WordPress.com hosting) and India. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for EU data transfers.

9. Children’s Privacy

Our services are not directed to children under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal data, please contact us.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date.