This notice covers data MarvelSoft Ventures collects itself — website visitors, demo and sales enquiries, support requests. It does not cover student, parent or staff data we process for a school: for that, see the School Data & Privacy Statement and the school's Data Processing Agreement. Section 8 is the short version for a parent who is using eKTextAI now.
Prepared under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The operational duties in Rules 3, 6–9 and 14 commence on 13 May 2027; this notice is accurate now.
1. Who we are
MarvelSoft Ventures, No. 89, HMT Main Road, Mattikere, Bengaluru 560054, India, operates ektextai.com, marvelsoft.co.in and mschoolsoftware.com. For this notice we are the Data Fiduciary — we decide why and how the data described here is used.
Data-protection contact: Ranganath Shivaram, ranganath@marvelsoft.co.in, +91 95350 41234.
2. What we collect
- Enquiry and demo data — name, school name and role, work email, phone/WhatsApp number, city, and what you told us you need. Purpose: answer your enquiry and give a demo.
- Account and billing data (paid plans) — school name, billing address, contact name, email, phone and an optional purchase-order reference. We do not require a GSTIN from the school; if one is given, it is printed on the invoice. Purpose: provide and bill the service.
- Support data — the messages you send us and the contact details you use. Purpose: resolve your issue.
- Website usage data — see section 4A and our Cookie Policy.
- We do not collect children's data through these channels.
3. Why we use it
- To answer your enquiry and give a demo.
- To provide and support the service your school subscribes to.
- To meet legal, tax and accounting obligations.
- Marketing emails — opt-in via a separate, unticked box on the contact and sign-up forms; every marketing email carries an unsubscribe link, and using it stops further marketing sends. Marketing consent is separate from the enquiry you sent us and withdrawing it does not affect the answer you asked for.
4. Our basis
- Consent — for enquiry follow-up and any marketing, by a clear affirmative action, no pre-ticked boxes.
- Legitimate uses under section 7 of the Act — where you have voluntarily given us the data for a purpose and have not withdrawn consent.
- Legal obligation — tax, accounting and record-keeping.
4A. Cookies and analytics
Cookies and analytics are used to give a school details about how its own staff and parents use the service — how many questions, which pages, which features — and not to build an advertising profile of anyone. On the sites, the cookies are the ones that keep a session signed in, remember a language choice and measure whether a page works. We do not run advertising cookies and we do not sell analytics data. The cookies are listed in our Cookie Policy.
5. Sharing
We don't sell your data and we don't share it for anyone else's purposes. We use service providers strictly to run the site and answer your enquiry, under contract.
Our service providers are: Contabo (servers and backups, European Union), OpenAI (the AI model we use to draft answers), and Amazon Web Services (email). WhatsApp messages are delivered over Meta's WhatsApp Business Platform on the school's own WhatsApp Business Account — the school holds that account and contracts with Meta for it; we send through it and do not hold or operate it.
6. Where your data is held
On servers in the European Union, operated by Contabo, with backups in the same account. Transfers outside India are permitted unless the Government restricts them, and no such restriction is in force as of 20 October 2026; that is why we disclose the location rather than deny the transfer.
7. How long we keep it
| Data | Retention |
|---|
| Enquiry and demo data | While the school is in subscription, then the same tail: 45 days to the block, 60 days to erasure — about day 105. |
| Support data | While the school is in subscription, then the same tail: 45 days, then 60 — about day 105. |
| Website analytics | The same tail as the account rule: 45 days, then 60. |
| Account and billing data | For the subscription, then as tax law requires for records (CGST Act 2017, section 36: 72 months). |
| eKTextAI account data | Held while the subscription runs; at the end of the paid term the account is blocked 45 days later and the data erased 60 days after the block (about day 105). An account that is not used follows the same clock from its last activity. See the calendar in the Terms of Service. |
Two things sit outside deletion and are stated rather than hidden: processing logs are kept at least one year (DPDP Rules 2025, Rule 8(3) and the Seventh Schedule, from 13 May 2027), and invoice records are kept as tax law requires. Neither is used for any other purpose.
8. If you are a parent or student using eKTextAI
This is the part a parent needs, and it is deliberately short because the rest of their rights run through their school.
- Your school decides. For your child's data, the school is the Data Fiduciary and MarvelSoft is its Data Processor. We act only on the school's instructions.
- Your conversation is visible to the school. When you use eKTextAI, what you and the assistant say is visible to your school and to the staff it authorises, so they can follow up. We also see it where we provide support. It is not private to you and the assistant.
- The assistant is software. It answers from your school's own circulars and notices, and tells you when it cannot answer from them rather than guessing. Some questions are handed to a person. An answer is not the school's official communication — where the school's circular says something different, the circular applies.
- Your rights run through your school. To see, correct or delete your child's data, or to withdraw consent, contact your school. The school instructs us and we carry it out. The school is your first stop, not us.
- It is deleted if the school's account lapses. If a free account is unused it is blocked after 45 days and its data erased 60 days later — day 105 — with warnings and an export window first. Where the school has paid, nothing is deleted until the term it has paid for ends, and the same 45/60-day sequence runs from that date.
9. Your rights (for our own data)
Using the contact in section 1 you may access your data, correct it, erase it, nominate someone to exercise your rights, and complain to us, with redressal within 90 days (that is the complaint clock, a different clock from the deletion sequence in section 7). You may withdraw consent at any time, as easily as you gave it.
We align our handling of personal data with the principles of the GDPR (EU) and UK GDPR, including lawfulness, data minimisation and security.
10. Complaints to the Board
If we do not resolve a complaint, you may complain to the Data Protection Board of India in the manner it prescribes.
11. Security
We protect this data with encryption in transit and at rest, role-based access controls, and regular backups.
If a breach occurs, we notify affected people and the Data Protection Board without delay, with the detailed report to the Board within 72 hours.
12. Children
Our own channels — the websites, demo forms, sales and support — are for adults acting for a school. We do not knowingly collect a child's data through them. Children's data reaches us only through a school, under section 8.
13. Google user data (OAuth / Limited Use)
eKTextAI may request access to certain Google user data when a tenant user connects a Google account via OAuth 2.0. This section states what Google user data we access, how we use it, with whom we share it, how we protect it, and how long we keep it. It is written to comply with the
Google API Services User Data Policy,
including the Limited Use requirements.
Limited Use affirmation
Google user data obtained through Google APIs (including Google Drive, Google Calendar, Google Business Profile, Google user profile / userinfo, and related OAuth tokens) is used only to provide or improve user-facing features of eKTextAI that are apparent in the product: connecting Drive files to a tenant document library, scheduling and managing calendar events, drafting replies to Google Business Profile reviews, identifying the connected Google account, and operating those features efficiently for that tenant.
- •We do not use Google user data for advertising, including personalized, retargeted, or interest-based ads.
- •We do not sell Google user data to data brokers, information resellers, or any third party.
- •We do not use Google user data to determine credit-worthiness or for lending.
- •We do not use Google user data, whether raw, aggregated, or derived, to create, develop, improve, or train foundational, generalized, or non-personalized AI and/or ML models, and we do not transfer it to any service that does.
- •We do not transfer Google user data to third-party applications except as necessary to provide the requested eKTextAI feature, as required by law, or with the tenant’s direction.
What Google user data we access
Access is granted only after the user completes Google’s OAuth consent screen. We request only the scopes needed for the feature the tenant enables. Depending on which integration the tenant connects, eKTextAI may access:
Google user profile (OAuth userinfo)
We access your Google account identifier, name, email address, and profile picture (if provided). We use this only to identify which Google account is connected, display connection status in the tenant workspace, and bind tokens to the correct tenant user.
Google Drive (files you choose, and files eKTextAI saves)
We access the metadata (such as name, ID, MIME type, and modified time) and the content of the files the tenant selects in Google’s file picker to add to that tenant’s document library, and of the files eKTextAI itself saves to the tenant’s Drive at the tenant’s request (for example documents created in Content Studio, or files received on WhatsApp that the tenant chose to keep in Drive). We cannot see other files in the tenant’s Drive.
Google Calendar
We access the list of calendars, busy times, and the event data needed to create, read, update, or delete events the tenant (or the tenant’s authorized automation) requests—such as title, description, start/end time, timezone, attendees, and Google Meet conference details. This lets users schedule meetings, check availability, and send invitations from eKTextAI without leaving the application.
OAuth tokens
We store access tokens and refresh tokens issued by Google so the tenant’s connection remains active. Tokens are stored encrypted, scoped to that tenant, and used only to call Google APIs for the features above.
Google Business Profile
If the tenant connects Google Business Profile, we access the business’s locations, its reviews (text, star rating, and reviewer name), and its posts, so the tenant can read reviews and publish replies and posts from eKTextAI. The same Limited Use, non-sharing, encryption, tenant-isolation, retention, and deletion rules in this section apply to that Google user data. We do not request access to Gmail.
How we use Google user data
We use Google user data solely to operate the Google-connected features the tenant enabled, including:
- •Authenticating the tenant user with Google and showing which Google account is connected
- •Importing selected Drive documents into that tenant’s isolated document library so their assistant can answer from the tenant’s own files
- •Creating and managing calendar events and Meet links that the tenant (or their flows) requested, and offering free times for a booking
- •Showing Google Business Profile reviews and drafting a reply for the tenant to publish
- •Saving files to the tenant’s Drive when the tenant asks for it
- •Refreshing OAuth tokens so those features keep working until the tenant disconnects Google
Google user data is not used to create, train, develop, or improve foundational, generalized, or non-personalized AI/ML models. Content imported from Drive remains in the connecting tenant’s workspace and is used only to provide that tenant’s answer and automation features. We do not fine-tune or train any model on it.
With whom we share, transfer, or disclose Google user data
We do not sell Google user data. We do not share, transfer, or disclose Google user data to unaffiliated third-party applications for their own use. We do not transfer Google user data to third parties for advertising, data brokerage, credit decisions, lending, or training generalized AI/ML models.
Google user data may be processed only as follows:
- •Within the tenant’s own space: Data stays isolated to the customer account that connected Google. Other tenants cannot access it.
- •Google: API calls go back to Google to perform the action the user requested (for example, listing Drive files or writing a calendar event).
- •Our AI provider, OpenAI: eKTextAI’s assistant writes its answers with OpenAI’s API (OpenAI, L.L.C.). When a feature the tenant enabled needs it, the Google user data that feature uses is sent to OpenAI to produce the answer, and for no other purpose. See AI processing of Google user data below.
- •Infrastructure subprocessors: Encrypted hosting/database providers that store the tenant workspace, solely to run eKTextAI. They are not permitted to use Google user data for their own purposes.
- •Legal requirement: If we are required by law, court order, or a valid government request, we will disclose only what is legally required.
AI processing of Google user data
eKTextAI uses an artificial-intelligence service to write answers. OpenAI (OpenAI, L.L.C.), through its API platform, is the only AI service that receives Google user data from eKTextAI. We call OpenAI directly; we do not use an AI aggregator, gateway, or model hub, and we do not run a self-hosted or offline AI model.
What is sent to OpenAI, and why:
- •Google Calendar: the title, time, and attendees of an appointment, and the free times we can offer, when the assistant books, finds, reschedules, or cancels an appointment for the tenant’s customer.
- •Google Drive: the text of the files the tenant chose to add to its document library. The text is converted into a searchable index that is kept in that tenant’s workspace, and the passages relevant to a question are sent to write the answer.
- •Google Business Profile: the text, star rating, and reviewer name of a review, when the tenant asks for a reply to be drafted.
- •Google user profile: not sent to OpenAI.
- •No model training. Under OpenAI’s terms for its API, data sent through the API is not used to train or improve OpenAI’s models unless the customer opts in. eKTextAI has not opted in and does not take part in any programme that shares API data for training.
- •Retention at OpenAI. OpenAI may keep API requests for up to 30 days to detect abuse, after which they are deleted, unless the law requires longer.
- •No shared model. Each tenant’s document index is kept apart from every other tenant’s and is used only to answer that tenant’s own users. Google user data from one tenant is never combined with another’s.
- •No other AI service. eKTextAI does not send Google user data to any other AI or machine-learning service. If that ever changes, this policy will be updated before the change takes effect.
How we protect Google user data
- •Encryption: Data is encrypted in transit (TLS) and at rest. OAuth tokens and other sensitive credentials are stored encrypted.
- •Tenant isolation: Each tenant has a separate workspace. Google connections, tokens, Drive imports, and calendar data are keyed to that tenant and are not mixed with other customers.
- •Access controls: Only authorized users of that tenant (and systems acting on their behalf inside eKTextAI) can use the Google connection. MarvelSoft personnel access tenant data only when needed to provide support or maintain the service, under confidentiality and least-privilege controls.
- •Scope minimization: We request the minimum Google scopes needed for the enabled feature (for example, access only to the Drive files the tenant picks or that eKTextAI saves, not to the whole Drive; and calendar busy times, not a full read of every calendar).
Retention and deletion of Google user data
We retain Google user data only for as long as needed to provide the connected features, or until the tenant disconnects Google or deletes their eKTextAI account, unless a longer period is required by law.
- •While connected: Tokens and profile identifiers remain so the integration can function. Drive files imported into the tenant document library remain until the tenant removes them or closes the account.
- •Disconnect Google: The tenant can revoke access in eKTextAI (and in their Google Account security settings). We then delete or invalidate stored Google OAuth tokens for that tenant and stop calling Google APIs with that account.
- •Account or data deletion: Request deletion via the dashboard's data-request tools, by emailing info@ektextai.com, or by closing the tenant account. We process deletion within 30 days, subject to legal retention duties.
- •When the retention period ends, we delete or irreversibly destroy the Google user data we hold for that purpose (including tokens). Backups expire on their normal rotation.
You can also revoke eKTextAI’s access at any time at
Google Account permissions.
14. Language and changes
This notice is available in English.
We will update this notice as our processing changes, and show the date of the current version. A material change is notified to the contact we hold for you.