Last updated: 9 October 2026 · Effective: 9 October 2026
This Policy explains what personal data Odvanta collects, why, how we protect it, and your rights. It applies to the Odvanta website and web app (the "Platform") and should be read with our Terms of Service.
Odvanta is a proprietorship owned and operated by Mr. Manoj Kumar Sahu, sole proprietor, trading as "Odvanta" (Udyam Reg. No. UDYAM-WB-14-0314641), J-164, DLF Newtown Heights, Tower-J, Major Arterial Road, New Town, Kolkata, West Bengal 700135, India. For your personal data, Odvanta is the Data Fiduciary under the DPDP Act 2023.
Grievance Officer / Data Protection contact: Mr. Manoj Kumar Sahu, Proprietor — support@odvanta.com (a grievance@/privacy@ alias may be added and honoured), at the address above.
Account & identity (you provide): full name, email, target exam (CAT 2026 / CAT 2027 / Other MBA entrance), and your Terms & Privacy consent flag and timestamp. With "Sign in with Google", Google returns your name and email (we never receive your Google password).
Activity data (the core of the product): your attempts — the question, its section/topic/concept tags and difficulty, the option picked or value typed, correct/incorrect, your confidence tap (Guessed / Unsure / Sure), time spent, attempt order, revisits, and timestamps; test and mock scores and per-question detail; per-topic progress.
Derived data: mastery %, strength score, mistake records, and the "next right move" ranking. Preferences: theme (light/dark) and UI prefs, in your browser's local storage. Technical: device/browser and approximate location from IP, for security and analytics.
Payments (future): processed by Razorpay — Odvanta never collects, sees, or stores your card number, CVV, or other complete payment details; we may keep a non-sensitive record of your plan, transaction reference, and status.
Our legal basis is your consent (with the "legitimate uses" the DPDP Act permits, e.g. providing a service you requested). We use your data to create and run your account and authenticate you; save and sync your progress across devices; generate your personalised analytics (the Intelligence Features — this is the core function and cannot work without your activity data); process payments via Razorpay; send transactional email (sign-in codes) via Resend; secure the Platform; improve it; and comply with law.
How consent is obtained: at sign-up you must affirmatively accept these Terms and this Policy before your account is created, and we record a consent flag and timestamp. How to withdraw: email support@odvanta.com or delete your account in Settings — withdrawal is as easy as giving consent. Because the analytics are core to the Service, withdrawing consent to activity processing generally means we can no longer provide the Service and will then delete or anonymise your data (Section 7). Withdrawal does not affect processing already done lawfully.
Your attempts (including the confidence tap) feed our engine, which classifies outcomes (clean / slip / lucky / gap), estimates reliable-vs-lucky performance and recoverable marks, and ranks your next action. Results show only to you (Dashboard, Analysis, Progress, Mistake Journal). Any peer/social-proof numbers ("N% got this right") are computed from aggregated, de-identified data and never expose anyone's identity.
We do not sell your data. We share it only with processors who help run Odvanta, each under contract to protect it and process it only on our instructions: Supabase (authentication, Postgres database, hosting of account/activity data); Resend (transactional email — email address); Google (optional sign-in — name, email); Razorpay (payments, future — card data handled by Razorpay, not stored by Odvanta); Netlify (web hosting, planned). We may also disclose where required by law.
Cross-border transfer: some providers may store or process data outside India; where that happens we rely on your consent and contractual safeguards, and transfer only to jurisdictions not restricted by the Central Government under the DPDP Act 2023.
Account and activity data sit in Supabase (Postgres) protected by Row-Level Security on a deny-by-default basis — every row carries your user ID, and you can read/write only your own rows; cross-user reads are not possible from the client. Data travels over encrypted connections (HTTPS/TLS); authentication is via Supabase (Google sign-in or email OTP), so we do not store your password. Card data is never stored by us. No system is perfectly secure, so we cannot guarantee absolute security.
We keep your data while your account is active and as needed to provide the Service. On account deletion (or consent withdrawal) we delete or irreversibly anonymise your personal data within a reasonable period, except records we must retain by law (e.g. tax/payment) or to defend legal claims. De-identified aggregate data may be retained for analytics.
Subject to the DPDP Act, you may: access a summary of the data and processing about you; have data corrected, completed, or updated (much is editable in Settings); request erasure; use our grievance redressal (Section 11); nominate someone to exercise your rights on death or incapacity; and withdraw consent anytime. Email support@odvanta.com to exercise these; we may verify your identity first and will respond within the legal timelines. If unsatisfied, you may escalate to the Data Protection Board of India once operational.
Delete your account anytime via Settings → Delete account or support@odvanta.com. This removes your profile and associated attempts, test results, progress, journal, ratings, and feedback from our live systems, subject to the legal-retention exceptions in Section 7. Deleting your Odvanta account does not affect your Google account. Deletion is irreversible — progress and analytics cannot be recovered.
The Platform is intended for adults aged 18 and over (CAT and most MBA-entrance exams require a completed bachelor's degree). It is not directed to children (under 18), and we do not knowingly collect or process the personal data of anyone under 18 — if we learn we have, we delete it promptly. Because the Service is restricted to adults, we do not undertake children's-data processing under the DPDP Act 2023; if that ever changes, we will implement verifiable parental-/guardian-consent mechanisms as required by law.
We use cookies and local storage for essential functionality only: to keep you signed in (session/auth tokens and a sign-in flag) and to remember preferences such as theme and onboarding state. We do not use them for cross-site tracking or advertising. Clearing them signs you out and resets local preferences.
We maintain reasonable safeguards. In a breach likely to affect you, we will contain and remediate it and notify affected Data Principals and the Data Protection Board of India as required by the DPDP Act 2023 and rules.
The Platform is designed for users in India under Indian law. If you access it from abroad (e.g. EU/UK) and the GDPR or similar law applies, we will honour equivalent access, correction, and deletion requests via the same contact. Our primary regime remains the DPDP Act 2023.
We may update this Policy; we will revise the date above and notify material changes in-app or by email. Continued use after changes means you have read the update.
Privacy questions, data requests, or grievances: support@odvanta.com — Mr. Manoj Kumar Sahu, Proprietor, Odvanta, J-164, DLF Newtown Heights, Tower-J, Major Arterial Road, New Town, Kolkata, West Bengal 700135, India. We acknowledge within 48 hours and aim to resolve within the DPDP Act's timelines.
See also our Terms of Service. © 2026 Odvanta — Mr. Manoj Kumar Sahu, sole proprietor.