What we hold about your child, and what we do with it

The data fiduciary — the business that decides what is collected and why, and that is answerable for it — is Nikhil Seth, trading as IVYBootcamps Consulting. We operate from Thryve Coworking, Plot No 3, First Floor, Next to Neelam Chowk Metro Station, 18/1, Mathura Road, Faridabad, Haryana 121007, India, and you can write to us there about anything on this page.

IVYBootcamps Consulting is the trading name of Nikhil Seth. The brand you see on this site is the trading name; the business that holds your data and contracts with you is named above.

You can reach us at talktous@ivybootcamps.com or +91 70650 11173, Monday to Saturday, 10:00 to 18:00 IST.

Grades 9 to 12 is roughly ages thirteen to eighteen. Section 9 of the Digital Personal Data Protection Act 2023 sets three obligations that apply to almost every student who uses this product. Two of them we meet by design. One of them we do not yet meet, and this notice says so rather than implying otherwise.

1. Verifiable parental consent — not yet built, stated plainly

   Today there is no age gate on the sign-up form and no step that takes consent from a parent. The form asks a student for a parent's name, and optionally an email address and a phone number, and the single consent tick in the assessment is the student's own. That is not verifiable parental consent and we are not going to call it that.

   The Rules under the Act prescribe how the verification must be done and they commence on 13 May 2027. We will have a proper step in place by then. Until we do: if you are a parent and would rather give consent yourself, or would rather your child did not sit this at all, write to talktous@ivybootcamps.com or ring +91 70650 11173 and we will take the consent from you directly, or delete everything. Neither request needs a reason and neither is argued with.

2. Nothing that could harm a child's well-being

   This obligation cannot be exempted away by anybody, for any purpose. So: the working-style questionnaire is not a clinical instrument and excludes every clinical scale a real screener would carry; no part of the report may suggest, hint at or invite a reader to consider a diagnosis; a low readiness index is always reported alongside the specific actions that would raise it, because a score handed to a sixteen-year-old with nothing attached is not information, it is a verdict; and the essay critique is written to say what would improve a piece of writing rather than to judge the person who wrote it. If a student, a parent or a teacher is worried about a child's wellbeing, that belongs with a qualified professional, not with us.

3. No tracking or behavioural advertising while a child is answering

   No advertising pixel, no cross-site tracker and no behavioural-profiling script runs on any screen of the assessment, on the intake form, or on the storyboard. That is enforced by an allowlist in our code rather than by anybody remembering, and the file that holds it cites this section of the Act as the reason. A pixel does run on our public and checkout pages — the next-but-one section says exactly which, and exactly what it reports. We do not build advertising audiences from assessment data, we do not target advertising at students, we never send a name, an email address, an answer, an essay or a score to an advertising platform, and we do not sell or share this data with anybody who would.

One point where the law is genuinely unsettled, said plainly rather than buried: whether scoring a minor's application profile amounts to “behavioural monitoring” under Section 9 has not been ruled on by any regulator. We do not know, and anyone who tells you they do is guessing. Our position is to assume it does, and to run the product as though the strictest reading applies.

A parent or guardian may exercise every right in this notice on the student's behalf: see what is held, correct it, have it deleted, withdraw consent, or complain.

Almost everything here rests on consent — yours if you are 18 or over, your parent's or guardian's if you are not, subject to the honest caveat above about how that consent is currently taken.

Two narrow exceptions, both of which are the law rather than our preference. Payment and tax records are kept because a business is required to keep them, and withdrawing consent does not erase a receipt. And where we have to establish or defend a legal claim — a disputed charge, for instance — we keep what that requires and nothing more.

Inside our own business, a student's answers, essays and scores are visible to that student and to the counselling team working on their case, and to nobody else. That is enforced at the database rather than in the interface, so it holds whichever screen somebody reaches and whatever they type into a browser. A counsellor's access is further limited to the destinations they actually work on.

When an assessment is submitted, a summary goes to our own team inbox so that a counsellor can pick it up. It is the fullest single disclosure this product makes and it goes nowhere outside the business.

We would also disclose data if a court, a regulator or the law required it. If that ever happens we will tell you, unless we are forbidden from doing so.

The one model call this product makes about a student is the one described above, and what it receives is listed there in full. Anthropic's published commercial terms state that inputs and outputs submitted through their interface are not used to train their models. We have set out exactly what we send so that you can weigh that for yourself rather than take our word for it. A second, separate model call exists in this product — the one that re-checks university fees, deadlines and scholarship details — and it is sent no student data at all.

Nor is your school told your results, or your teachers, or any university, unless you or your parent ask us to send them.

Withdrawing is as easy as giving. Email talktous@ivybootcamps.com from the address on the account, or a parent's address, and say what you are withdrawing.

We stop processing the answers, we delete them along with the essays and the scores derived from them, and the report stops being available. We cannot undo this, and it is worth saying that a deleted essay is genuinely gone — keep your own copy first if you might want it. If you paid for a report and then ask us to delete it, we will delete it, but the payment is not refunded for that reason: see the refunds page.

Ask us to close the account as well and we delete all of it, apart from the payment records the law requires us to keep. Those are kept for the period in the table above and used for nothing else.

Withdrawing does not make anything that happened before it unlawful, and it does not reach the things we no longer control — a report you have already downloaded, printed or forwarded is yours, and we cannot recall it.

We set exactly one kind of cookie ourselves — the sign-in cookie that keeps you logged in while you work through an assessment that takes about forty minutes. Without it you would be signed out halfway. It is strictly necessary, it carries no advertising identifier, and it is not shared with anybody. Your draft answers are held in your browser's own storage rather than in a cookie, and they never leave your device in that form.

No advertising pixel and no behavioural-analytics script runs on any screen of the assessment, on the intake form, or on the storyboard. That is the part that matters most to us and it is absolute: nothing a student does while answering questions is reported to an advertising platform, ever. It is enforced by an allowlist in the code rather than by convention.

An advertising pixel does run on seven kinds of page, and here they are: the homepage, the sign-in page, the sign-up page, the results list, a result page, the unlock page and the account page. On those pages it records that the page was opened, and when an account is created, an assessment is completed, a checkout is started or a payment completes, it reports that the event happened along with the amount where there is one. It never reports a name, an email address, a phone number, an essay, an answer or a score. The pixel is shared with our sibling assessment product, which means the advertising platform can recognise the same browser across both sites using its own cookies — it is told nothing by us that would let it recognise a person.

Two more third-party scripts exist in this product: the payment gateway's checkout, which loads only when you choose to pay, and the booking calendar on the result page. Each sets its own cookies on its own domain when it loads. Neither is present on any page a student passes through while taking the assessment.

The site also sends a browser header refusing camera, microphone, location and advertising-topic participation across every page.

What we will not claim: that any of this makes a breach impossible. It does not. We hold no independent security certification today and we are not going to imply one. If personal data we hold is ever breached, we will notify the Data Protection Board of India and every affected family, in plain language, with what happened and what to do about it.

Any complaint about privacy — something we hold that we should not, a request we have not answered, an email you did not ask for — goes to the officer above. We will acknowledge it within 48 hours and resolve it within 30 days.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India, which is the statutory body established under the Act to hear complaints of this kind. The Board is still being constituted, so until it begins accepting complaints the practical route is through our Grievance Officer — and we would rather tell you that than send you to an address that will not reply.

If we change what we collect, why we collect it, or who we share it with, we will update this page and move the effective date. Where the change is material — a new purpose, a new recipient, a longer retention period — we will email the address on the account, and the parent's address where we hold one, before it takes effect. We will not rely on you noticing a quietly edited page.

This version is effective from 21 August 2026 and applies to data we hold from that date. A family in dispute is entitled to know which version applied on the day they paid, so previous versions are kept and we will send you one on request.