1. Scope and who we are
This Privacy Policy explains how PinnacleWorks InfoTech Pvt Ltd doing business as SB AURA (‘SB AURA’, ‘we’, ‘our’), handles digital personal data in connection with superbotaura.com, demonstrations, business enquiries, customer support, and the SB AURA admissions platform, student portal and associated services (collectively, the ‘Services’).
The Services support educational institutions with lead management, admission applications, document verification, merit and seat workflows, student communications, payments and AI-assisted operational insights. This Policy should be read with the applicable institution’s own privacy notice where the institution determines the purposes and means of processing student or applicant data.
2. Data Fiduciary and Data Processor roles
For data collected for our own website, sales, account administration, billing, security and support purposes, SB AURA may act as a Data Fiduciary, depending on the actual processing arrangement. The relevant institution ordinarily acts as Data Fiduciary for student/application/admissions records that it controls; SB AURA generally processes these records on documented instructions as a Data Processor, subject to the applicable contract.
An institution may determine forms, admission criteria, permissible fields, communication purposes, permissions, retention settings and lawful grounds for its student data. Students should ordinarily direct rights requests about institution-controlled admission records to the institution; we will provide reasonable assistance and facilitate requests as required by law and contract. These roles depend on substance, not merely contractual labels.
3. Categories of information processed
Depending on use and configuration, information may include:
- Identification and contact information: name, telephone number, email, postal address, age/date of birth and parent/guardian information.
- Enquiry and admissions information: chosen courses, campuses, educational history, examination scores, eligibility details, applications, merit/rank, seat allocation, offer status and uploaded certificates or marksheets.
- Communications: voice-call metadata and, where recording is enabled and lawful, recordings or transcripts; WhatsApp, SMS, email, portal exchanges, preferences, communication consents, opt-outs, language and follow-up commitments.
- Financial and transaction records: fee structure, invoices, payment status, transaction references and receipts; complete card/payment credentials should be handled by authorised payment providers rather than stored by SB AURA unless specifically disclosed and appropriately safeguarded.
- Institution workforce records: user identities, role/permissions, access and activity logs, approvals, configuration changes and support interactions.
- Technical information: IP address, device/browser identifiers, cookies (where used), security logs, diagnostic data and platform usage information.
- AI-derived outputs: summaries, suggested responses, lead-priority indicators, document mismatch flags, forecasts and related explanations, which may constitute personal data where linked to an identifiable individual.
Institutions should avoid collecting unnecessary sensitive or high-risk information, and must assess lawful handling of disability, health, caste/category, financial and other protected records where admission procedures require them.
4. Purposes and lawful basis
We and our institutional customers process information only for specified lawful purposes and in accordance with applicable notice, consent or another permissible basis under applicable law, as relevant to the particular processing activity.
- Operating enquiries, demonstrations, accounts and contractual relationships.
- Capturing and routing enquiries, processing applications, verifying documents, applying institution-approved admission rules, managing seats, offers, fee instalments and receipts.
- Communicating operational information, responding to questions, recording consent preferences and honoring unsubscribe/do-not-contact instructions.
- Providing AI-assisted summaries, recommended follow-ups, document-reading assistance, lead prioritisation and reporting where lawfully enabled by the institution.
- Maintaining security, detecting fraud or abuse, troubleshooting, auditability, legal compliance and establishment or defence of lawful claims.
Marketing communications and optional uses of personal data are subject to the requisite lawful permissions; service-related communications must not be improperly relabelled as marketing or vice versa.
5. Notice, consent and withdrawal
Where consent is the lawful basis, the relevant Data Fiduciary should provide a clear, stand-alone or appropriately separated notice identifying the personal data, specified purposes, means of exercising rights and complaint channels, in the form and languages required by applicable law. Consent must meet the statutory standard when those provisions apply.
SB AURA may provide configurable purpose-specific consent records and channel suppression controls, but these features do not by themselves establish legal compliance. The institution must correctly configure notices, communication templates, collection points, permissions and lawful grounds. Consent may be withdrawn through the disclosed mechanism; withdrawal will not invalidate processing previously undertaken lawfully and may restrict certain Services. Applicable legal retention obligations and permissible continuing processing may still apply.
6. AI-assisted features and human oversight
Depending on enabled modules, SB AURA may generate summaries of calls and messages, maintain a student interaction timeline, infer follow-up priorities, draft communications, detect possible document mismatches and produce operational forecasts. AI outputs can be inaccurate, incomplete or biased and must be independently checked before consequential action.
Admission eligibility, rejection, merit ranking, seat allotment, fee changes, final offers and materially consequential decisions must remain subject to properly authorised human review and institution-approved rules. Institutions must not treat an AI-generated recommendation as an independent legal or academic determination.
Institutional personal data must not be used to train general-purpose AI models or for unrelated secondary purposes unless specifically authorised in a lawful, transparent contractual arrangement.
7. Children and guardians
Educational admissions may involve applicants below 18 years of age. Where applicable provisions of the DPDP Act and Rules are in force, the relevant Data Fiduciary must implement the prescribed verifiable parental-consent process for a child and comply with restrictions on detrimental processing, tracking, behavioural monitoring and targeted advertising, subject only to lawful exemptions.
Institutions must configure age/guardian collection and approval steps appropriately. SB AURA will support agreed technical controls as contracted; neither the availability of a parent name nor the submission of an application alone should be represented as proof of verifiable parental consent.
8. Channels, communications and recording
Messages, calls and campaigns may be facilitated through telecommunication, email, WhatsApp or other channel providers subject to their terms and applicable Indian telecom, unsolicited commercial communication and other messaging rules. Institutions are responsible for obtaining required permissions, registering templates/senders where required and honoring opt-outs, DND preferences and channel-specific requirements.
Call recording/transcription, if enabled, must use appropriate notice, lawful authorisation and access limits. Automated or AI-mediated conversations should be appropriately disclosed where required and configured to allow escalation to an authorised human representative.
8A. Information we receive from Meta (Facebook and Instagram lead forms)
An institution may connect its Facebook Page (and linked Instagram account) to SB AURA. When it does, the answers a person submits in that institution’s Facebook or Instagram lead form are received through Meta’s API and stored in that institution’s SB AURA account. They are used solely to handle that person’s enquiry for that institution. The institution acts as Data Fiduciary for these records and SB AURA processes them on its behalf, as described in section 2.
- SB AURA does not sell this information, does not use it for its own advertising, and does not use it to train AI models.
- Hashed contact lists may be sent to the institution’s own Meta ad account only when the institution enables Custom Audiences for its account.
- Lead form information is retained and deleted as described in section 11. To ask for it to be deleted, follow our data deletion instructions.
9. Sharing and service providers
Personal data may be disclosed to authorised institutional personnel, contracted hosting and cloud providers, communications gateways, payment processors, identity/security providers, AI infrastructure providers, professional advisers and authorities where lawful and necessary. Each disclosure is limited to appropriate purposes and subject to contractual, access-control and confidentiality safeguards where applicable.
SB AURA does not sell student personal data.
10. Security and breach response
We maintain reasonable technical and organisational safeguards appropriate to risk, which may include role-based access, authentication, access logging, segregation of customers, encryption, backups, monitoring, controlled exports and staff confidentiality measures.
No environment can be guaranteed entirely secure. Suspected personal-data breaches are investigated and escalated without undue delay, and notifications are made to customers, affected persons, competent authorities or CERT-In as required by applicable law, contractual responsibility and relevant commencement dates. Customers must promptly notify us of incidents or unauthorised processing they detect.
11. Retention, deletion and backups
Personal data is retained only for as long as necessary for the specified purpose or required by applicable law, the institution’s lawful retention instructions, valid legal holds or legitimate records obligations. Following the relevant retention period, data is deleted, anonymised or returned where appropriate and technically feasible, with backup deletion governed by documented retention cycles.
Retention of student/application data, recordings, audit logs, analytics, payment references, backups and post-termination export/deletion is governed by the applicable contract and retention schedule. See also our data deletion instructions.
12. International transfers
Where service providers, customer users or infrastructure outside India access or process data, transfers will be assessed under applicable Indian law, relevant government restrictions and customer contractual obligations.
13. Individual rights and grievance redressal
Subject to the applicable commencement of the DPDP Act provisions and other laws, eligible individuals may exercise rights to access prescribed information, correct, complete or update personal data, request erasure, seek grievance redressal and nominate another individual, as provided by law. Requests regarding institution-controlled admissions data should ordinarily be addressed to that institution.
For matters where SB AURA is the appropriate Data Fiduciary, contact: [email protected] (email), 34 A, B, C, Tower B4, Spaze iTech Park, Sector 49, Sohna Road, Gurgaon, Haryana, India – 122018 (address), attention Grievance Officer (designation). We will respond within the legally applicable timeframe and provide any prescribed escalation mechanism. An affected individual may approach the competent authority in accordance with applicable law.
14. Cookies and external websites
The website or platform may use necessary cookies and, if deployed, analytics or preference cookies. Where non-essential technologies are used, a cookie notice or controls will identify them, their purposes, durations and opt-out choices as applicable. Links to external websites, payment systems or communication platforms are governed by their respective policies.
15. Updates, governing framework and contact
We may revise this Policy to reflect feature releases, service-provider changes or legal requirements. Material updates will be communicated through appropriate channels and additional notice or consent will be obtained where legally required.
This Policy is to be interpreted with applicable Indian law, including the Information Technology Act, 2000, applicable rules and the DPDP Act, 2023 and DPDP Rules, 2025 as and when relevant provisions come into force. Contact: PinnacleWorks InfoTech Pvt Ltd, 34 A, B, C, Tower B4, Spaze iTech Park, Sector 49, Sohna Road, Gurgaon, Haryana, India – 122018, [email protected].