Privacy policy

ChatStudyAbroad is run by Crizac, an international education company. For the personal data in ChatStudyAbroad, Crizac is the data controller (under UK GDPR) and the data fiduciary(under India’s Digital Personal Data Protection Act, 2023). In this policy "we" and "us" mean Crizac.

Plexe Ltd builds and hosts ChatStudyAbroad for us. It processes personal data only on our instructions and under a written agreement.

Schools use ChatStudyAbroad to support their students’ university plans. If your school invited you, your school counsellor works with you through it.

This policy covers the ChatStudyAbroad Student app on iPhone and Android, and the student pages of the ChatStudyAbroad website. It applies to students, and to parents or guardians who set up an account for a student under 18.

From your school counsellor. When your counsellor adds you, they record your name, school, class, date of birth and email, and your parent or guardian’s name, email and phone. They may add academic details such as your marks or English test score.

When you set up your account. Your email address, a password (we store only a one-way scrambled version, never the password itself), and the choices you make about the terms, this policy and optional updates.

When you use ChatStudyAbroad.

• Your chats with the ChatStudyAbroad assistant, and the courses it suggests.
• Courses you save to your shortlist.
• Your preferences, such as subject, level, countries, cities, intake, course length and budget. Some are picked up from what you say in chat. You can see, change or remove them on the Preferences screen, or clear them all with Start fresh on your Profile.
• Short notes the assistant keeps from your chats, such as your budget, your background or a university you keep asking about, so it does not have to ask again. Start fresh sets these aside along with your preferences, and the assistant stops using them.
• The details you choose to add on the My details screen: name, email, gender, passport number, home state, the countries you are considering, course type and intake. Adding them is up to you. Your counsellor needs them to start an application.

Technical data. A sign-in cookie that keeps you signed in, and server logs (such as IP address, device or browser type, and time) that we keep for security and to fix problems.

What we do not collect. No advertising IDs, no location tracking, no contacts or photos, and no third-party analytics or advertising tools. ChatStudyAbroad shows no ads.

• To provide ChatStudyAbroad: run your account, answer your questions, suggest and compare courses, and keep your chats, shortlist and preferences in step across the app and the website.
• So your school counsellor can support you: your counsellor sees your chats, shortlist, preferences and details, and uses them to guide you and, if you go ahead, to help with applications.
• To keep ChatStudyAbroad safe: prevent misuse, protect accounts and fix faults.
• To send you updates about courses and deadlines, but only if you opted in. You can change your mind at any time.

Our legal reasons. Under India’s DPDP Act we rely on your consent, or a parent’s or guardian’s consent for a student under 18, given when the account is set up. Under UK GDPR we rely on providing the service you asked for, on our legitimate interest in supporting students with their school, on your consent for optional updates, and on legal obligations where they apply.

ChatStudyAbroad’s assistant is powered by Anthropic’s Claude models. To answer you, your message, the conversation so far, and the preferences, notes and details relevant to it are sent to Anthropic for processing. Under Anthropic’s commercial terms, this data is not used to train its models.

Our own records of each conversation, used to check the quality of answers and fix problems, are stored in our own cloud account.

AI can make mistakes. Course details, fees and entry requirements change, so check anything important with your counsellor or the university before you rely on it.

• Your school counsellor, and other counsellors at your school who work with you.
• Crizac’s admissions team, when needed to support an application you choose to make.
• Universities and colleges, only when you decide to apply. We share what is needed for that application.
• Service providers who process data for us under contract: Plexe Ltd (builds and runs the service), Amazon Web Services (hosting, in India), Anthropic (the AI assistant), and our email providers, Amazon SES and Resend (account emails such as invites and password resets).
• Authorities, if the law requires it.

We never sell personal data, and we never use it for advertising.

Your data is stored on Amazon Web Services in Mumbai, India. Some providers process data outside India: Anthropic’s AI processing and our email providers are based in the United States. Where data leaves India or the UK, we use providers bound by contract to protect it, including standard data protection clauses where UK law requires them.

ChatStudyAbroad is invite-only. For a student under 18, the invitation goes to their parent or guardian, who sets up the account, chooses the password and gives consent for the student. This is the verifiable consent that India’s DPDP Act requires.

We do not track children’s behaviour, profile them for advertising or show them ads. A parent or guardian can contact us at any time to see, correct or erase their child’s data, or to withdraw consent.

We keep your data while your account is open and while you are working with your school counsellor.

If you delete your account, your sign-in is removed straight away and you are signed out everywhere. Your chats, shortlist and details stay with your counsellor as part of your school counselling record, so your counsellor can carry on supporting you and an invitation can restore your account. We keep that record only as long as your school needs it for counselling, and then delete or anonymise it.

If you delete a chat, it disappears from your chats on all your devices. It stays part of your counselling record, and your counsellor can still see it.

If you use Start fresh, your preferences are cleared and the assistant’s notes about you are set aside. The assistant no longer uses them, but they stay part of your record until it is erased.

To have that record erased as well, email the privacy contact (to be confirmed). We will confirm when it is done, unless the law requires us to keep something, in which case we will tell you what and why.

Server logs are deleted after 14 days.

You, or your parent or guardian if you are under 18, can:

• see the personal data we hold about you and get a copy of it
• correct anything that is wrong or out of date. Many details you can change yourself in the app
• ask us to erase your data
• withdraw your consent, including to optional updates
• object to, or ask us to restrict, how we use your data (UK)
• nominate someone to exercise your rights if you cannot (India)
• complain to us, and to a regulator

Email the privacy contact (to be confirmed) to use any of these rights. We reply within one month, and sooner where the law requires. If you are not happy with our answer, you can complain to the Information Commissioner’s Office in the UK, or the Data Protection Board of India.

In the app, tap your initials at the top right of Home to open your Profile, then Delete account. On the web, sign in and go to chatstudyabroad.com/account/delete. You will be asked for your password. Section 9 explains what is removed and how to ask for full erasure.

Everything you send is encrypted in transit (HTTPS), and data is encrypted at rest. Passwords are stored only as strong one-way hashes. Access to personal data is limited to the people who need it: your school’s counsellors for your record, and a small number of Crizac and Plexe Ltd staff to run and support the service. No system is perfectly secure. If a breach affects you, we will tell you and the regulators as the law requires.

If we change this policy, we will update the date at the top. If the change is important, we will tell you in the app or by email first, and ask for your consent again where the law requires it. This is version 2026-10-05.

For questions, requests or complaints about your personal data, including to reach our grievance officer under India’s DPDP Act, email the privacy contact (to be confirmed).