UniTrack CRM Privacy Policy

Avenlixx Technologies Pvt. Ltd. builds and operates UniTrack CRM, the CRM used by education consultancies and study abroad agencies. This policy explains what personal data we process when a consultancy uses the platform and when you visit our websites, and what choices you have.

It is written for both audiences that matter here: the consultancy that signs a subscription, and the student whose file is being carried through it.

• Account data: name, work email, phone, role, and the hashed value of your password.
• Workspace data: consultancy name, address, logo, branch structure, staff list, subscription package and billing records.
• Student records you enter: identity and contact details, academic history, examination scores, passport and visa information, uploaded documents, application stages and payments. We do not collect this from students directly — the consultancy puts it in.
• Payment data: transaction references and status from the payment gateway. Card and bank credentials go to the gateway, not to us.
• Technical data: IP address, device and browser details, timestamps and the actions taken in the product, which are written to the audit trail.

For the student and lead records inside a workspace, the consultancy is the data controller and Avenlixx Technologies Pvt. Ltd. is the processor. We handle that data only on the consultancy's instructions, only to provide the Service, and never as our own records.

For the consultancy's own account, staff and billing data, Avenlixx Technologies Pvt. Ltd. is the controller.

A student asking to see, correct or delete their file should send that request to the consultancy handling their application; the consultancy can act on it immediately inside the product, and we will assist it if the request needs us.

• To run the Service: authentication, tenancy isolation, workflow, storage and delivery of the modules a workspace has subscribed to.
• To keep it safe: fraud and abuse monitoring, rate limiting, CSRF and injection defences, session control, and the audit trail workspaces use to review what their own staff did.
• To bill for it: subscription state, invoices and payment reconciliation.
• To support it: responding to requests, diagnosing a reported problem, and sending service notices such as maintenance or security advisories.
• To improve it: aggregate, workspace-bounded product statistics. We do not sell your data or use one workspace's records to market to another.

We disclose personal data only to the limited parties needed to operate the Service, under obligations comparable to this policy:

• Our hosting and infrastructure provider, which stores the encrypted database and uploaded files.
• Payment gateways used at checkout — eSewa and connectIPS — which receive the order and contact details needed to complete a transaction.
• Email and messaging providers that deliver transactional notices on our behalf.
• Courts, regulators or law enforcement where disclosure is required by law, in which case we notify the affected workspace first unless legally prohibited.

A sub-agent or partner account in a workspace sees only the records its own grant allows; the platform is built so that no workspace can read another's data.

Traffic between your browser and the platform is encrypted in transit, and stored data is encrypted at rest. Passwords are stored only as salted hashes, sign-in can require a second factor, an account holds one active session at a time, mutating requests are checked for cross-site forgery, and inputs are validated against injection. Every data access is scoped to the workspace resolved from the request host, and administrative actions are recorded in an audit trail.

No system is impenetrable. The controls above reduce risk; they cannot promise it away, which is why we also recommend that workspaces enforce strong unique passwords and turn on the authenticator requirement for every staff account.

We use first-party cookies to keep you signed in, to remember which workspace a Super Admin is currently viewing, and to hold the guided-tour and cache state the product needs. Session cookies are scoped so that a consultancy signs in on its own subdomain and the platform console on another.

We do not set advertising cookies on the product or on the marketing site, and we do not track you across unrelated websites for advertising purposes.

Workspace records are kept for as long as the subscription lasts. After a subscription ends, the export window described in the Terms of Service applies, then the workspace's records are deleted from the live system and fall off the backup rotation.

Data needed for our own legal, tax or security obligations may be retained for the period those laws require, and audit records of a deleted account are retained in a form that no longer identifies the person where the law permits.

You may ask to access, correct, export or delete personal data we hold about you, to restrict certain processing, or to withdraw a consent you gave. Staff of a workspace can exercise these for their own account through the product's profile settings; students exercise them through the consultancy that holds their file; anyone may write to the contact below.

We answer requests without undue delay and normally within thirty days. We may need to verify who is asking before disclosing anything, and we may decline a request that another law obliges us to refuse.

Study-abroad files often include applicants who are minors. The platform is sold to consultancies, not to students, and is not directed at children. Where an applicant is under the age of digital consent in the relevant country, the consultancy must obtain the consent of a parent or guardian and can record that in the student file; the same deletion and access rights apply to a minor's records.

UniTrack CRM ('Software') is owned exclusively by Avenlixx Technologies Pvt. Ltd. All intellectual property, source code, and updates remain the sole property of Avenlixx Technologies.

Nothing in this policy transfers any right in the Software to a workspace, and none of the marks used to identify the product are licensed by it.

We may update this policy as the product, our providers or the law change. The revision date at the top of the page shows when it last did, and a material change is announced in the product and by email to the workspace contact before it takes effect.

This policy is governed by the laws of Nepal, and disputes connected to it fall to the courts sitting in Kathmandu, Nepal. Where a workspace serves data subjects whose local law applies additionally, that law governs their requests.

Avenlixx Technologies Pvt. Ltd., registered under the Office of Company Registrar, Nepal. Kathmandu, Nepal. Privacy enquiries: support@unitrackcrm.com.