Privacy Policy

1. Who this website is for

This website is for students of the Indian Institutes of Technology who are 18 or older. You need an email address issued by your IIT to join. We do not knowingly collect data from anyone under 18; if we learn that someone under 18 has joined, we delete their account and data. Tell us at support@enip.ai if you think this has happened.

2. What we collect

When you join, you give us:

• your name, IIT, branch, degree and expected graduation year;
• your IIT email address, which we verify by sending it a one-time code;
• your mobile number;
• the company you have interned or worked at, if any;
• what you are looking for on ENIP (for example internships, resume review or mentorship), and how you heard about us;
• the referral code you joined with, if any; and
• whether you want WhatsApp alerts, and when you said yes.

When you use the website, we keep:

• the messages you exchange in chats;
• CV files you choose to attach in a chat;
• for an instant CV review: the role you chose and the score, summary and feedback. The CV file itself and the text read from it are not kept by us;
• your points, the friends you referred and your place on the waitlist.

Automatically, we collect:

• cookies that keep you signed in and remember an unfinished sign-up (see section 9);
• a random visitor ID, the link or source that first brought you to the website, and what you do on it (pages you open, what you search for, profiles and chats you open, and whether you share your invite), but never the text of your messages or files;
• a one-way scrambled form (hash) of your network (IP) address, to limit abuse such as too many code requests or free CV reviews; and
• standard technical logs kept by our hosting provider (such as IP address, browser and pages requested).

We do not ask for your date of birth, photos, location, contacts or payment details on this website.

3. How we use it

• to confirm that you are a student of the IIT you chose, and to allow only one account per email address and per phone number;
• to run your account, chats, waitlist place, referrals and points;
• to send you service emails: sign-in codes, when you get in off the waitlist, when a friend you invited joins, and a reminder if you start joining but do not finish;
• to send WhatsApp alerts when a senior replies, once this is available, and only if you turned them on;
• to understand how students use the website and where they get stuck, so we can improve it. Once you join, your earlier activity on this browser is linked to your account, and the YAL team can see it;
• to prevent fraud, fake accounts, spam and misuse, and to keep the platform safe; and
• to comply with the law.

We do not sell your personal data, show you third-party advertising or share your data with others for their marketing.

4. Who can see your data

The YAL team. During this early phase, chats are answered by the YAL team and Entrepreneurs in Residence, who are always labelled as such and never presented as alumni. The team can see your sign-up details, your messages and the CVs you attach, so they can reply and keep the platform safe.

Friends you invite. A friend who opens your invite link sees your first name. When friends join with your code, you see their first names in your list of invites.

Other students do not see your details. Campus pages show only how many students from each IIT have joined.

Service providers that run parts of the website for us, only for that purpose:

• Vercel: hosts the website (Singapore region);
• Neon: our database (Singapore);
• Brevo: delivers our emails;
• Supabase: private storage for CVs attached in chats; and
• HireLayer: scores your CV when you ask for an instant review. The file is sent with a do-not-store instruction and the review is deleted on their side once we have the result.

We may also disclose data when the law requires it, or when it is needed to protect someone's safety or our legal rights.

5. Where your data is stored

Our database and website servers are in Singapore. Some providers, such as our email provider, may process data in other countries. When data leaves India, we take reasonable steps so that it stays protected as described here and as the Digital Personal Data Protection Act requires.

6. How we protect it

• all traffic is encrypted (HTTPS);
• sign-in codes are stored only in scrambled form, expire quickly and allow limited attempts;
• requests are rate-limited to stop guessing and spam;
• CVs are kept in private storage and can be opened only by the student who shared them and the YAL team; and
• team access needs its own sign-in, which expires after 12 hours.

No system is completely secure, but we work to protect your data and will tell you, and the Data Protection Board where required, if a breach is likely to affect you.

7. How long we keep it

• your account data, for as long as your account exists;
• details from a sign-up you did not finish: usable for 30 minutes, deleted within 8 days;
• sign-in codes, until they expire; sessions, for up to 30 days (12 hours for team accounts);
• records used to limit code requests, which hold only scrambled network addresses, for up to 30 days; and
• your activity on the website (section 2), for up to 180 days.

If you ask us to delete your account, we delete or anonymise your data within 30 days, except what the law requires us to keep.

8. Your rights

Under the Digital Personal Data Protection Act you can:

• get a summary of the personal data we hold about you and how we use it;
• correct or update inaccurate data;
• have your data erased, including by deleting your account;
• withdraw your consent, for example to WhatsApp alerts, at any time (this does not undo processing already done);
• nominate someone to exercise these rights if you die or become unable to; and
• raise a grievance with our Data Protection Officer.

To use any of these rights, write to dpo@enip.ai from your IIT email address. Withdrawing consent is as easy as giving it.

9. Cookies

We use only the cookies the website needs to work, and no advertising cookies:

• enip_session: keeps you signed in (up to 30 days);
• enip_pending_email and enip_pending_key: remember a sign-up or sign-in in progress (30 minutes);
• enip_ref: remembers the invite code from a friend's link, so they get credit;
• enip_vid and enip_src: a random visitor ID and your first source, to record your activity on the website (section 2);
• enip_cv_review_guest: lets you see your free CV review without an account; and
• your light or dark theme choice, saved in your browser.

You can block or delete cookies in your browser settings, but signing in will not work without them.

10. Data Protection Officer and grievances

We have appointed a Data Protection Officer to handle questions, requests and complaints about your personal data and this website:

• Data Protection Officer: Ravi Sharma
• Email: dpo@enip.ai
• Registered office: Flat No. M 70/110, Mansarovar, Jaipur, Rajasthan – 302020, India
• Acknowledgement: within 24 hours
• Resolution: within 15 days of receipt

If your complaint is not resolved, you may approach the Data Protection Board of India after using this grievance process.

11. Changes to this Policy

We will post any update on this page with a new effective date. If a change is significant, we will also tell you by email.

12. Contact us

Echelonera Technologies Private Limited

Email: legal@enip.ai

Corporate office: 3rd Floor Awfis Lorven Tiara, Survey No 34, Kondapur, Laxmi Cyber City, Whitefields, HITEC City, Kothaguda, Telangana – 500084

Registered office: Flat No. M 70/110, Mansarovar, Jaipur, Rajasthan – 302020, India