Data protection and integrity¶

Kwilo is built for the DPDP Act 2023 and serves minors, so consent, data minimisation and integrity trails are product features, not policy text.

A consent banner runs on kwilo.ai and app.kwilo.ai before anything is tracked. The default is no consent.

Purpose	Default	What it covers
Necessary	Always on	Session, CSRF, auth
Functional	Off	Nothing today, reserved
Measurement	Off	PostHog analytics, session replay (app only, 10% sample) and frontend error reporting

Visitors can accept all, reject all or choose per purpose. The choice is stored under cc_kwilo and shared across kwilo.ai subdomains. Fonts are self-hosted, so the page renders in brand before any choice.

The site footer has Manage cookies. The product app doesn't have a way to reopen the dialog yet.

Before a minor's face is enrolled, the institution sends the parent a consent request. The parent sees what's collected, the purpose, security, retention and their rights, and accepts or rejects. Admins track consented, pending and rejected counts. Required for K-12 schools and PU colleges. See Attendance.

Data minimisation¶

APAAR ID is stored as the statutory student ID. Raw Aadhaar is not.
Student photos are served only through short-lived signed URLs.
Institution payment keys are encrypted and never returned by the API.
Signup attribution data (UTM values, click IDs) is personal data and is deleted with the account.

Isolation¶

Every ERP table has a forced row-level security policy keyed on the active institution. One institution's queries can't read another's rows, even through the table owner. See Roles and permissions.

Account deletion (Learner)¶

B2C users manage their own account in Settings → Account:

Pause deactivates the account. Signing in again reactivates it.
Delete asks for a reason and the password, anonymises personal data immediately, then hard-deletes child data after 30 days. Signing in within 30 days restores access, but anonymised fields stay anonymised. The chatbot's long-term memory is erased too.
Payment and invoice records are kept, with the user link anonymised, for Indian tax retention.

AI labelling¶

AI-generated content carries a label wherever it's shown or exported.

Exam integrity¶

Proctoring. Online assignments can turn on proctoring in the Proctor step. Flagged events are recorded against the submission and shown next to the answers while grading.
Grading trail. The answer sheet, the AI-suggested mark with its confidence, and the final mark a trainer approved stay linked. See Assignments and grading.
Seating and invigilation. Branch-alternating seating and a duty roster with no double-booking. See Exam operations.

Content moderation¶

Messages and submissions pass through moderation, which flags risky content for review. This is part of our POCSO obligations for platforms used by minors.

Where it lives¶

Backend: api/v1/proctoring.py, services/moderation.py
Web: components/proctoring/; consent comes from @kwilo/ui/consent