Privacy Policy

Account Information

When you register, we collect your name, email address, phone number, and role (consultancy admin, counselor, or student). For consultancies, we also collect the organization name, address, and branding preferences.

Student Data

Consultancies enter student information including names, contact details, target countries, intake preferences, university applications, visa applications, and document uploads. This data is owned by the consultancy and processed by Qylantis on their behalf.

Documents

Documents uploaded to the platform (passports, transcripts, IELTS scores, financial statements) are stored encrypted on Google Cloud Storage. Only authorized users within the consultancy can access them.

Payment Information

Subscription payments are made by bank transfer or QR payment, or through Khalti or eSewa where those gateways are enabled. We do not store card details or your bank login. Payment references and receipts are stored for billing records.

Usage Data

We automatically collect IP addresses, browser type, device information, pages visited, and actions taken within the platform. This data helps us improve performance and detect issues.

Providing and maintaining the Qylantis CRM platform and its features.

Processing student applications, documents, and visa tracking as directed by consultancies.

Sending transactional emails including stage updates, document reminders, OTP codes, and appointment confirmations.

Calculating commissions, incentives, and financial reporting for consultancy administrators.

Monitoring platform health, detecting bugs, and preventing fraudulent activity.

Improving the platform based on aggregated, anonymized usage patterns.

We do NOT sell your data.

Period. We never have and never will sell personal information to advertisers, data brokers, or any third party.

Service Providers

We share data with essential service providers: Google Cloud (hosting & storage), Neon and MongoDB Atlas (databases), a managed Redis service (caching), Khalti/eSewa (payments, where enabled), Gmail SMTP (email delivery), Sentry (error monitoring), and Firebase / Google Play Services (push notifications on the mobile app). Each provider is bound by their own privacy and security policies.

Legal Requirements

We may disclose information if required by law, court order, or government regulation — specifically under Nepali law and applicable international regulations.

Consultancy Data Ownership

Student data entered by a consultancy belongs to that consultancy. Qylantis processes it on their behalf. If a consultancy terminates their subscription, they may request a full data export before account deletion.

All traffic between your device and the platform is encrypted over HTTPS.

The database is hosted on Neon PostgreSQL, which encrypts stored data.

Documents are stored on Google Cloud Storage, which encrypts stored files, and are shared through time-limited signed links.

Passwords are stored only as salted one-way hashes (PBKDF2-SHA256). We never store plaintext passwords.

Sign-in tokens expire after 24 hours, and active sessions are tracked so they can be ended.

Role-based access control (RBAC) ensures users can only access data relevant to their role and consultancy.

Important actions, such as sign-ins and changes to records and settings, are written to an audit log that administrators can review.

We use localStorage for authentication tokens and user preferences (theme, session). We do not use third-party advertising cookies or tracking pixels.

Sentry is used for error monitoring. It receives error reports and stack traces so we can fix bugs, and it is configured not to attach personal data such as cookies or IP addresses by default.

We do not use Google Analytics, Facebook Pixel, or any advertising tracker.

Access

You can request a copy of all personal data we hold about you.

Correction

You can update your profile information at any time through the platform settings.

Deletion

You can request account deletion. For consultancy accounts, access is locked as soon as deletion is scheduled, and all associated data, including student records and documents, is permanently deleted 30 days later. Until then you can cancel the deletion or ask us for a full export of your data.

Data Export

Consultancy admins can export reports and records in CSV/Excel from within the platform, and we will provide a full export of your data on request.

Opt-Out

You can opt out of non-essential email notifications through your settings. Transactional emails (OTPs, security alerts) cannot be disabled.

Account data is kept while the account is active. When deletion is scheduled, the account is locked and its data is permanently deleted 30 days later.

Audit logs are kept for as long as the account is active.

Deleted records are removed from the live database; copies in our daily backups expire when those backups are removed after 30 days.

Records of payments made to us are kept for as long as tax and accounting law requires.

Mobile app

Our Android app is built with React Native and the Expo framework, and accesses the same account data described above. The only permission it asks you for is to show notifications. To upload a document you pick it with Android’s own file picker, which shares only the files you choose; the app does not use the camera and does not read your device storage.

Firebase Cloud Messaging (Google)

We use Firebase Cloud Messaging to deliver push notifications. For this we store a device push token. Google may process device identifiers in line with Google’s Privacy Policy.

Google Play Services

On Android, the app relies on Google Play Services for app distribution, integrity/security checks, and push-notification delivery. Google Play Services may collect device and diagnostic information governed by Google’s policies.

App updates

Updates to the app are delivered only through Google Play. The app does not download or install code on its own.

No advertising SDKs

The app contains no third-party advertising SDKs and no advertising identifiers are used.