EduLink Portal Privacy Policy (MVP)

What we collect

• Information you submit (enquiry, notes, preferences) and facts you enter in Profile Studio.
• Contact details needed to deliver the service (e.g. email, optional WeChat).
• Minimal product events (page views / key actions) and attribution (utm/referrer/landing).

How we use AI

• We use AI only when you explicitly request generation (recommendations/docs/visa/trip).
• We try to minimize direct identifiers in model context and focus on structured facts + business inputs.
• AI outputs are drafts and not legal/visa advice; paid adviser review is a separate service.

Retention

• Portal events are retained for 90 days by default (TTL).
• Case/enquiry/profile/recommendation records are kept for delivery and audit unless you request deletion.

Your rights: export & delete

• You can export your data as JSON in Profile Studio.
• You can submit a deletion request; admins will process it and perform best-effort DynamoDB deletion.
• Cognito account disable/delete is handled by admins with approval + explicit confirmation (typically disable first, then delete).

Security

• Public endpoints are protected by WAF and rate limiting; Function URLs are not used as public entry points.
• We apply least-privilege permissions for backend access.

Contact

For privacy questions or export/deletion assistance, contact info@edulink.co.nz.