Who this applies to
- Consultancies (our customers) and their owners and staff who sign up and use the dashboard.
- Clients of a consultancy (for example students) who register through a consultancy’s QR code or form, or upload documents through the client portal.
For client data, the consultancy decides what is collected and why; Nayaro Flow processes that data on the consultancy’s behalf. Questions about your own record should go first to the consultancy you registered with.
Data we collect
- Account data: name, email address, phone number, organization name and a hashed password for consultancy staff.
- Registration data: details a client enters on a consultancy’s form, such as name, contact details, date of birth, chosen service, destination country and intake.
- Documents: files uploaded by staff or clients (for example passports, academic certificates and letters), and PDFs the service generates.
- Google account data: when a consultancy connects Google Drive, the email address of the connected Google account and an OAuth refresh token (see below).
- Technical data: server logs (IP address, browser type, time of request) and an activity log of actions inside an organization, used for security and troubleshooting.
Google Drive and Google user data
A consultancy owner can connect their organization’s Google account using Google OAuth. Nayaro Flow requests only the drive.file permission (“See, edit, create and delete only the specific Google Drive files that you use with this app”).
- What we access: only folders and files that Nayaro Flow itself creates. We cannot see, read or change any other file in your Google Drive.
- What we do with it: create a “Nayaro Clients” folder and one subfolder per client, upload that client’s documents into it, rename files we created, and share the main folder with the staff members you add (as editors, never by public link). We also read the email address of the connected account to show which account is connected.
- Storage: files are stored in the consultancy’s own Google Drive and count against its storage. We store the OAuth refresh token encrypted and never show it to anyone. Access tokens are short-lived and not stored.
- No other use: we do not use Google user data for advertising, do not sell it, do not use it to train AI or machine learning models, and do not allow humans to read it except with your explicit permission, when needed for security, to comply with the law, or for our internal operations in aggregated and anonymized form.
- Disconnecting: an owner can disconnect at any time in Settings → Google Drive, which revokes the token at Google and deletes it from our database. You can also remove access at myaccount.google.com/permissions. Files already in your Drive stay there and remain yours.
Nayaro Flow’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use data
- To provide the service: register clients, generate documents and checklists, organize uploads, and send notifications.
- To read uploaded documents when a consultancy uses AI features (for example extracting details from a passport or drafting a letter). Documents are sent to our AI provider only for that request.
- To send account emails such as sign-up verification codes and service notices.
- To keep the service secure, prevent abuse and fix problems.
- To bill consultancies for their subscription.
We do not sell personal data and do not use it for advertising.
Service providers
We use a small number of providers to run Nayaro Flow, each only for its part of the service:
- Render (application server and database) and Vercel (website hosting).
- Google (Google Drive storage, when a consultancy connects it).
- Resend or the consultancy’s own email server (sending emails).
- Google Gemini or Anthropic (AI document reading and drafting, only when those features are used).
We may also disclose data if required by law or to protect the rights and safety of our users or the public.
Security
- All traffic is encrypted with HTTPS.
- Passwords are hashed; Google tokens, email passwords and portal codes are encrypted at rest.
- Each consultancy can see only its own data. Drive folders are shared only with named staff accounts, never by public link.
- Uploaded files are kept on our server only temporarily and deleted a few days after they reach Google Drive.
Retention and deletion
We keep account and client records for as long as the consultancy’s account is active. A consultancy can disconnect Google Drive at any time, and can ask us to delete specific client records or to close its account and delete its data by emailing info@nayaro.tech. Documents stored in a consultancy’s Google Drive are controlled by that consultancy and are not deleted by us.
Your rights
You can ask to access, correct or delete your personal data. Clients of a consultancy should contact that consultancy first; you can also email us and we will help or pass the request on.
Children
Nayaro Flow is a business tool for consultancies. Where a consultancy registers clients under 18, the consultancy is responsible for obtaining any consent required from a parent or guardian.
Changes
We may update this policy. We will change the date at the top and, for significant changes, notify consultancy owners by email or in the dashboard.
Contact
Nayaro Tech, Nepal · info@nayaro.tech · nayaro.tech
See also our Terms of Service.