Privacy Policy

Effective date: 3 October 2026
Last updated: 3 October 2026

This Privacy Policy explains how Hash Buckets, a sole proprietorship registered and operating in Pakistan ("Hash Buckets", "Scholars Copilot", "we", "us", or "our"), collects, uses, stores, discloses, and otherwise processes information in connection with the Scholars Copilot platform, website, beta program, and related services (collectively, the "Services").

Scholars Copilot is a product operated by Hash Buckets.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Scope

This Privacy Policy applies to information:

• provided directly to us;
• collected when you use Scholars Copilot;
• generated through your interaction with the Services;
• provided to us by an organization using Scholars Copilot;
• provided during support, onboarding, beta testing, or product-feedback activities; and
• collected through our websites, applications, communications, and related Services.

This Privacy Policy does not necessarily apply to information that an agency or other customer independently collects and processes outside Scholars Copilot.

Where an organization uses Scholars Copilot to process information relating to its students, applicants, employees, or other individuals, that organization may have its own privacy obligations and policies governing that information.

2. Important distinction for customer data

Scholars Copilot is designed for use by education and student-recruitment agencies.

An agency may enter information about its students, applicants, parents, employees, or other individuals into Scholars Copilot.

In these circumstances, the agency generally determines:

• what information it collects;
• why it collects the information;
• what legal basis or authorization it relies upon;
• who can access it;
• how long it should be retained; and
• how the information is used.

Accordingly, the agency is generally responsible for the legality of its collection and use of that information.

Hash Buckets processes such information primarily to provide Scholars Copilot to the agency.

Where applicable, our processing relationship with the agency is governed by our Data Processing Agreement (DPA).

3. Information we may collect

Depending on how you interact with Scholars Copilot, we may collect several categories of information.

3.1. Account and organization information

This may include:

• name;
• email address;
• telephone number;
• organization name;
• job title or role;
• account credentials;
• subscription or plan information;
• account preferences; and
• information required to administer the account.

3.2. Customer data

Agencies using Scholars Copilot may submit information concerning their business operations and customers.

This may include:

• student records;
• applicant information;
• educational history;
• application information;
• communications;
• documents;
• identity information;
• passport information;
• financial information;
• immigration-related information;
• photographs;
• contact information;
• family or sponsor information;
• employee information; and
• other information entered by the agency or its Authorized Users.

The agency is responsible for determining what information it uploads and whether it has the necessary legal rights and permissions to do so.

4. Information collected automatically

When you use Scholars Copilot, we may collect technical and usage information necessary to operate and secure the Services.

Depending on the implementation, this may include:

• IP address;
• browser and device information;
• operating system;
• login and authentication information;
• timestamps;
• pages or features accessed;
• application events;
• error information;
• performance information;
• security logs; and
• information concerning interactions with the Services.

We may use this information to operate, maintain, troubleshoot, secure, and improve Scholars Copilot.

5. Information you provide to us

We may receive information when you:

• create an account;
• participate in the beta program;
• contact us;
• request support;
• provide product feedback;
• participate in interviews;
• report bugs;
• communicate with our team;
• request demonstrations or onboarding;
• complete forms;
• enter information into Scholars Copilot; or
• otherwise interact with us.

6. How we use information

We may use information for the following purposes:

Providing the Services

To:

• create and administer accounts;
• provide Scholars Copilot functionality;
• store and retrieve Customer Data;
• process requests;
• provide support;
• facilitate integrations;
• maintain service availability; and
• provide features requested by customers.

Security and abuse prevention

To:

• protect accounts;
• detect unauthorized activity;
• investigate security events;
• prevent fraud and abuse;
• protect the Services and infrastructure; and
• enforce applicable agreements.

Product development

To:

• understand how customers use Scholars Copilot;
• identify bugs;
• improve workflows;
• develop new functionality;
• test product changes;
• evaluate performance; and
• improve reliability and usability.

Communications

To:

• respond to inquiries;
• provide service notifications;
• communicate about beta participation;
• provide important account information;
• provide security notices; and
• communicate changes to the Services or applicable agreements.

Legal compliance

To comply with applicable legal obligations and respond to valid legal requests.

7. Product feedback

If you voluntarily provide:

• suggestions;
• recommendations;
• feature requests;
• bug reports;
• workflow feedback;
• interview responses;
• usability observations; or
• other product feedback,

we may use that feedback to develop and improve Scholars Copilot.

Unless otherwise agreed in writing, feedback does not entitle you to ownership, royalties, compensation, or attribution.

Customer or domain-expert agreements may contain additional provisions governing feedback and intellectual property.

8. Aggregated and de-identified information

We may create aggregated, statistical, or de-identified information from information available to us where permitted by applicable law.

Such information may be used to:

• understand product usage;
• measure performance;
• identify trends;
• improve Scholars Copilot;
• develop new features; and
• conduct internal analysis.

We will not intentionally use information in a manner intended to identify an individual from properly de-identified information.

9. Artificial intelligence

Scholars Copilot may include features involving:

• artificial intelligence;
• machine learning;
• OCR;
• document processing;
• extraction;
• classification;
• summarization;
• embeddings;
• search;
• automated assistance; or
• other automated technologies.

The availability and implementation of these features may change as Scholars Copilot develops.

Where a customer connects its own AI provider or API key, the customer is responsible for that third-party provider relationship and should review the provider's applicable privacy and data-processing terms.

AI-generated results may be inaccurate, incomplete, outdated, or unsuitable for a particular purpose.

Customers remain responsible for reviewing AI-generated outputs before relying on them for consequential decisions, submissions, applications, communications, or other important actions.

Scholars Copilot does not make admissions, immigration, educational, financial, legal, or other professional decisions on behalf of customers.

10. Third-party services

Scholars Copilot may rely on third-party providers for services such as:

• cloud infrastructure;
• database hosting;
• file storage;
• backups;
• monitoring;
• communications;
• authentication;
• analytics;
• AI services;
• application infrastructure; and
• other technical or operational services.

These providers may process information as necessary to provide their services.

Where appropriate, we seek to impose contractual obligations and security requirements on service providers that process Personal Data on our behalf.

A current list of material subprocessors may be maintained separately and may be updated as the Services evolve.

Subprocessor list: Available upon request by contacting hello@scholarscopilot.com.

11. Data sharing

We may disclose information to:

Service providers

Third parties that provide infrastructure, hosting, storage, support, security, communications, or other services necessary to operate Scholars Copilot.

Customer-authorized users

Information submitted by an agency may be accessible to its Authorized Users according to the access controls and permissions configured by that agency.

Legal and regulatory authorities

Where disclosure is required by applicable law, court order, governmental request, or other valid legal process.

Security and protection

Where reasonably necessary to protect the rights, safety, security, property, or integrity of Hash Buckets, Scholars Copilot, our users, or third parties.

Business transfers

If Hash Buckets undergoes a restructuring, merger, acquisition, financing, sale, transfer, or other transaction involving Scholars Copilot, information may be transferred as part of that transaction, subject to applicable law.

We do not sell Customer Data to third parties.

12. Customer responsibilities

Organizations using Scholars Copilot are responsible for:

• collecting Personal Data lawfully;
• providing appropriate privacy notices;
• obtaining required permissions or consents where applicable;
• establishing appropriate legal bases for processing;
• ensuring that their Authorized Users have appropriate access;
• maintaining accurate information where required;
• responding to Data Subject requests where they are responsible for doing so;
• determining appropriate retention periods;
• ensuring that uploaded documents may lawfully be processed; and
• complying with applicable privacy and data-protection laws.

Our DPA contains additional provisions concerning customer responsibilities and processing relationships.

13. Security

We take reasonable measures designed to protect information processed through Scholars Copilot.

Depending on the relevant service architecture, these measures may include:

• access controls;
• authentication controls;
• encryption in transit;
• infrastructure security controls;
• database access restrictions;
• storage access controls;
• backup mechanisms;
• monitoring and logging where implemented;
• administrative access restrictions; and
• incident-response procedures.

However, no internet-connected service can be guaranteed to be completely secure.

Customers are also responsible for protecting their account credentials, devices, Authorized User access, API keys, and connected third-party services.

14. Security incidents

If we confirm a Security Incident affecting Customer Personal Data, we will follow our applicable incident-response procedures and provide notification where required under the applicable agreement or law.

Where an agency is responsible for determining whether individuals or regulators must be notified, the agency remains responsible for making those determinations.

Our DPA contains additional provisions concerning Security Incidents involving Customer Personal Data.

15. Data retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, the applicable customer agreement, or as required by law.

For Customer Data, the applicable customer agreement and DPA govern the retention and deletion process.

Following termination of a customer relationship, customers generally have a 30-day period to export their Customer Data.

After that period, Customer Data may be deleted from active production systems.

Backup copies may persist until overwritten or deleted according to applicable backup and disaster-recovery processes.

We may retain certain information where reasonably necessary for:

• legal compliance;
• security;
• fraud prevention;
• dispute resolution;
• establishment or defense of legal claims; or
• legitimate business records.

16. International processing

Scholars Copilot may use infrastructure and service providers located in countries other than the country where you or a Data Subject is located.

This means information may be processed internationally.

Customers are responsible for determining whether their use of Scholars Copilot involves international data-transfer requirements applicable to them.

Where required and reasonably applicable, we will seek to implement appropriate contractual or other safeguards for international processing.

17. Data subject rights

Depending on applicable law and your relationship with Scholars Copilot, you may have rights concerning your Personal Data.

These may include rights to:

• request access;
• request correction;
• request deletion;
• request restriction of processing;
• object to certain processing;
• request portability; or
• withdraw consent where processing is based on consent.

The availability and scope of these rights varies depending on applicable law and the role of the relevant organization.

Customer-managed information

If your information was submitted to Scholars Copilot by an agency or other organization, you should generally contact that organization first because it may control the processing of your information.

We may assist the relevant customer where required and reasonably practicable.

Direct interactions with Hash Buckets

If you interact directly with Hash Buckets and believe we independently control your Personal Data, you may contact us using the details below.

18. Children's and minors' information

Scholars Copilot may be used by education and student-recruitment agencies that process information concerning students who may be minors.

Where an agency processes information concerning minors, the agency is responsible for determining and complying with applicable requirements concerning parental or guardian permissions, notices, consent, age restrictions, and other legal protections.

Customers should not submit information concerning minors unless they are legally authorized to do so.

Where applicable law imposes additional requirements on Hash Buckets, we will take reasonable measures appropriate to those requirements.

19. Cookies and similar technologies

Scholars Copilot and related websites may use cookies or similar technologies necessary for:

• authentication;
• maintaining sessions;
• security;
• remembering preferences;
• measuring service usage; and
• improving functionality.

Where applicable, additional cookie or consent controls may be provided through the relevant website or application.

20. Marketing communications

We may send service-related communications that are necessary for operating your account or providing the Services.

These may include:

• security notices;
• service announcements;
• account notifications;
• billing or subscription communications;
• important contractual notices; and
• product or operational updates.

Where permitted by law, we may also send optional marketing communications.

You may opt out of promotional communications using the unsubscribe mechanism provided in the relevant communication.

You may continue to receive essential service communications after opting out of marketing communications.

21. Account and credential security

You are responsible for maintaining the confidentiality of your credentials and for activity conducted through your account, except to the extent caused by our own failure to maintain required security controls.

You should:

• use strong and unique credentials;
• avoid sharing credentials;
• restrict Authorized User access;
• remove former users promptly;
• protect API keys;
• use secure devices; and
• notify us promptly if you suspect unauthorized account access.

22. Your choices

Depending on the Services and applicable law, you may be able to:

• update account information;
• control Authorized User access;
• export Customer Data;
• request correction or deletion;
• change certain account settings; or
• opt out of optional marketing communications.

Certain information may need to be retained where required by law or reasonably necessary for security, contractual, or legitimate business purposes.

23. Confidentiality

Information provided to us in connection with Scholars Copilot may also be protected under contractual confidentiality obligations.

Where an applicable customer agreement or DPA imposes confidentiality obligations that are more specific than this Privacy Policy, those contractual obligations continue to apply.

24. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Updates may be made to reflect:

• changes to Scholars Copilot;
• new features;
• changes to our data practices;
• changes in infrastructure;
• changes in legal requirements; or
• operational or security developments.

When appropriate, we will provide notice of material changes.

The "Last updated" date at the beginning of this Privacy Policy indicates when it was most recently revised.

25. Governing law

This Privacy Policy is generally governed by the laws applicable to Hash Buckets and the applicable customer relationship, subject to any mandatory data-protection rights or requirements applicable to an individual.

Where a customer agreement contains specific governing-law and dispute-resolution provisions, those provisions govern disputes between Hash Buckets and that customer to the extent permitted by law.

26. Contact us

For privacy-related questions, requests, or concerns, contact:

For requests concerning Personal Data processed on behalf of an agency, please identify the relevant agency or organization where possible so that we can determine the appropriate party to handle the request.

27. Effective date

This Privacy Policy is effective from 3 October 2026 and applies to information processed by Hash Buckets in connection with Scholars Copilot from that date, subject to applicable law and any contractual arrangements governing specific customers.