Privacy

There are two relationships here and they are not the same, so it is worth being clear about which one applies to you.

In the language of Nepal’s Individual Privacy Act, 2075, the consultancy is the one collecting and using personal information, and OfficeYak is the service they use to do it.

Only what the product needs to do its job. In full:

We do not ask for, and have no use for, citizenship numbers, caste or ethnicity, political views, or health information. If a consultancy uploads a document containing something like that, it is treated like any other document: encrypted, restricted, and deleted when they delete it.

To run the service the consultancy is paying for, and for nothing else. Concretely: showing a counsellor their own students, telling somebody what is late, sending the invitation a student is waiting for, producing the month’s payroll, and proving afterwards who did what.

We do not sell it. We do not share it with advertisers. We do not build a profile of a student across consultancies, and there is no product here that would be improved by doing so.

When a consultancy has the practice tools switched on, the text a student writes in the tool they are using is sent to our AI provider to be answered or scored, along with the parts of their own profile that make the practice realistic, such as the country they are applying to and the course. Nothing else from their file goes with it: not their documents, not their fees, not their notes, not anything about another student.

Their work is not used to train anybody’s model, ours or the provider’s. A consultancy that wants none of this can switch the tools off for the whole office, and then nothing is sent at all.

Inside a consultancy, only the people their own owner has given the key to. Each person has a job, each job carries a set of permissions, and the server checks them on every screen rather than only hiding links. A consultancy can see exactly who holds which key on the Security page in their own console.

One consultancy cannot see another. That is not a setting anybody can switch off: every query in the product is written against the consultancy asking it.

At OfficeYak, access to customer data is limited to the people who keep the service running, is used only to fix something or to answer a request from the consultancy, and is recorded. We will not browse a consultancy’s students out of interest.

The outside services that touch data at all, and what each one gets:

We will hand data to a government or a court only when we are legally required to, and we will tell the consultancy it concerns unless we are forbidden from doing so.

On servers operated by Contabo GmbH in Germany. Backups are encrypted before they leave the machine, so a copy in transit or at rest somewhere else is unreadable without the key, which is not stored beside it.

That means personal information about people in Nepal is held outside Nepal. A consultancy that needs it held inside the country should talk to us before signing up, because today we cannot offer that.

Documents are encrypted with AES-256 before they touch the disk, under a key held apart from the data. Passwords are stored as scrypt hashes with a salt each, so nobody here can read one, including us. Sessions are signed, and changing a password ends every other one. Opening payroll or a student’s document is written to a trail the product itself cannot delete.

The full account of what protects your data, what we are doing next and what we will never do is on the security section of our front page, and every consultancy sees the same facts about their own account on their Security screen.

If you believe you have found a weakness, write to security@officeyak.com. We would rather hear it from you than from somebody else.

Under Nepal’s Individual Privacy Act, 2075, you can ask what is held about you, ask for it to be corrected, and ask for it to be deleted.

If you are a student or a parent, ask the consultancy advising you. They hold the file and they can correct it, export it or delete it themselves, usually faster than we can. If they do not answer, write to privacy@officeyak.com and we will help.

If you are a consultancy, most of this is a button in your own console. Anything it does not cover, write to privacy@officeyak.com and we will answer within seven days.

Nobody has to pay to exercise any of this, and asking for it will never affect the service you get.

Some students are under eighteen when their file is opened. Their consultancy is responsible for having a parent’s or guardian’s agreement before entering their information, which is the same responsibility they already have on paper. The product supports this directly: a parent can be given a read-only view of their child’s progress without being handed the whole file, and that access can be withdrawn at any time.

Three, and none of them follow anybody around the internet.

When this changes we will update the date at the top, and if the change actually matters to you we will email the consultancy rather than hoping somebody notices a new date.

Write to privacy@officeyak.com about anything on this page, or hello@officeyak.com about anything else. OfficeYak is run from Kathmandu, Nepal.