1. Controller identity
ASKCECOS is operated by the Center for Digital Governance and Agentic Innovation (CDGAI), a research and engineering center at CECOS University of IT and Emerging Sciences, F-5, Phase 6, Hayatabad, Peshawar, KP, Pakistan.
Contact: cdgai@cecos.edu.pk · +92-91-5860291-3
ASKCECOS is licensed to institutions (the “Customer”). The Customer is the data controller; CDGAI acts as the data processor on the Customer's behalf in accordance with the Data Processing Agreement.
2. Information we process
We process the following categories of personal data on behalf of the Customer:
- Message content — WhatsApp messages sent to the institution's official number.
- Phone number — stored as a SHA-256 hash for conversation continuity; the raw number is held in Redis with a short TTL and is never written to permanent storage.
- Language and timestamps — to route queries and generate analytics.
- Knowledge base content — FAQs, policies, and academic calendars uploaded by institution administrators.
- Admin panel activity — logins, ticket actions, and threshold changes performed by institution staff.
We do not collect payment card numbers, CNICs, or financial account numbers unless the institution explicitly configures its knowledge base to include them, in which case they are redacted from logs and analytics.
3. Legal basis for processing
Processing is carried out on the following bases:
- Contractual necessity — processing is required to provide the ASKCECOS service to the Customer under the Terms of Service.
- Legitimate interests — aggregate analytics and service reliability monitoring, balanced against data-minimisation measures.
- Legal obligation — audit log retention for security and compliance purposes.
Student message senders interact with ASKCECOS because their institution has deployed it on their official WhatsApp Business number. Institutions are responsible for ensuring their students are informed that an AI assistant operates on that number (e.g., via welcome message, student handbook, or website notice).
4. How we use information
- To generate AI responses to student and staff queries.
- To route low-confidence queries to human staff (smart handoff).
- To produce aggregate, anonymised analytics for the institution.
- To maintain audit logs of admin panel activity.
- To detect and prevent abuse of the messaging pipeline.
We do not use student message content to train or fine-tune foundation models. We do not build persistent profiles of individual WhatsApp users or track them across conversations beyond what is necessary to maintain a single session.
Automated decision-making: ASKCECOS uses an AI confidence-scoring system that automatically routes messages either to an AI-generated response or to a human agent. No legally or similarly significant decision about a student is made solely by automated means — smart handoffs always involve human review.
5. Data retention
Conversation data is retained for the period configured by the institution (default: 12 months). Audit logs are retained for at least 12 months. Institutions may request earlier deletion at any time by contacting cdgai@cecos.edu.pk.
Raw phone numbers in Redis are automatically expired within 24 hours of inactivity. Hashed phone identifiers in PostgreSQL are retained for the duration of the institution's subscription and deleted within 30 days of contract termination.
7. Your rights
Students and staff whose data is processed through ASKCECOS may contact their institution to exercise the following rights:
- Access — request a copy of personal data held about you.
- Correction — request correction of inaccurate data.
- Deletion — request erasure of your personal data.
- Restriction — request that processing be limited.
- Objection — object to processing carried out on the basis of legitimate interests.
- Withdraw consent — where processing is consent-based, you may withdraw at any time without penalty (this does not affect prior processing).
Institutions may also direct requests to cdgai@cecos.edu.pk. We will respond within 30 days.
Children: ASKCECOS is not directed at children under 13. If you believe a child under 13 has sent messages through the service, please contact your institution's administrator or email us at the address above.
8. Security
We use TLS 1.3 in transit, AES-256 encryption at rest, role-based access control, and immutable audit logging. Phone numbers are stored only as SHA-256 hashes in permanent storage. See our Security page for the full list of measures.
9. Changes to this policy
We will post any material changes to this policy on this page with a new effective date and notify Customer institutions by email at least 14 days in advance.
10. Contact
CDGAI, CECOS University of IT and Emerging Sciences, F-5, Phase 6, Hayatabad, Peshawar, KP — Pakistan. cdgai@cecos.edu.pk · +92-91-5860291-3