Privacy Policy
Last updated: 16 September 2026 · Version 1.0
How STEAMCUBE Private Limited handles personal data on Future Pathways Lab.
In Short
What this policy covers
Future Pathways Lab assesses a student's capabilities and builds them a plan. To do that we need to know who the student is and what they answered. We do not sell that information, we do not advertise to anyone, and we do not use a student's answers to train anything for another customer.
If the student is under 18
We ask a parent for consent first, and the parent can withdraw their consent at any time.
Who We Are
Data Fiduciary
Future Pathways Lab is developed, owned and operated by STEAMCUBE Private Limited. Under India's Digital Personal Data Protection (DPDP) Act 2023, we are the Data Fiduciary for the personal data described on this page.
Registered address
STEAMCUBE Private Limited, L Space, Logic Square, VIP Road, Near Kaloor Stadium, Kaloor, Kochi - 682017, Kerala, India.
What We Collect
About the student
Name, class and division, and year of birth; the institution they belong to, if they joined through a school; their email address and sign-in details; everything they enter in an assessment — their answers, and how long each question took them, since timing is part of the assessment and not surveillance; the reports and action plans produced for them, and any evidence they upload against their plan; and when they signed in, and from what kind of device.
About a parent (for students below 18 years old)
Name, email address and phone number, and the record of consent given, and of consent withdrawn.
About an institution and the people who work in it
The institution's name and address, and the name, email address and role of each counsellor, teacher and administrator using the platform.
What we do not collect
We do not collect caste, religion, community, income, health information or biometric data. We do not ask for any government identity number, and there is nowhere on the platform to enter one.
Why We Collect It
The purposes
To run the assessment the student came to take; to produce their report and their six-month action plan; to show that report to the people entitled to see it — the student, their parent and the school that enrolled them; to measure progress when a student is assessed again after their action plan; and to keep an account secure, and to answer a support request.
What we don't do with it
That is the whole list. We do not profile students for advertising, we do not build a marketing audience from this data, and we do not pass a student's results to a college, an employer or a recruiter.
Children Under 18
A Child under the DPDP Act
A student under 18 is a Child under the DPDP Act, and the Act treats their data with more care. So do we.
Parental consent
We ask a parent before we assess them. A parent's email address is required, the parent is asked to consent, and the assessment does not open until they have.
Withdrawing consent
A parent can withdraw consent at any time, without giving a reason and without contacting anybody first. Withdrawal is total — the child stops being visible to every role on the platform, including their school, counsellor and teacher. The student cannot sign in, and nothing further is served, including reports that were paid for.
No advertising to children
We do not track a child for advertising and we do not show them advertisements. The Act forbids it and the platform has no advertising in it. A student aged 18 or over manages their own consent and decides for themselves what a parent may see.
Who Else Sees It
Four places, and no further
Personal data on this platform goes to the student; their parent, where consent applies and according to the student's age; the institution that enrolled them — its counsellors, teachers and administrators, each seeing only the students they are responsible for (a student who signed up directly, without a school, has no institution and no school sees them); and Microsoft, as our hosting provider.
Microsoft as hosting provider
The platform runs on Microsoft Azure and the data sits in Azure's East Asia region. Microsoft processes it on our instructions and for no purpose of its own. If your school bought Future Pathways Lab through Microsoft Marketplace, Microsoft also handles that payment and invoices the school.
No sale of data
We do not sell personal data. We do not share it with data brokers, advertisers or analytics companies. We would disclose data if a court or a law required it, and we would tell the person first unless the law forbade that.
How Long We Keep It
While the account is active
A student's profile, assessments and reports are kept, because the whole point is a profile that grows over several years.
After a school's licence ends
The data is kept for 30 days and then permanently deleted. The 30 days exist so a school that renews late does not lose its students' history, and so a cancellation made by mistake can be undone.
After a consent withdrawal or account deletion request
The data is deleted permanently, without any further notice, and there is no way we can restore it. Some records have to stay — an invoice, and the record that a consent was given and later withdrawn — since deleting the proof of consent would leave us unable to show we ever had it.
Where It Is Stored And How It Is Protected
Storage and encryption
Stored on Microsoft Azure, in the East Asia region. Encrypted in transit and at rest, with Role Based Access Control implemented.
Access controls
Reachable only by the people the platform grants access to, checked on every request rather than only at sign-in. Reports are served through links that check who is asking — a report link is not a public address that works for anybody who has it.
AI use
Where AI is involved in any part of the Future Pathways Lab process, no personally identifiable data is shared with it.
Your Rights
Under the DPDP Act 2023
You may ask what personal data we hold about you or your child; ask us to correct anything wrong or out of date; ask us to erase it; withdraw a consent you gave, at any time; nominate somebody to exercise these rights on your behalf if you are unable to; and raise a grievance, and have it answered.
What withdrawal does and doesn't do
Withdrawing consent does not make what happened before it unlawful, and it does not undo a report that was already produced. It stops everything from that point.
How to exercise any of these
Write to dpo@steamcube.in from the email address on the account, and tell us the student's name and school. We will answer within one working day and complete the request as quickly as possible.
Grievances
Our Data Protection Officer
Reachable at dpo@steamcube.in. Write with the word "grievance" in the subject line and it will be treated as a formal complaint rather than a support question.
If you are not satisfied
You may complain to the Data Protection Board of India.
Changes To This Policy
Staying informed
If we change how we handle personal data, we change this page and move the date at the top. If a change is significant — new data collected, or a new recipient — we tell account holders by email rather than relying on somebody noticing a date.
Contact
Questions or concerns?
Privacy questions go to dpo@steamcube.in. Everything else goes to support@futurepathwayslab.com.
STEAMCUBE Private Limited
Email: dpo@steamcube.in
Address: L Space, Logic Square, VIP Road, Near Kaloor Stadium, Kaloor, Kochi - 682017, Kerala, India