Privacy Policy

This Privacy Policy explains what personal information Nishan (“we,” “us,” or “the Organization”) collects, how we use and protect it, and the choices you have. It applies to our website, our student research journal, our AI research assistant, our mentorship program, and our outreach activities (together, the “Services”). Please read it carefully. Because many of the people we serve are students under the age of eighteen, we take particular care with the information of minors, as described in Section 5.

Who We Are

Nishan is a student-led nonprofit that supports research and learning in science, technology, engineering, and mathematics. We operate a peer-reviewed student research journal, an AI research assistant, a mentorship program, and educational outreach. This policy covers all of these. It does not cover the practices of any third-party website or service we link to or integrate with, each of which has its own privacy policy.

If you have questions about this policy or your information, contact us at privacy@nishaninstitute.com. If you are a parent or guardian with questions about a child's information, see Section 5, which is written for you.

1. Information We Collect

We collect information in three ways: information you give us, information we receive automatically when you use the Services, and information we receive from other people or sources. We only collect what we need to run the Services and to do the things described in Section 2.

1.1 Information you provide to us

• Account and contact information. When you create an account or sign up for updates, we collect your name, email address, and, where relevant, your school, grade level, and general location. You may choose to give us a phone number or other contact details.
• Journal submissions. When you submit a manuscript, we collect the manuscript and everything in it, along with author names, affiliations, ORCID identifiers, and the contact details of the corresponding author. We also collect the correspondence and review records connected to your submission.
• Mentorship information. When you apply to or take part in the mentorship program, we collect the information in your application, your areas of interest, your goals, and records of your participation. Where a participant is under eighteen, we also collect the parental consent and contact information described in Section 5.
• Communications. When you email us, use a contact form, or message us, we collect your name, contact information, and the contents of your message.
• Surveys and feedback. If you take part in a survey, give feedback, or rate part of the Services, we collect your responses.
• Event and outreach information. When you register for or attend a workshop, presentation, or outreach event, we collect registration details and, where you have given the appropriate consent, any photographs or recordings made at the event.
• Payment information. We do not charge students to submit to the journal or to take part in our programs. If we ever collect a donation or a payment, it is processed by a third-party payment provider, and we receive only limited transaction details, not your full card number.

1.2 Information we receive automatically

When you visit our website or use the Services, some information is collected automatically by your browser or device. We call this Technical Information.

• Device and connection data. Your device type, operating system, browser, language, time zone, and internet protocol (IP) address, which gives an approximate location.
• Usage data. The pages you view, the links you click, the dates and times of your visits, the features you use, and how you move through the Services.
• Log and error data. Records that help us keep the Services running, including error reports and the state of the application when a problem occurs.

1.3 Information from other sources

We may receive information about you from a mentor, a teacher, a co-author, or a parent or guardian who provides it as part of a program or a submission. We may also receive limited information from the service providers that help us run the Services, such as our website host or our analytics provider. Where someone gives us information about you, we expect them to have the right to do so.

2. How We Use Information

We use the information we collect for the following purposes:

• To create and manage your account and to provide the Services you ask for.
• To run the journal: to receive and review submissions, manage peer review, communicate with authors and reviewers, and publish accepted work.
• To run the mentorship program and to match, support, and supervise participants.
• To operate and improve the AI research assistant, as described in Section 3.
• To respond to your messages and provide support.
• To send you service messages, and, where you have agreed, occasional updates about our programs. You can unsubscribe from non-essential messages at any time.
• To understand and improve the Services, including through analytics and research on how the Services are used.
• To keep the Services safe: to detect, prevent, and address fraud, abuse, security issues, and violations of our Terms of Service.
• To meet our legal, tax, and regulatory obligations, and to protect the rights, safety, and property of our participants, our organization, and others.

We do not sell your personal information, and we do not use it to serve third-party advertising. We also do not use the personal information of minors for any form of behavioral advertising or profiling.

3. The AI Research Assistant

Our AI research assistant helps students explore topics, find sources, and develop their work. It is powered by one or more third-party AI providers. When you use the assistant, your Inputs are sent to that provider to generate the Outputs, and the provider processes them under its own terms and privacy policy.

We use Inputs and Outputs to operate the assistant, to keep it safe, and to improve how the Services work. We may review conversations that are flagged for safety or that you report to us, so that we can prevent misuse and improve the assistant. We do not use the content of student conversations to train our own models, and we ask our providers to limit their use of that content in line with their policies.

Please do not enter sensitive personal information into the assistant, such as government identification numbers, financial account details, health information, or information about other people that you are not permitted to share. The assistant produces information that can be wrong or incomplete, and it is not a substitute for professional advice. You are responsible for checking anything important before you rely on it.

4. How We Share Information

We share personal information only as described below. We do not sell it.

• Service providers. We share information with the companies that help us run the Services, such as our website host, our email provider, our analytics provider, and our AI provider. They may use the information only to perform services for us and must protect it.
• Within the journal process. A submission and its contents are shared with the editors and reviewers who handle it, under the confidentiality rules in our author guidelines. Accepted articles are published and become publicly available, including the author names and affiliations.
• Within the mentorship program. Information is shared between a participant and their assigned mentor and the staff who supervise the program, as needed to run it and to keep participants safe.
• Legal and safety reasons. We may disclose information where we believe in good faith that it is necessary to comply with the law or a legal request, to enforce our Terms of Service, to prevent harm, or to protect the rights, safety, and property of any person, including where we are required to report a concern about the safety of a child.
• Aggregated or de-identified information. We may share information that has been aggregated or de-identified so that it does not identify you.
• With your consent or direction. We share information in other ways when you ask us to or agree to it, including when you choose to make your work public.
• Business changes. If our organization merges with or transfers its programs to another nonprofit or entity, information may be transferred as part of that change, subject to this policy.

5. Children and Minors

This section is important, and it is written for students and for parents and guardians. Because we serve students, we expect that many of the people who use the Services are under the age of eighteen. We are committed to protecting their information and their safety, and we follow the United States Children's Online Privacy Protection Act (COPPA) and other laws that protect young people.

5.1 Age requirements

You must be at least thirteen years old to create an account or use the Services on your own. We do not knowingly allow children under thirteen to create an account or to provide personal information without verifiable parental consent. If we learn that we have collected personal information from a child under thirteen without that consent, we will delete it promptly.

Some outreach activities, such as a presentation at a school, may involve children under thirteen. In those cases we work through the school or the child's parent or guardian, we collect as little information as possible, and we obtain the consent required by law before collecting personal information.

5.2 Parental consent for participants under eighteen

If you are under eighteen and you want to take part in the mentorship program, submit to the journal, or join a program that involves ongoing participation, we require the consent of a parent or guardian first. The consent form explains what we collect, how mentors and participants communicate, and how we keep participants safe. A parent or guardian may refuse or withdraw consent at any time, and we will end the child's participation and delete their information where we are not required to keep it.

5.3 What we collect from minors, and what we do not

For a minor participant we collect only what we need: their name, contact information, school and grade, the information in their application or submission, parental consent and contact details, and records of their participation. We do not use a minor's information for advertising, and we do not build profiles of minors. We do not publish a minor's photograph, full name in a promotional context, or other identifying details without the specific consent of a parent or guardian, collected through a media release.

5.4 Keeping participants safe

The mentorship program follows a safeguarding policy and a code of conduct. Communication between mentors and minor participants takes place through channels the Organization can oversee, and is not moved to private or personal channels. Mentors are given rules of conduct, and participants and parents can report a concern to us at safeguarding@nishaninstitute.com. If we believe a child is at risk of harm, we may contact a parent or guardian or the appropriate authorities.

5.5 Rights of parents and guardians

A parent or guardian may review the personal information we hold about their child, ask us to correct it, ask us to delete it, and refuse to allow us to collect more. To make a request, contact us at privacy@nishaninstitute.com. We will verify that you are the child's parent or guardian before we act on the request.

6. Cookies and Analytics

We use cookies and similar technologies to make the website work, to remember your preferences, and to understand how the Services are used. Some cookies are essential and cannot be turned off. Others, such as analytics cookies, help us improve the Services and can be controlled.

You can manage cookies through your browser settings, and where required we ask for your consent through a banner when you first visit. We use a small number of analytics providers to understand traffic and usage; these providers are listed with our other service providers, and their use of information is governed by their own policies. We do not use cookies to serve third-party advertising.

7. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights over your personal information. We honor these rights for all of our users as a matter of practice, subject to the limits allowed by law.

• Access. You can ask what personal information we hold about you and request a copy of it.
• Correction. You can ask us to correct information that is inaccurate or out of date.
• Deletion. You can ask us to delete your personal information, subject to information we must keep for legal reasons or to run a program you are enrolled in.
• Portability. Where it applies, you can ask for a copy of certain information in a portable format.
• Objection and restriction. You can object to or ask us to restrict certain uses of your information.
• Withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect processing that already took place.
• Opt out of messages. You can unsubscribe from non-essential emails using the link in the message or by contacting us.

To exercise any of these rights, contact us at privacy@nishaninstitute.com. We may need to verify your identity first. We will not treat you differently for exercising your rights. If a request concerns a minor, a parent or guardian may make it on the child's behalf, as described in Section 5.

8. Data Retention

We keep personal information only for as long as we need it for the purposes in this policy, and then we delete it or make it anonymous. How long we keep information depends on what it is:

Where we keep information in an anonymous or aggregated form that can no longer identify you, we may retain and use it without the time limits above.

9. How We Protect Information

We use reasonable technical and organizational measures designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include limiting who can access information, using reputable service providers, and protecting accounts and connections. No method of storage or transmission is completely secure, so we cannot promise absolute security. If we ever learn of a data breach that affects you, we will notify you and the appropriate authorities as required by law.

10. International Users and Data Transfers

We are based in the United States, and we operate the Services from there. If you use the Services from outside the United States, your information will be transferred to and processed in the United States and in the countries where our service providers operate. These countries may have data protection laws that differ from those in your country. Where the law requires it, we use appropriate safeguards, such as the standard contractual clauses approved by the European Commission, to protect information transferred from the European Economic Area, the United Kingdom, and Switzerland. You can contact us for more information about these safeguards.

11. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, or a place with similar law, we process your personal information only where we have a legal basis to do so. The basis depends on the purpose:

Where we rely on legitimate interests, we have weighed those interests against your rights. You can ask us for more detail, and you can object to this processing as described in Section 7.

12. Regional Disclosures

12.1 United States state privacy rights

If you live in California or another U.S. state with a comprehensive privacy law, you have the rights described in Section 7, including the right to know, to access, to correct, and to delete your personal information, and the right not to be discriminated against for exercising them. We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by these laws. You may use an authorized agent to make a request, and we will verify the request before we act on it.

12.2 European Economic Area and United Kingdom

If you are in the European Economic Area or the United Kingdom, the legal bases in Section 11 apply, and you have the rights in Section 7 under the General Data Protection Regulation (GDPR) and the UK GDPR. You also have the right to complain to your local data protection authority. The data controller for your information is Nishan, at the address in Section 15.

13. Third-Party Links and Services

The Services may link to or connect with websites and services we do not control, such as our AI provider, an ORCID profile, a data repository, a payment provider, or a social media page. When you use one of these, you provide information directly to that third party, and its own privacy policy governs what it does with that information. We are not responsible for the practices of third parties. Review their policies before you use them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the effective date at the top and, where appropriate, tell you by email or through the Services. If a change affects information we have collected from a minor, we will obtain a new parental consent where the law requires it. Your continued use of the Services after a change means you accept the updated policy.

15. How to Contact Us

If you have a question, a request, or a complaint about your information or this policy, contact us. We take privacy concerns seriously and will respond as quickly as we can.

This Privacy Policy should be read together with our Terms of Service and our journal author guidelines.