Privacy Notice

Effective: [gep_legal field=”policy_effective”] · Version [gep_legal field=”version”]

This notice explains what personal data [gep_legal field=”brand”] collects, why, how long we keep it, who we share it with and how you can use your rights. [gep_legal field=”brand”] is operated by [gep_legal field=”legal_entity_name”], [gep_legal field=”registered_address”] (“we”).

1. What we collect and why

Data	Why we need it	Required?
Name, email address, password (stored only as a one-way hash)	To create and secure your account and to contact you about it	Yes
Whether you are 18 or older	To apply the rules for children’s data (see “Children”)	Yes
Exams you follow and your preparation preferences	To show relevant exams, dates, tests and a study plan	Needed for those features
Test attempts, answers, scores and time taken	To score tests, show your results, weak topics and progress, and to choose practice questions you have not seen	Created when you take tests
Saved questions, mistake notebook, application tracker entries	Features you choose to use	Optional
Questions you report and messages you send us	To fix content and answer you	Optional
Technical data: IP address, browser, sign-in times	Security (for example rate limiting and preventing account abuse) and troubleshooting. IP addresses in our logs are stored as one-way hashes where practical.	Yes
Consent records (what you agreed to, which version, when)	To show what you agreed to and when	Yes

We do not collect payment card or bank details. We do not use advertising, advertising cookies, cross-site tracking or analytics that profile you, and we do not sell personal data.

2. How your data is used by automated features

Tests are scored on our server against stored answer keys. Weak-topic analysis and study plans are calculated from your own attempts to help you prepare; they are not used to make decisions with legal or similar effects about you. Practice questions are prepared with AI services before tests are published; your personal data is not sent to AI services to generate them.

3. Who we share data with (processors)

We use service providers who process data for us under our instructions. Depending on how this site is configured, these can include:

• Hosting and database provider — stores all account and test data.
• Email delivery provider — sends account emails (verification, password reset, replies to your requests).
• Cloudflare (if enabled) — network security, bot protection on sign-in forms (Turnstile) and file storage.
• Google (if you choose “Sign in with Google”) — confirms your identity. Google Fonts may also be loaded to display text, which shares your IP address with Google.
• AI providers — receive exam content (questions, syllabus text) to prepare practice material. They do not receive your account data.

The current list of providers is available on request. Some providers may process data outside India.

4. How long we keep data

Account and preparation data: while your account is active. When you delete your account, it is erased, except records we must keep as evidence (consent records and closed privacy requests, kept pseudonymised). Logs: security and system logs are deleted automatically after a set period (typically 90–365 days, depending on the type). Unfinished sign-ups are deleted after 7 days.

5. Your rights

• Get a summary of your data and how it is used, and download a copy.
• Correct or update inaccurate data.
• Erase your data or delete your account.
• Withdraw consent — as easily as you gave it. Withdrawing consent to the Privacy Notice means we can no longer provide the service to you.
• Nominate someone to exercise your rights if you die or become unable to.
• Raise a grievance with us, and if unresolved, with the Data Protection Board of India.

Signed-in students can do most of this themselves under Privacy & data. Anyone can use the form on Your data rights or email [gep_legal field=”privacy_email”].

6. Children

See Children and young users. We do not knowingly process a child’s data without verifiable consent from a parent or lawful guardian where the law requires it, and we never use tracking or targeted advertising for children.

7. Security

We use encryption in transit (HTTPS), hashed passwords, access controls that limit staff access to what their role needs, rate limiting, logging of security-relevant actions and regular backups. No system is perfectly secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board as required by law.

8. Cookies

We only use cookies needed to sign you in and keep the service secure. See the Cookie Policy.

9. Contact and grievances

Privacy contact: [gep_legal field=”privacy_email”]. Grievance officer: [gep_legal field=”grievance_officer”], [gep_legal field=”grievance_email”]. See Grievance redressal.

10. Changes

When we change this notice in a way that matters, we update the version number and ask you to review it the next time you sign in.