Privacy Policy

This Privacy Policy explains how ParikshaPatra collects, uses, shares, stores and protects your personal data when you use our mobile application and our website at parikshapatra.in.

ParikshaPatra is operated from India. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), ParikshaPatra is the Data Fiduciary responsible for your personal data, and you are the Data Principal.

Please read this policy along with our Terms and Conditions, our Refund and Cancellation Policy, and our Account and Data Deletion page.

1. Who we are and how to reach us

Support hours are Monday to Friday, 9:00 AM to 6:00 PM IST, and Saturday, 10:00 AM to 2:00 PM IST. We are closed on Sundays and public holidays. We reply to messages within 24 hours on business days.

2. Consent notice

By creating a ParikshaPatra account you consent to us processing the personal data described in this policy, for the purposes described in this policy, and for no other purpose.

Your consent is:

• Specific. We ask for data we need to run the service, not data we might find useful later.
• Informed. Section 3 lists every category of data we collect and Section 4 lists exactly what we do with each category.
• Freely given. You can use the Free Plan without paying, and you can withdraw consent at any time.
• Withdrawable. See Section 11 for how to withdraw consent, and what happens when you do.

If we ever want to use your data for a new purpose that is not covered here, we will ask you again before doing so.

3. What personal data we collect

We collect only the following:

Data you give us when you register or use the app

• Name — to identify your account and address you in the app.
• Email address — your login identifier, and how we send account, payment and support messages.
• Mobile number — account recovery and support contact.
• Country and state — so we can show you exams and current affairs content relevant to your region. This is the state you select in your profile. We do not read GPS or precise device location.
• Exam preferences — the exams you are preparing for, so we can filter papers and tests.
• Password — stored only as a salted cryptographic hash. We never store or see your actual password.

Data generated as you use the service

• Usage and activity data — papers you open, tests you attempt, scores, answers, time spent, and progress. This is what powers your analytics and progress tracking.
• Device and technical data — device type, operating system and version, app version, and IP address. Used for security, debugging and crash diagnosis.

Data related to payments

• Payment records — the Razorpay Order ID, Payment ID, amount, date, plan purchased and payment status. For purchases made through Apple, the Apple transaction identifier and receipt status.
• We do not collect or store card numbers, CVV, UPI PINs, net banking credentials or bank account numbers. Those are handled entirely by the payment processor and never reach our servers.

We do not collect biometric data, government identity numbers (Aadhaar, PAN), health data, caste or religion, contact lists, photos from your gallery, SMS, or call logs.

4. Why we use your data (purpose limitation)

We use each category of data only for the purposes listed against it. We do not use your data for anything else.

We do not sell your personal data. We do not rent or trade it. We do not use your test performance, scores or exam preferences to target advertising.

5. Legal basis under the DPDP Act, 2023

We process your personal data on the basis of the consent you give when you register, and on the basis of "legitimate uses" recognised under the DPDP Act where applicable — for example, retaining transaction records to comply with tax law, or processing needed to respond to a support request you initiate.

Where the law requires us to keep data even after you ask us to delete it, we say so plainly in Section 9 and on the Account and Data Deletion page.

6. Advertising in the mobile app

The ParikshaPatra mobile app shows rewarded advertisements supplied by Google Mobile Ads (AdMob). Watching a rewarded ad can unlock access to a paper.

• Rewarded ads are currently served on iOS only. Advertising is disabled in the current Android version of the app.
• Ads are optional. You are never required to watch an ad to use the app, and no ad plays unless you choose to start it.
• We do not send Google your name, email, mobile number, exam preferences, test scores or payment records.
• Google may process device-level advertising identifiers and technical signals to select and measure ads. Google's practices are described at https://policies.google.com/technologies/partner-sites and its advertising policies at https://policies.google.com/technologies/ads.
• On iOS, the app follows Apple's App Tracking Transparency framework. If you decline tracking, ads are served in a non-personalised mode.
• We do not knowingly permit personalised or behaviourally targeted advertising to be served to users we know to be under 18. See Section 12.

7. Who we share data with

We share personal data only with the following parties, and only to the extent each needs it:

Razorpay Software Private Limited — payment processing (web and Android)

Receives your name, email address, mobile number and the transaction amount so it can process your payment and satisfy its own regulatory requirements. Razorpay is the party that handles your card, UPI and net banking details; we never see them. Razorpay's privacy policy: https://razorpay.com/privacy/

Apple — payment processing (iOS in-app purchases)

Where you buy a plan inside the iOS app, Apple processes the payment under its own terms and privacy policy and shares only a purchase confirmation with us. Apple's privacy policy: https://www.apple.com/legal/privacy/

Google (AdMob) — rewarded advertising, iOS only

Receives device-level advertising and technical signals as described in Section 6. It does not receive your account details.

Cloud hosting providers — hosting and infrastructure

We use reputable third-party cloud hosting providers to store our application servers, database and backups. They act on our instructions as processors and do not use your data for their own purposes.

Legal and regulatory disclosure

We may disclose data where we are required to by law, by a valid court order, or by a lawful request from a government authority, and where necessary to establish, exercise or defend a legal claim.

Business transfer

If the service is transferred to another entity, your data may transfer with it. We will notify you before that happens and the receiving entity will remain bound by this policy or a policy at least as protective.

Beyond the above, aggregated statistics that cannot identify you (for example, "the average score on this paper is 62%") may be used and published freely, because they are no longer personal data.

8. Cross-border data transfers

Our primary servers and databases are hosted on servers located in India, operated by our cloud hosting providers.

Some of the service providers named in Section 7 — in particular Google (AdMob) and Apple — operate global infrastructure, so limited data may be processed on servers outside India. Where that happens:

• The transfer is limited to what the provider needs for the specific function described in Section 7.
• We rely on the provider's own contractual commitments and data protection terms.
• Transfers are made only to countries not restricted by the Central Government under Section 16 of the DPDP Act. If a country we use is later restricted, we will stop transferring data there.

9. How long we keep your data

Retained payment records are kept in a restricted, minimal form — the transaction details and the identifiers needed to make the record meaningful for an audit. They are not used to serve you content, market to you, or rebuild your account.

10. How we protect your data

• All traffic between your device and our servers is encrypted in transit using HTTPS/TLS.
• Passwords are stored only as salted hashes, never in plain text and never in a form we can reverse.
• Authentication uses signed JWT access tokens with a limited lifetime.
• Access to production databases is restricted to the people who need it to operate the service.
• Payment credentials never reach our servers; they are handled by Razorpay or Apple.
• We apply security updates to our dependencies and infrastructure as part of routine maintenance, and we review our access controls periodically.

No system connected to the internet can be guaranteed completely secure. We do not claim absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required under the DPDP Act.

11. Your rights, and how to exercise them

As a Data Principal you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct data that is inaccurate, and complete or update data that is incomplete or out of date. Most fields can be edited directly in the app under Profile.
• Erase your personal data. See the Account and Data Deletion page for the full process, what is deleted, what is retained and why.
• Withdraw consent at any time (see below).
• Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. Write to us to register a nominee.
• Grieve — raise a complaint with our Grievance Officer and, if unsatisfied, escalate to the Data Protection Board of India (Section 13).

How to make a request. Email info@parikshapatra.in from your registered email address with the subject line "Data Principal Request". We will acknowledge within 24 hours on a business day and complete the request within 30 days.

Withdrawing consent. You can withdraw consent by emailing info@parikshapatra.in or by deleting your account in the app. Withdrawing consent for data that is essential to the service — your name, email and account record — means we can no longer provide you an account, so we will treat that request as an account deletion request. Withdrawal is not retrospective: it does not undo processing that was lawful while your consent was in place, and it does not release us from statutory retention obligations in Section 9.

Marketing. You can opt out of promotional email and push notifications at any time using the unsubscribe link, your device notification settings, or by writing to us. You will still receive essential transactional messages about your account and purchases.

12. Children and users under 18

Under Indian law a "child" is a person under 18 years of age. This is stricter than the 13-year threshold used in some other countries, and it is the threshold we apply.

• ParikshaPatra is intended for use by adults aged 18 and over, and by users under 18 only with the consent of a parent or lawful guardian.
• If you are under 18, you may use ParikshaPatra only with verifiable consent from your parent or lawful guardian. Your parent or guardian must contact us at info@parikshapatra.in before or promptly after you register so that we can verify their consent, and they accept our Terms on your behalf.
• We verify parental consent by corresponding directly with the parent or guardian at a contact they confirm, and by asking them to confirm the child's registered email address. We keep a record of that verification.
• We do not knowingly undertake tracking, behavioural monitoring or targeted advertising directed at a user we know to be under 18, and we do not process a child's data in a way likely to cause them detrimental effect.
• If we learn that we hold data about a user under 18 without verified parental consent, we will delete it.

Parents and guardians can review, correct or delete their child's data by writing to info@parikshapatra.in.

13. Grievances and escalation

Step 1 — Grievance Officer. In line with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, we have appointed a Grievance Officer:

We acknowledge every grievance within 24 hours on a business day and resolve it within 15 days of receipt.

Step 2 — Data Protection Board of India. If you are not satisfied with how we have handled your grievance, or if we do not respond within the time above, you may escalate to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023. You must ordinarily approach us first. Details of the Board and its complaint process are published by the Ministry of Electronics and Information Technology at https://www.meity.gov.in.

14. Cookies and similar technologies

Our website uses only essential cookies and local storage, for signing you in and keeping your session active. We do not use advertising cookies or cross-site tracking cookies on parikshapatra.in. You can clear or block cookies in your browser settings, but you will not be able to stay signed in.

The mobile app does not use cookies. It stores your authentication token and preferences locally on your device; uninstalling the app or deleting your account removes them.

15. Changes to this policy

We may update this policy as the service, or the law, changes. When we make a material change we will notify you by email to your registered address or by a prominent notice in the app, before the change takes effect where we reasonably can. The "Last updated" date at the top always reflects the current version. If a change requires fresh consent under the DPDP Act, we will ask for it rather than assume it.

16. Contact

Questions about this policy, or about your data: