Privacy Policy

ExamGrinder (“we”, “us”, “our”) is operated by ExamGrinder Technologies (“Company”). This Privacy Policy describes how we collect, use, store, share, and protect your personal data in accordance with India's Digital Personal Data Protection Act 2023 (DPDP Act) and other applicable laws.

By using ExamGrinder, you (the Data Principal) consent to the collection and use of your information as described below. You may withdraw consent at any time by contacting us at privacy@examgrinder.in.

We collect the following categories of personal data:

• Account data: Name, email address, phone number, hashed password.
• Exam preferences: Target exam(s), exam date, study hours, reservation category.
• Usage data: Pages visited, questions attempted, practice session results, mock test scores, typing test results, syllabus progress.
• Payment data: Order ID, transaction reference (processed by Razorpay — we do not store card details).
• Device data: IP address, browser type, device type, operating system (for security and analytics).

We do not collect sensitive personal data (biometric, financial account numbers, medical data) except as described above.

Your personal data is processed for these specific purposes:

• Creating and managing your account
• Personalising your study plan, question recommendations, and progress tracking
• Processing payments for subscriptions
• Sending transactional emails (OTP, receipts, password reset)
• Analytics to improve the platform (aggregated, not sold)
• Security monitoring and fraud prevention
• Legal and regulatory compliance

We do not use your data for targeted advertising or sell it to third parties.

Your data is stored on Neon PostgreSQL servers hosted in the United States (us-east-1 region) by Neon Inc., a sub-processor bound by our data processing agreement. We use AES-256 encryption at rest and TLS 1.3 in transit. Passwords are hashed using bcrypt with a cost factor of 12 and are never stored in plaintext.

We retain account data for the duration of your account plus 12 months. Usage and analytics data is retained for 24 months. You may request deletion at any time.

We share your data only with the following service providers (sub-processors):

• Neon Inc. — database hosting (United States)
• Razorpay Software Pvt. Ltd. — payment processing (India)
• Vercel Inc. — web hosting and CDN (United States)
• Redis Cloud / Upstash — session caching (your data is cached temporarily, not permanently stored)

All sub-processors are contractually obligated to protect your data and may not use it for their own purposes.

As a Data Principal, you have the following rights:

• Right to access: Request a summary of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your account and associated data.
• Right to withdraw consent: Withdraw consent for data processing (this will require closing your account).
• Right to grievance redressal: Raise a grievance with our Grievance Officer (see Section 8).
• Right to nominate: Nominate an individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email us at privacy@examgrinder.in with the subject line “DPDP Rights Request”. We will respond within 30 days.

We use strictly necessary cookies for authentication (session token, CSRF protection) and a single consent cookie (dpdp-consent). We do not use tracking or advertising cookies. Session storage is used for temporary UI state only and is cleared when you close your browser tab.

In accordance with the DPDP Act 2023, our Grievance Officer for data protection matters is:

We may update this Privacy Policy from time to time. When we do, we will notify you by email (if your account is active) and update the “Last updated” date at the top of this page. Continued use of ExamGrinder after changes constitutes acceptance of the updated policy.