Privacy Policy

1. Scope

This Privacy Policy explains what personal data AdvikPrep collects, why, how it's used, and your rights, regardless of where you are located — including specific sections for EU/EEA/UK users (GDPR), Indian users (Digital Personal Data Protection Act, 2023 — "DPDP Act"), and California/U.S. users (CCPA/CPRA).

2. What We Collect

• Account data: name, email address, password (hashed), account creation date.
• Payment data: we do not store your full card/bank details — payments are handled entirely by our payment processor(s) (e.g. Stripe, Lemon Squeezy), who act as independent data controllers/processors for that information under their own privacy policies.
• Usage data: quiz attempts, scores, question-level performance, time spent, feature usage, device/browser type, IP address, and similar analytics data — used to improve question quality and your learning experience.
• Communications: support emails, feedback, ratings/reviews you submit.
• Cookies and similar technologies: see Section 8.

We do not knowingly collect any special category / sensitive personal data (e.g. health, biometric, financial account numbers) beyond what's needed for account and payment administration.

3. How We Use Your Data

• To provide and maintain your account and subscription access
• To process payments and manage billing/renewals
• To personalize quiz content and track your progress
• To improve question quality (e.g. analyzing which questions are frequently missed or reported)
• To communicate with you about your account, billing, or support requests
• To send you product updates or marketing communications, only where you have consented (you can opt out at any time)
• To detect and prevent fraud, abuse, or violations of our Terms of Service
• To comply with legal obligations

Google Account & OAuth Data Disclosures

This section applies specifically to users who register for or sign in to AdvikPrep using Google Sign-In or connect Google services. AdvikPrep complies strictly with the Google API Services User Data Policy, including the Limited Use requirements, and Google Cloud OAuth Verification guidelines.

1. Google OAuth Scopes Requested & Data Collected

When you choose to authenticate with AdvikPrep using Google OAuth, we request access only to the minimum required scopes:

• https://www.googleapis.com/auth/userinfo.email (or email): Used to obtain your primary Google email address for account creation, login authentication, and essential account notifications.
• https://www.googleapis.com/auth/userinfo.profile (or profile): Used to obtain your display name and profile picture URL to personalize your AdvikPrep user dashboard.
• openid: Used for secure user authentication via OpenID Connect.

2. Purpose & Use of Google Data

AdvikPrep uses data retrieved from Google APIs solely to:

• Authenticate your identity and provide Single Sign-On (SSO) access to AdvikPrep.
• Display your name and profile avatar on your account dashboard and leaderboard.
• Send transactional, account security, and billing-related email notifications.

3. Strict Restrictions on Google User Data (Limited Use Compliance)

AdvikPrep enforces strict controls over data accessed via Google APIs:

• No Selling: We do NOT sell, rent, or trade Google user data to any third party, data broker, or commercial partner under any circumstances.
• No Advertising: Google user data is NEVER used for serving advertisements, retargeting, cross-context behavioral advertising, or building ad profiles.
• No AI/ML Training: Google user data, profile details, and activity logs are NEVER used to train, retrain, or fine-tune AI or Machine Learning (ML) models.
• No Human Access: No human at AdvikPrep reads or accesses your Google user data unless: (1) you provide explicit written consent for support troubleshooting, (2) it is necessary for security investigations (such as fraud or abuse), or (3) to comply with applicable legal obligations.

4. Data Sharing & Third-Party Processors

We do not share your Google user data with third parties except with our trusted infrastructure service providers (e.g. cloud hosting, database management, and email gateways) strictly necessary to operate the AdvikPrep platform. All such providers are contractually bound to maintain strict confidentiality and security standards.

5. Data Retention, Account Deletion & Revoking Access

• Data Retention: Google user profile data and OAuth tokens are retained only as long as your AdvikPrep account remains active.
• Account Deletion: If you choose to delete your AdvikPrep account, all associated Google user data, profile information, and authentication tokens are permanently erased from production databases within 30 days. You can request deletion by contacting support@advikprep.com.
• Revoking Permissions: You can revoke AdvikPrep's access to your Google Account at any time by visiting your Google Account Security Settings.

4. Legal Bases for Processing (GDPR/EEA/UK users)

We process your personal data on the following legal bases:

• Contract necessity — to provide the Service you signed up for (account, quizzes, billing)
• Legitimate interests — to improve our Service, prevent fraud, and maintain security, balanced against your rights
• Consent — for optional marketing communications and non-essential cookies (you may withdraw consent at any time)
• Legal obligation — where we must retain or disclose data to comply with law

5. Who We Share Data With

We do not sell your personal data. We share data only with:

• Payment processors (e.g. Stripe, Lemon Squeezy) — to process your subscription payment
• Hosting/infrastructure providers (e.g. Vercel, MongoDB Atlas, or equivalent) — to run the Service
• Analytics provider (only with your consent — e.g. Google Analytics 4 via the Google tag) — to understand usage patterns; blocked until you accept the cookie banner
• Law enforcement or regulators, only where legally required
• A successor entity, if AdvikPrep is acquired or merged, subject to this policy continuing to apply

All third parties we use are contractually required to protect your data and use it only for the purposes we specify.

6. International Data Transfers

AdvikPrep is operated from India. If you are located in the EU/EEA/UK, your data may be transferred to and processed in India or other countries (e.g. where our hosting/payment providers operate) that may not have the same data protection laws as your home country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) with our service providers to protect your data in these transfers.

7. Data Retention

We retain your account and usage data for as long as your account is active, and for a reasonable period afterward (e.g. 12 months) to handle disputes, legal obligations, or re-activation requests, after which it is deleted or anonymized, unless a longer retention period is required by law (e.g. financial/tax records).

8. Cookies and Tracking

We use cookies/local storage for: keeping you logged in (essential), remembering preferences, and — only if you accept the cookie banner — Google Analytics 4 (GA4, cookies such as _ga and _ga_*) to understand usage and improve question quality. Consent Mode v2 defaults to denied, so no analytics hits are sent until you click “Accept analytics”. You can withdraw consent anytime by clearing site storage (which re-shows the banner) or via the Google opt-out at tools.google.com/dlpage/gaoptout. See Google's policy at policies.google.com/privacy.

9. Your Privacy Rights

If you are in the EU/EEA/UK (GDPR)

You have the right to: access your data; correct inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; receive your data in a portable format; withdraw consent at any time (without affecting prior lawful processing); and lodge a complaint with your local data protection supervisory authority.

If you are in India (DPDP Act, 2023)

As a "Data Principal," you have the right to: obtain a summary of your personal data and processing activities; request correction, completion, updating, or erasure of your data; have your grievances addressed by our Grievance Officer (contact above) within the statutory timeline; and nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

If you are in California or another U.S. state with a comparable law (CCPA/CPRA, etc.)

You have the right to: know what personal data we collect and why; request deletion of your personal data; correct inaccurate personal data; and opt out of the "sale" or "sharing" of personal data — we do not sell or share your personal data with third parties for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.

To exercise any of the above rights, email support@advikprep.com. We will respond within the timeframe required by applicable law.

10. Children's Privacy

AdvikPrep is not directed at, and does not knowingly collect personal data from, individuals under 18 (or the applicable age of digital consent in your jurisdiction). If we learn we have collected data from a child without appropriate consent, we will delete it promptly.

11. Security

We use reasonable technical and organizational measures (e.g. encrypted connections, hashed passwords, access controls) to protect your data. No system is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version with a new effective date, and for material changes, notify active users by email or in-app notice where required.

13. Contact Us

For privacy questions, data requests, or grievances: AdvikPrep Grievance Officer, support@advikprep.com, or general contact at support@advikprep.com.