This Privacy Policy explains how Dhruv Shah, an individual carrying on business as a sole proprietor in India under the trade name “Prepvora” (“Prepvora”, “we”, “us”), collects, uses, shares and protects personal data when you use prepvora.com, the Prepvora web, installable and desktop apps, our emails, our invite-a-friend program and our affiliate program (the “Service”).
We are the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), the “controller” under the EU and UK General Data Protection Regulations (“GDPR”), and the “business” under US state privacy laws, to the extent those laws apply to us. Words like “personal data” mean information that identifies or relates to an identifiable person.
If you are under 18, please read this policy with your parent or guardian. There is a summary for families in Section 8.
1. Personal data we collect
Information you give us
- Account details: name, email address and password (stored only as a secure hash by our authentication provider), and, if you choose to give them, last name and phone number. We also record your account type (student, parent, teacher, tutor or school), the age range you select at sign-up (13–17 or 18+), and the version and time of the Terms you accepted.
- Profile and preferences: profile photo, target test, test date, target score, study goals, dream schools, the time you choose for a daily calendar reminder, what you share with parents and study friends, and other settings (such as theme and class-rank display).
- Learning activity: answers, time spent, scores, flagged and reviewed questions, practice history, streaks, study plans, focus-timer sessions, class assignment results and question reports.
- AI conversations: messages you send to the Vora AI tutor and other AI features, and the question context attached to them. We also keep a summary of AI help used during practice (the number and type of requests, not the text).
- Connections and classes: study friends, parent connections and classes you join or create, and notes sent through them.
- Invites and share cards: your invite code, which accounts signed up through your invite, whether they qualified, and the bonus tests earned and used. If you create a share card, we create a link containing the exam, a rounded score or goal, the date and your invite code.
- Score Guarantee claims: official score reports and related details you upload. These can include your name, test date, registration or ID numbers and scores; we use them only to assess and verify your claim.
- Communications: messages you send us, newsletter sign-ups and survey responses.
- Affiliates: if you join the affiliate program, your name, contact details, channel or website, payout details and the tax information we are legally required to collect.
Information collected automatically
- Device and log data: IP address, approximate location derived from it, browser and device type, operating system, pages viewed, referring page and timestamps.
- Test-integrity signals: during timed practice tests we may record events such as leaving full-screen mode or switching tabs, so that practice scores and Score Guarantee claims reflect genuine work.
- Local storage and cookies: described in our Cookie Policy, including a cookie that remembers an invite link you opened. The installable app caches its static files on your device so it loads quickly.
- Analytics: Vercel Web Analytics and Speed Insights measure aggregate traffic and performance without cookies. Google Analytics and Google Ads measurement run only if you accept them in our cookie banner. If you accept, we also send Google Analytics events about actions in the app (for example, sign-up, starting or finishing a practice set or test, the estimated score of a finished test, reaching a plan limit, sharing an invite and upgrade clicks). These events do not include your name, email address, invite code, question text or answers.
Information from third parties
- Google sign-in: if you choose “Continue with Google”, Google shares your name, email address, profile picture and a Google account identifier with us.
- Other users: a teacher, tutor or school may give us your email address to invite you to a class, and a parent may enter your email address when setting up an invitation. If you sign up through someone’s invite link, we learn which account invited you.
- Stripe: our payment processor tells us whether a payment succeeded and gives us limited details such as card brand, last four digits, expiry, billing country and billing email. We never receive your full card number or security code.
- Public sources (partners only): to invite creators to our affiliate program, we may collect publicly available business information — such as YouTube channel names, public contact details and channel statistics — through official platform APIs. We do not collect student data this way.
We do not intentionally collect sensitive categories of data such as health, religion, caste, biometric or financial account data (other than the limited payment details above). Please do not send them to us.
2. How we use personal data, and our legal bases
| Purpose | Examples | Legal basis (GDPR / DPDP) |
|---|---|---|
| Provide the Service | Create your account, serve questions and adaptive tests, compute scores, save progress, sync devices | Performance of a contract / consent and legitimate use for the service you requested |
| Personalize learning | Study plans, weak-area drills, difficulty calibration, progress insights | Performance of a contract |
| AI features | Generate tutor replies, explanations and remixes | Performance of a contract |
| Payments and the Score Guarantee | Process subscriptions, send receipts, assess and verify guarantee claims, handle refunds | Performance of a contract; legal obligation (tax and accounting) |
| Safety, security and integrity | Prevent fraud, account sharing, scraping and abuse; secure systems; enforce our Terms | Legitimate interests; legal obligation |
| Communications | Account and security emails; newsletters and product updates (you can unsubscribe anytime) | Contract (service emails); consent or legitimate interest (marketing) |
| Study emails for students | Welcome guide, get-started reminders, one message after a period of inactivity, test-date countdowns and a weekly summary (details below) | Legitimate interests in helping you use the service you signed up for; you can opt out at any time |
| Sharing you turn on | Show your chosen progress to connected parents and study friends; share class work with class staff; send parents the reports they ask for | Your consent and instructions (you can change them at any time); performance of a contract |
| Invite-a-friend program | Link sign-ups to invites, check qualification, credit and track bonus tests, prevent self-referral and abuse | Performance of a contract; legitimate interests (fraud prevention) |
| Analytics and improvement | Understand which features help students; fix bugs; improve questions using aggregated or de-identified data | Legitimate interests (cookieless analytics); consent (Google Analytics and Ads measurement) |
| Partner outreach | Contact creators about our affiliate program | Legitimate interests; you can object at any time |
| Legal compliance | Respond to lawful requests, keep required records, handle disputes | Legal obligation; legitimate interests |
Study emails. Student accounts with a verified email address may receive: a welcome guide in the first days after sign-up; a reminder if you have not practiced since signing up, and a suggested next step (or a diagnostic reminder) a few days later; one “come back” message after about ten days without practice; countdown reminders about four weeks, two weeks, one week and one day before the test date saved in your profile; and, in weeks when you practiced, a weekly summary of your activity. We use your first name, exam, test date, target score, recent activity and diagnostic results to write them. We cap how often we send them (currently no more than one a day and three in any seven days, counting the weekly summary), we stop habit reminders if you have been inactive for a long time, and countdowns stop once your saved test date has passed. We do not send them to parent, teacher, tutor or school accounts, to unverified addresses, or to accounts still waiting for a parent’s approval under our earlier sign-up process. Every one includes an unsubscribe link (and supports one-click unsubscribe in email apps); unsubscribing stops these emails, the weekly summary and newsletters, but not account, security or billing emails. You can also turn study emails, study nudges, test-date countdowns and the weekly summary on or off individually in Settings → Notifications.
Parent reports. A parent connected to a student can choose to receive a weekly progress report, new-test alerts, streak-at-risk alerts and study-plan alerts. All are off until the parent turns them on, and we record when they did. Reports contain only the categories the student shares, never private answers or AI conversations, and each email has its own unsubscribe link.
No automated decisions with legal effects. Adaptive difficulty and study recommendations are automated, but they do not produce legal or similarly significant effects. If a Score Guarantee claim is refused, you can ask for the decision to be reviewed by a person.
No personalized advertising. We do not use your personal data to show you personalized ads and we do not sell it. When you consent to Google Ads measurement, it is used only to measure whether our own ads led to a visit or sign-up; we disable Google’s ad-personalization (remarketing) signals.
Model training. We do not provide your personal data to third parties to train their general-purpose AI models. We may use aggregated or de-identified learning statistics (for example, how often a question is answered correctly) to improve our questions and features.
3. How AI features handle your data
When you use an AI feature, the text you enter and the relevant question content are sent to an AI provider (currently Google’s Gemini API and Groq) to generate a response. These providers process the data under their own API terms, which may allow them to retain inputs for a limited period (for example, to detect abuse) and, depending on the plan used, to use inputs to improve their services. We send only what is needed to answer your request. Because AI inputs leave our systems, please do not include sensitive personal information in AI chats.
5. International transfers
We operate from India. Our primary database (Supabase) and our server functions (Vercel) run in Singapore, and our other providers, including Stripe, Google, Groq and Resend, process data in the United States and other countries. Where the law requires, we rely on appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses (and the UK addendum) contained in our providers’ data-processing terms. Transfers from India are made in line with the DPDP Act and any restrictions notified by the Government of India.
6. How long we keep personal data
| Data | How long |
|---|---|
| Account, profile and learning data | While your account is active. When you confirm deletion (Settings → Data & privacy → Delete account, using a one-time code we email you), we cancel any subscription and delete your login, profile, practice and test history, saved work, AI conversations, profile photo, class memberships, question reports and parent-report settings straight away. Copies may remain in rolling backups for up to a further 90 days. |
| Deletion record | When an account is deleted, we keep a minimal record for our own administration: a masked email address (only its first letter and domain), account type, plan, sign-up and deletion dates, and counts of tests and questions answered. It contains no name, full email address or answers. |
| Class work you submitted | Results you submitted to a teacher’s class stay in that class’s records for its staff, even after you leave the class or delete your account. Email us if you want them removed. |
| Invite and email-delivery records | Your invite code, the record of which invite you used, your bonus-test use and the log of which study emails we sent you are deleted when you delete your account. If you invited someone who later deletes their account, your own record of the bonus you earned is kept so it is not taken back. |
| Share cards | A share card holds no personal details and is not stored as a separate record, so a card link you shared keeps working after you delete your account. |
| Inactive free accounts | We may delete accounts with no sign-in for 24 months, after emailing a warning at least 48 hours before. |
| Payment and invoice records | As long as tax, accounting and anti-fraud laws require (generally up to 8 years). |
| Score Guarantee claims and reports | Until the claim is resolved plus 12 months, then deleted. |
| AI conversation history | Kept with your account so you can revisit it, and deleted with your account. |
| Security and access logs | Up to 12 months, unless needed longer to investigate an incident. |
| Newsletter subscriptions and email preferences | Until you unsubscribe. Unsubscribing removes you from the newsletter list and records your opt-out on your account, so study emails and newsletters stop. |
| Partner outreach records | Up to 24 months, or sooner if you ask us to stop contacting you. |
We may keep information longer where the law requires it or to establish, exercise or defend legal claims.
7. Security
We use reasonable technical and organizational safeguards, including encryption of data in transit (HTTPS/TLS), encryption at rest provided by our infrastructure providers, hashed passwords, row-level access controls in our database, restricted administrative access and monitoring for abuse. You must verify your email address before using the app; you can turn on two-step verification with an authenticator app and sign out of all devices from your security settings; and account deletion must be confirmed with a single-use code we email to you, which expires after 10 minutes. Invite codes and share-card links are cryptographically signed so they cannot be altered or used to guess another student’s account. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal-data breach affects you, we will notify you and the relevant authorities as the law requires.
8. Children, teens and parents
- Under 13: the Service is not for children under 13 and we do not knowingly collect their personal data. If we learn that we have, we will delete it promptly.
- 13 to 17: students under 18 may use the Service only with a parent or guardian’s permission. Under India’s DPDP Act, a person under 18 is a “child”. At sign-up, students choose their age range and confirm that they have this permission, and we record that confirmation with the Terms version accepted. Accounts for students under 18 can only be student accounts.
- Parent accounts: a parent or guardian can create their own parent account and invite their child from the parent dashboard. The student decides whether to accept and chooses what to share, and either side can disconnect at any time. Parent email reports are off until the parent turns them on. Some accounts created under our earlier sign-up process are still waiting for a parent’s approval; we do not send study emails to those accounts.
- No ads or profiling for advertising: we do not target advertising at children and do not track or monitor children’s behavior for advertising. Learning activity is processed only to deliver and improve the educational service.
- Parents’ rights: a parent or guardian can ask to review the personal data we hold about their child, correct it, have it deleted, or stop further collection by emailing admin@prepvora.com from the address linked to the account or with proof of guardianship.
9. Your rights and choices
Everyone. You can access and download your data (Settings → Data & privacy → Download my data) and delete your account (Settings → Data & privacy → Delete account, confirmed with a code we email you); update your profile; choose what connected parents and study friends can see, or disconnect them; leave a class or turn class rank off; unsubscribe from study emails and newsletters using the link in any of them; and change cookie choices using the “Cookie settings” link in our footer.
India (DPDP Act). You may request a summary of the personal data we process and the recipients it is shared with; correction, completion, updating or erasure of your data; withdrawal of consent (as easily as you gave it); redress of grievances through our Grievance Officer; and to nominate another person to exercise your rights if you die or become incapacitated. After using our grievance process, you may approach the Data Protection Board of India.
EEA, UK and Switzerland (GDPR). You have the rights of access, rectification, erasure, restriction, data portability and objection (including to processing based on legitimate interests and to direct marketing), and to withdraw consent at any time without affecting earlier processing. You may complain to your local data-protection supervisory authority.
United States (including California). Depending on your state, you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to obtain a portable copy; and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information for targeted advertising and do not use sensitive personal information for purposes that require an opt-out. We will not discriminate against you for exercising your rights. You may use an authorized agent, and you may appeal any decision by replying to our response.
How to make a request. Use the in-app tools or email admin@prepvora.com. We will verify your identity (usually by confirming access to your account email) before acting and will respond within one month, or sooner if the law requires. If we cannot fully meet a request (for example, because we must keep invoice records), we will explain why.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of non-essential cookies and as an opt-out of any sale or sharing.
11. Third-party sites
The Service links to sites and services we do not control, such as the College Board, ACT, Google and YouTube, and some lessons embed videos hosted by YouTube or Vimeo. Their privacy practices are governed by their own policies.
12. Changes to this policy
We will update this policy as the Service or the law changes. The version and effective date at the top show the latest revision. If we make a material change, we will notify you by email or in the app before it takes effect and, where the law requires, ask for your consent again.
13. Contact us
Data Fiduciary / controller: Dhruv Shah, trading as Prepvora, India (full postal address provided on request — email admin@prepvora.com).
Grievance Officer and data-protection contact: Dhruv Shah, admin@prepvora.com. See Grievance Redressal for response times and escalation options.