Privacy Policy

1. Introduction

This Privacy Policy explains how Examaker, operated by Subash Venkatesh as an unregistered/proprietary business ("Examaker", "we", "us", "our"), collects, uses, discloses, and protects personal data when you use the Examaker website and application (the "Platform"). We process personal data as a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and this Policy is intended to give you clear, itemised notice as required under that Act. By using the Platform, you consent to the collection and use of your information as described here.

2. Information We Collect

We collect the following categories of personal data:

• Identity & Contact Data: name, mobile number (used for WhatsApp OTP login and identification), school/institution name, and — where you provide it for invoicing — GSTIN and billing address.
• Usage Data: pages visited, features used, device type, browser, IP address (in server logs), and interaction/analytics events (see Section 6).
• Content Data: question papers you generate, questions you author, template preferences, subject/class selections, and other content you create on the Platform.
• Payment Data: transaction identifiers, subscription status, and billing history. We do not collect or store your full card number, UPI PIN, or net-banking credentials — these are collected and processed directly by our payment processor, Razorpay.
• Communications Data: messages you send us for support, and delivery/read status of transactional WhatsApp messages we send you (e.g. OTPs, payment confirmations, staff-added notifications).

We do not knowingly collect personal data directly from students. Question paper content may reference student-facing material (e.g. exam questions), but this is curriculum content, not personal data about identifiable students.

3. How We Use Your Data

We use your data, on the basis of your consent and/or to perform our contract with you, to:

• Create and authenticate your account, and deliver core Platform functionality (generating, editing, saving, and downloading question papers)
• Process payments, manage your subscription, and send billing-related communications
• Send essential transactional communications (OTPs, payment receipts, renewal reminders, staff-added notices) via WhatsApp/SMS/email
• Send product updates or promotional communications, where you have not opted out (see Section 8)
• Monitor, maintain, and improve the security, reliability, and performance of the Platform
• Comply with legal obligations, including tax, billing, and law-enforcement requests

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law (for example, invoices and payment records are typically retained for the period required under Indian tax law). When you delete your account, we retain your data for a 7-day recovery window (during which you can restore your account), after which it is permanently deleted from our production systems, subject to residual copies in encrypted backups that are purged on our standard backup-rotation schedule.

5. Data Protection & Storage

We use industry-standard encryption (in transit via TLS, and at rest) and reputable cloud infrastructure providers — including Supabase (database/storage) and Vercel (application hosting) — to store and process your data. Access to personal data is restricted to authorised personnel on a need-to-know basis. We do not sell your personal data to third parties. In the event of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India as required under the DPDP Act.

6. Third-Party Services & Disclosures

We share limited data with the following categories of recipients, only as necessary to operate the Platform:

• Razorpay — payment processing (transaction and billing data)
• MSG91 — WhatsApp/SMS delivery for OTP login and transactional messages (mobile number only)
• Supabase, Vercel — database, storage, and application hosting infrastructure
• PostHog (EU-region hosted) — product analytics, used in de-identified/aggregated form wherever possible, to understand feature usage and improve the Platform
• Government authorities or courts — only where required by applicable law, a valid legal process, or to protect the rights, property, or safety of Examaker, our users, or the public

We do not sell, rent, or trade your personal data to advertisers or data brokers. Where any of our processors are located outside India, we take reasonable steps to ensure they provide an adequate level of data protection, consistent with the DPDP Act's cross-border transfer provisions.

7. Cookies & Tracking

Our website and application use cookies and similar technologies (such as localStorage) for session management, remembering your preferences, and analytics. You may disable cookies in your browser settings, but doing so may prevent certain Platform features (such as staying logged in) from working correctly. We do not use cookies for third-party behavioural advertising.

8. Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

• Obtain a summary of the personal data we hold about you and how it is being processed
• Correct, update, or complete inaccurate or incomplete personal data
• Erase personal data that is no longer necessary for the purpose it was collected, or request deletion of your account
• Withdraw your consent to any processing that is based on consent (e.g. promotional communications), at any time, as easily as you gave it
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
• Lodge a grievance with us, and if unresolved, with the Data Protection Board of India

To exercise any of these rights, email support@examaker.com. We will acknowledge your request within 72 hours and resolve it within 7 working days wherever reasonably possible; where a request is complex, we will inform you of a reasonable extended timeline and the reason for it.

9. Children's Data

The Platform is designed for use by adult teachers and school administrators, not directly by children. We do not knowingly collect personal data from, or create accounts for, individuals under 18 years of age. If you believe a child has provided us with personal data directly, contact support@examaker.com and we will take steps to delete it.

10. Consent Manager & Data Protection Officer

For queries about how your personal data is processed, or to raise a grievance, you may contact our Grievance Officer / point of contact for data protection matters:

11. Policy Updates

We may update this Privacy Policy as our services, legal obligations, or data practices change. We will notify you of material changes via email, WhatsApp, or an in-app notice, and update the "Last Updated" date above. Continued use of the Platform after a change takes effect indicates your acceptance of the revised Policy.

12. Contact

For any privacy-related concerns, contact us at: support@examaker.com