Privacy Policy

Introduction

PrepGraph, Inc. ("PrepGraph", "we", "us", or "our"), a Delaware corporation, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational platform and services.

By using PrepGraph, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Personal Information

We collect personal information that you provide directly:

• Account Information: Name, email address, password, phone number
• Profile Information: Age, grade level, academic goals, school information
• Payment Information: Billing address, payment method details (processed securely by third parties)
• Parent/Guardian Information: Contact details for users under 18

1.2 Learning Data

We collect information about your use of the platform:

• Academic Performance: Responses to questions, test scores, progress metrics
• Learning Patterns: Session duration, topics studied, difficulty preferences
• Interaction Data: Conversations with AI tutor, feedback provided
• Progress Tracking: Mastery levels, completion rates, learning goals

1.3 Technical Information

• Device Information: IP address, browser type, operating system
• Approximate Location: We resolve your IP address to a country and state (using an IP lookup service and our own geolocation service) so we can show region-appropriate exams, pricing, and content
• Usage Data: Pages visited, features used, time spent on platform
• Cookies and Browser Storage: Session tokens, country and display preferences, and similar app state stored in cookies and your browser's local storage
• Push Notifications: If you enable them, we store a push subscription for your browser so we can send you study reminders; delivery uses your browser vendor's push service (e.g. Google, Mozilla, or Apple)

1.4 Third-Party Information

If social sign-in is offered and you choose to use it (e.g. Google), we receive:

• Public profile information (name, email, profile picture)
• Authentication tokens
• Any additional permissions you grant

2. How We Use Your Information

We use collected information for:

2.1 Service Delivery

• Providing personalized learning experiences
• Adapting difficulty and content to your skill level
• Generating progress reports and analytics
• Recommending learning paths and resources
• Facilitating parent/teacher monitoring (with appropriate permissions)

2.2 Platform Improvement

• Analyzing usage patterns to improve features
• Training and improving AI models
• Identifying and fixing technical issues
• Conducting research on learning effectiveness

2.3 Communication

• Sending account notifications and updates
• Responding to support requests
• Providing learning reminders and encouragement
• Sharing educational content and tips
• Marketing communications (with your consent)

2.4 Legal and Security

• Complying with legal obligations
• Enforcing our Terms of Service
• Protecting against fraud and abuse
• Ensuring platform security

3. How We Share Your Information

We do NOT sell your personal information. We may share your information with:

3.1 Service Providers

• Payment Processors: Razorpay (payments from India) and Stripe (international payments, where available) — your card and UPI details are handled by the processor, not by us
• Cloud & Hosting: Cloud infrastructure providers used to host the platform and store data (including Cloudflare)
• Abuse Prevention: Google reCAPTCHA on signup and password-reset forms
• IP Geolocation: An IP lookup service (ipify) used to detect your country for region-appropriate content
• Content Delivery: Font and asset CDNs (Google Fonts, jsDelivr, cdnjs) that receive standard web-request data such as your IP address when assets load
• Sign-In Providers: Social sign-in providers such as Google — only where offered and only if you choose to sign in with them
• Push Delivery: Your browser vendor's push service (Google, Mozilla, or Apple) — only if you enable notifications

3.2 Educational Stakeholders

With appropriate authorization:

• Parents/Guardians: Progress reports for students under 18
• Teachers: Class performance data for school accounts
• School Administrators: Aggregated performance metrics

3.3 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal processes or government requests
• Enforce our policies and agreements
• Protect the safety and security of our users
• Investigate fraud or security issues

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4. Data Security

We implement industry-standard security measures:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest
• Authentication: Secure password hashing and one-time email verification codes
• Access Controls: Limited employee access on need-to-know basis
• Logging: Security-relevant events are logged
• Regular Reviews: We review our security practices on an ongoing basis

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

5. Your Rights and Choices

5.1 Access and Correction

You can access and update your personal information through your account settings or by contacting us.

5.2 Data Deletion

You may request deletion of your account and personal data. Some information may be retained for legal or operational purposes.

5.3 Communication Preferences

You can opt out of marketing communications through account settings or unsubscribe links in emails. You cannot opt out of essential service communications.

5.4 Cookie Management

You can control cookies through browser settings. Note that disabling cookies may limit platform functionality.

5.5 Data Portability

You may request a copy of your data in a structured, machine-readable format.

6. Children's Privacy (COPPA Compliance)

We comply with the Children's Online Privacy Protection Act (COPPA) and similar international regulations.

6.1 Parental Consent

For users under 13, we require verifiable parental consent before collecting personal information. Users aged 13-17 must have parental awareness.

India: Under the Digital Personal Data Protection (DPDP) Act, 2023, anyone under 18 is considered a child. For users in India under 18, we require parental or guardian consent before processing personal data, and we do not use children's data for targeted advertising or behavioural tracking unrelated to learning.

6.2 Limited Data Collection

We collect only the minimum information necessary to provide educational services to children.

6.3 Parental Rights

Parents have the right to:

• Review their child's personal information
• Request deletion of their child's information
• Refuse further collection or use of their child's information

7. International Data Transfers

PrepGraph operates globally. Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers.

7.1 GDPR (European Users)

European users have additional rights under GDPR:

• Right to access, rectification, and erasure
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with supervisory authority

7.2 CCPA (California Users)

California residents have rights under CCPA including the right to know what personal information is collected and the right to delete. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

7.3 DPDP Act 2023 (Users in India)

If you are in India, we process your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. As a Data Principal you have the right to:

• Access a summary of the personal data we process about you
• Request correction, completion, or erasure of your personal data
• Withdraw consent at any time (this may limit the services we can provide)
• Nominate another individual to exercise your rights in case of death or incapacity
• Raise a grievance with us, and escalate to the Data Protection Board of India if unresolved

To exercise any of these rights, or to raise a grievance, contact our grievance redressal team at support@prepgraph.com. We acknowledge grievances promptly and aim to resolve them within the timelines prescribed under applicable law.

8. Data Retention

We retain your information:

• Account Data: As long as your account is active
• Learning Data: For the duration of your subscription plus up to 2 years for analytics
• Payment Records: As required by applicable law in your country (typically 7–8 years)
• Anonymized Data: May be retained indefinitely for research

When you delete your account, we remove or anonymize your personal information within 30 days, except where retention is required by law.

9. Third-Party Links and Services

Our platform may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

10. AI and Machine Learning

PrepGraph uses AI and machine learning to personalize your learning experience:

• Your learning data is used to train and improve our AI models
• Personal identifiers are removed or pseudonymized before use in model training
• AI-generated content and recommendations are based on educational best practices
• We continuously monitor AI outputs for bias and accuracy

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a notice on our platform. The "Last Updated" date at the top indicates when the policy was last revised.

Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: