Privacy at PrepGraph

Who we are

PrepGraph, Inc. ("PrepGraph"), a Delaware corporation, builds an AI tutor that remembers what each student knows, for school and exams, and the courses and certificates that follow. Supplies to customers in India are made by PREPGRAPH PRIVATE LIMITED (GSTIN 03AARCP1868M1ZT). Most of the students who use PrepGraph are under 18, and we build with that in mind: nothing on this page assumes an adult is at the keyboard.

What we process

• Voice audio → transcripts. When a student talks to the tutor, the audio is converted into text transcripts. The transcripts are what the tutor responds to and what we keep as part of the session.
• Learning progress. Answers to questions, topics studied, mastery levels, and session history — the record the tutor uses to pick up where the student left off.
• Uploaded documents. Photos and documents a student uploads (for example, a problem they want help with).

Who processes it for us

These are the external providers that currently process data as part of running PrepGraph:

• Microsoft Azure OpenAI — the AI models behind the tutor; processed in India and, for some models, in other regions.
• Sarvam AI — speech synthesis (India).
• Smallest.ai — speech recognition (India).
• Inworld AI (United States) — speech recognition and speech synthesis; audio may be processed in the US.
• Google Cloud — speech synthesis.
• Google Analytics — usage measurement for adult (parent, teacher, admin) sessions only, with identifying page paths stripped. Never loaded for students or child sessions.
• Cloudflare Web Analytics — Cloudflare serves this site and adds its analytics script to every page, students’ pages included. It counts page views and how quickly pages load, from the address of the page (without anything after a question mark), the page that linked to it, your browser, operating system and type of device, and the country you are connecting from, which Cloudflare works out from your IP address. It sets no cookie and stores nothing in your browser.
• ipapi.co — works out the country you are connecting from, from your IP address, when you choose your goal at sign-up, so the site shows the right market’s exams and prices.
• Google Fonts — serves some of the typefaces the pages are set in. Your browser asks Google for them, which tells Google your IP address.
• Google (sign-in and reCAPTCHA) — Sign in with Google, and the invisible check that keeps bots off the sign-up and password forms.
• Twilio, SendGrid, and Meta — messaging (SMS, email, and WhatsApp).
• Stripe and Razorpay — payments.

Alongside the learning data above, running an account means we also process account and contact details (name, email, phone number) and, for paid plans, payment details handled by the payment providers.

When this list changes, this page is updated and re-versioned.

When a school, teacher or partner writes to us

The enquiry form on /contact asks for what a person needs in order to reply to you. Sending it also passes on three things you do not type, listed below.

What the form collects

• Who you are writing as: an institution, a teacher, or a partner.
• About your organisation: its name, its kind, the city and the state.
• About you: your name, your role, your email address and your phone or WhatsApp number.
• Your consent: the fact that you ticked the consent box, and when.
• Sent with it, which you do not type: the address of the page you sent it from, which link on our site brought you to the form, and your IP address. The page address and the link travel with your enquiry to the team that answers it. Our server uses the IP address to limit how often the form can be sent.

Why we collect it

We use what you send us to reply to your enquiry, and to pass it to the right team — the institutions team, the Academy, or the founder’s office.

How long we keep it

• An enquiry that goes nowhere: two years from our last contact with you, then deleted. Ask us earlier and we will delete it earlier.
• An enquiry that becomes a customer relationship: for as long as that relationship lasts, under the agreement that governs it.

Your rights, and withdrawing consent

You can ask us for a summary of what we hold about you and who we have shared it with, to correct it, or to delete it, unless the law requires us to keep it, in which case we will tell you.

Withdrawing is as easy as giving: one line saying you would rather we did not contact you, and we stop. You can narrow it instead of ending it — “email only, no calls or WhatsApp” is a normal request and we will honour it.

Children

The enquiry form is for adults — an institution, a teacher or a partner. A student, or any child, has nothing to fill in on it. If you think a child has sent us something through the form, write to us and we will delete it.

For any of this, write to privacy@prepgraph.com.

Questions and data requests

Parents and guardians (and students) can write to us with questions about any of the above, or to ask for access to, correction of, or deletion of their data: