Privacy & Your Data Rights

1. Personal data we collect

We collect only what we need to provide and improve the service:

• Account data — name, mobile number, email, password (stored hashed), class/grade and exam goal where you provide them.
• Learning activity — courses, tests, quizzes, practice and progress on the platform.
• Transaction data — records of purchases. Card/UPI details are handled by our payment partners; we do not store full card numbers.
• Technical data — device, browser, IP address and cookies/identifiers strictly necessary to run the service, and (only with your consent) analytics.
• Support data — messages you send us.

2. Purposes and lawful basis

We process your personal data only for specified purposes, on the basis of your consent or, where permitted, certain legitimate uses under the DPDP Act.

• Create and secure your account and deliver the learning service (live classes, tests, practice, analytics).
• Process payments and provide receipts and support.
• Send essential service communications (OTP, security, account and transaction notices).
• Improve and secure the platform and prevent fraud/abuse.
• Comply with legal, tax and regulatory obligations.

3. Cookies and your consent

We use cookies that are strictly necessary to run QuestPix (login/session, security, preferences). Non-essential cookies (analytics/improvement) are used only with your consent and are off by default. You can accept, reject or change these choices anytime via the consent banner, and withdraw consent as easily as you gave it.

4. Sharing and data processors

We share personal data only with vetted service providers (Data Processors) acting on our instructions under contract — cloud hosting, SMS/OTP delivery, email and payment processing. We do not sell your personal data, and do not share it for third-party advertising. We may disclose data where required by law or to protect rights and safety.

5. Data retention

We retain personal data only as long as necessary for the purposes above or as required by law — typically while your account is active and for a reasonable period afterward for support, tax and legal needs. When the purpose is served and no legal requirement applies, we erase or anonymise the data.

6. Data security

We apply reasonable security safeguards — encryption in transit, access controls, hashed passwords and staff practices — to protect your data. No system is perfectly secure; in the event of a personal-data breach we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

7. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we process about you and how.
• Correction & completion — correct inaccurate or update incomplete data.
• Erasure — request deletion where retention is no longer required by law or for the purpose collected.
• Withdraw consent — at any time, for processing based on consent.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.

8. Children and students (under 18)

QuestPix is used by school students, some of whom are children (under 18). For a child's account we require consent of a parent or lawful guardian, and by creating or supervising the account the parent/guardian confirms that consent. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

9. Data transfers

Your data is processed on servers that may be located in or outside India through our service providers; where data is transferred, we do so in accordance with the DPDP Act and applicable restrictions.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified on this page (and, where required, to you directly). The “Last updated” date reflects the latest revision.