Privacy policy

[Your registered business name] (“we”), [Registered address, City, State, PIN], operates UCEDEX and is the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). We also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Contact us at [support@yourdomain.in] or through our Grievance Officer (see below).

You give us

• Account details: email address and display name.
• Optional profile details: mobile number, target exams and year, city and state.
• Your work: answers, scores, time taken, mock attempts, and photos of drawings or notes you upload for creative questions.
• Support messages you send us, including any order ID you mention.

Created when you use UCEDEX

• Mock timing data: when you start, connection “heartbeats” during the exam (used to run the timer and pause it if you disconnect) and when you submit.
• Orders: what you bought, price, coupon, status, and from Razorpay the payment ID and payment method type (for example “UPI” or “card”).
• Technical data: a sign-in cookie, and server logs with IP address, browser and device type, kept for security and troubleshooting.

We never receive your card number, CVV, UPI PIN or net-banking password. We don’t use passwords; you sign in with your email address and a one-time code.

We process personal data on the basis of your consent, which you give when you create an account and agree to this policy, and for the legitimate uses the DPDP Act allows, such as meeting legal obligations. We use it to:

• create and secure your account and sign you in;
• show daily questions, score your answers, run mocks and calculate leaderboards, percentiles and predictions;
• evaluate your creative work and show you feedback;
• process payments, unlock purchases, issue receipts or invoices and handle refunds;
• answer support requests and grievances;
• detect cheating, abuse and security problems;
• keep accounting and tax records required by law.

We don’t use your data for advertising, and we don’t sell or rent it to anyone.

• Your uploads are private. Only you and our evaluators can see them. They are never shown on leaderboards or to other students.
• NID daily questions and NID bank uploads: the images, the question and its rubric are sent to an AI model (through Vercel’s AI Gateway to the model provider) to generate instant, AI-assisted feedback. The result is stored with your submission.
• NID mock answers: an AI draft may be prepared in the same way, then reviewed and finalised by a human evaluator.
• UCEED Part B (pass and mocks): evaluated by people only.
• We don’t use your uploads to train AI models, and we use AI services only to produce your feedback. AI feedback can be wrong; you can ask for a human re-evaluation.
• Uploads are deleted when you delete your account.

Leaderboards and multiplayer rooms show your display name, scores, rank and percentile. Nothing else, not your email, phone or uploads, is shown to other users. You can change your display name in Settings at any time, including to a nickname.

Payments are processed by Razorpay Software Private Limited, a payment aggregator regulated by the Reserve Bank of India. When you pay, you share payment details directly with Razorpay under its own privacy policy. We share only what Razorpay needs to take the payment (amount, order reference, and your name, email and phone to prefill checkout) and receive back the payment status, payment ID and method type.

We share personal data only with service providers that process it for us under contract, and only as needed:

• hosting and infrastructure (Vercel Inc.);
• payments (Razorpay);
• email delivery for sign-in codes (Resend);
• AI model providers, through Vercel’s AI Gateway, for AI-assisted feedback on uploads;
• our evaluators, who see your uploads and the related question only.

We may also disclose data when required by law, a court or a government authority, or to protect the safety of users. If our business is transferred, your data moves with it under this policy.

Some providers store or process data outside India. We do so only where the DPDP Act permits it and with providers that protect data to a comparable standard.

We use one essential cookie to keep you signed in (for up to 30 days). We don’t use advertising or cross-site tracking cookies, so there’s nothing to opt out of.

Under the DPDP Act, anyone under 18 is a child. If you are under 18, you may use UCEDEX only with the verifiable consent of your parent or legal guardian, who agrees to this policy on your behalf. We may ask a parent or guardian to confirm consent.

We don’t track or monitor the behaviour of children for advertising, and we don’t show targeted ads to anyone. A parent or guardian can contact us to see, correct or delete their child’s data.

• Account, practice history, mock attempts and uploads: while your account exists. When you delete your account they are deleted. Accounts inactive for three years may be deleted after we email you.
• Sign-in codes: deleted once used and never kept for more than an hour.
• Support messages: up to two years after they’re resolved, or until you delete your account.
• Server logs: up to 90 days.
• Payment and invoice records: kept for eight years, as required by tax and accounting law (including the Central Goods and Services Tax Act, 2017 and the Income-tax Act, 1961), even after you delete your account. When you delete your account we remove your name, email and phone from these records and keep only what the law requires: the order, amount, date, payment ID and state.

Under the DPDP Act you have the right to:

• Access a summary of your personal data and how it’s processed: use Download my data in Settings.
• Correct and update your data: edit your profile in Settings, or ask us.
• Erase your data: delete your account in Settings (payment records are kept anonymised, as explained above).
• Withdraw consent at any time, as easily as you gave it, by deleting your account or contacting us. Withdrawal doesn’t affect processing before it, and we’ll stop providing the service that depends on it.
• Nominate someone to exercise your rights if you die or become unable to.
• Grievance redressal: complain to our Grievance Officer, and then, if you aren’t satisfied, to the Data Protection Board of India.

We reply to requests within 30 days. We may need to confirm it’s really you first.

We use HTTPS, signed sign-in sessions, hashed one-time codes, private storage for uploads and access controls for staff. No system is perfectly secure; if a personal data breach happens, we will inform the Data Protection Board of India and affected users as the DPDP Act requires.

For any privacy question, request or complaint, contact our Grievance Officer. We acknowledge within 48 hours and aim to resolve within 15 days.

• Grievance Officer: [Grievance officer name]
• Email: [grievance@yourdomain.in]
• Address: [Registered address, City, State, PIN]
• Phone: [+91 00000 00000] (Monday to Saturday, 10 am to 6 pm IST)

If we change this policy we’ll update the effective date and, for significant changes, tell you on the site, and ask for fresh consent where the law requires it.