Privacy Policy

01What we collect

We collect the least we can while still running a test series properly. There are four categories.

• Account details: your email address, and your name and phone number if you choose to give them. Your email is required because it is how we sign you in and send your results.
• Test data: the answers you select, the questions you visit, how long you spend on each one, and when you started and submitted. This is what produces your score, your rank and your chapter report.
• Payment records: the order id, the amount, the coupon used and the transaction reference returned by our payment provider. We never receive or store your card number, UPI PIN or bank credentials.
• Basic technical data: your approximate location from your IP address, your browser and device type, and error logs. We use these to keep the platform working and to detect abuse.

02How we use it

We use your data to run the service you paid for, and for nothing else.

Specifically: to sign you in, to give you access to the series you bought, to score your papers and calculate ranks across everyone who sat the same paper, to produce your performance report, to email you when a paper opens and when your result is ready, and to send receipts.

We do not sell your data. We do not share it with advertisers. We do not use your test performance to build profiles for anyone other than you.

03Why we are allowed to use it

Under the Digital Personal Data Protection Act 2023, we process your data on the basis of the consent you give when you create an account, and because it is necessary to provide the service you have purchased.

For students in the European Economic Area or the United Kingdom, the equivalent bases under the GDPR are performance of a contract (Article 6(1)(b)) and our legitimate interest in keeping the platform secure (Article 6(1)(f)).

You can withdraw consent at any time by asking us to delete your account. Doing so ends your access to any test series you have bought.

04What is stored on your own device

While you are taking a paper, the questions and your answers are stored in your browser rather than being sent over the network with every click. This is what lets a test keep working when your connection drops.

That data stays on your device and is cleared once your paper has been submitted and confirmed. It is not readable by other websites, and it is not shared with us beyond the answers you submit.

If you use a shared or public computer, sign out when you finish so that nothing is left behind for the next person.

05How long we keep it

Account details are kept while your account is open, and for 30 days after you ask us to delete it, so that an accidental deletion can be reversed.

Test attempts and results are kept for as long as your access to that series lasts, plus 12 months, so you can look back at your progress across a full preparation cycle.

Payment records are kept for eight years, because Indian tax law requires it.

Sign-in codes are deleted as soon as they are used or expire, whichever comes first.

06Who else touches your data

We use a small number of service providers to run the platform. Each of them sees only what they need to.

• Supabase, which hosts our database in the Mumbai region of India. It stores your account, orders and test results.
• Cashfree Payments, which processes payments. They receive your email address and the order amount. Your card and bank details go directly to them and never pass through our servers.
• Resend, which delivers our email. It receives your email address and the contents of the message being sent to you.
• Cloudflare, which serves the site and receives test submissions at the edge. It sees your IP address as part of normal request handling.

07How we protect it

All traffic to and from the platform is encrypted in transit. Your session is held in a cookie that JavaScript cannot read, which limits the damage a cross-site scripting bug could do.

Payment credentials never reach our servers, so there is nothing there for anyone to steal. Answer keys are kept sealed until a paper closes.

No system is perfect. If a breach ever affects your data, we will tell you and the Data Protection Board of India without undue delay, and we will tell you plainly what happened and what you should do.

08Your rights

You can ask us to do any of the following, and we will respond within 30 days.

• Show you a copy of the data we hold about you.
• Correct anything that is wrong, such as a misspelt name.
• Delete your account and everything attached to it, subject to the payment records we are legally required to keep.
• Nominate another person to exercise these rights if you are unable to, as provided under the DPDP Act.
• Complain to the Data Protection Board of India if you are unhappy with how we have handled a request.

09Cookies

We use one cookie. It is called udaan_session, it holds your signed-in session, and it lasts 30 days or until you sign out.

We do not use advertising cookies, we do not run third-party trackers, and there is no cookie banner because there is nothing here to consent to beyond the cookie that signs you in.

10Students under 18

Much of our audience is between 14 and 18. Where a student is under 18, we process their data on the basis of consent given by a parent or guardian, as the DPDP Act requires.

We do not use the data of students under 18 for advertising, tracking or behavioural profiling of any kind.

A parent or guardian can write to us at any time to see, correct or delete the data we hold about their child.

11Grievance officer

If you have a concern about how your data has been handled, write to our Grievance Officer at info.udaanvidya@gmail.com with "Data Grievance" in the subject line.

We acknowledge every grievance within 48 hours and aim to resolve it within 30 days, as required under the DPDP Act 2023.