Privacy Policy

1. What we collect

• Identity: name, email, phone, institution, class (from you or your institution)
• Parent contact: parent name and WhatsApp number (provided by the institution for report delivery)
• Assessment data: answers, scores, timing, OMR scan images, practice history, mistake patterns
• Technical: IP address, device/browser type, session logs (security and abuse prevention)

2. Why we process it (lawful purposes)

• Scoring tests, generating analytics, reports and personalised practice — performance of service
• Sending performance reports to parents via the institution — consent / legitimate educational purpose
• Platform security, fraud and abuse prevention — legitimate interest
• Opportunity matching (optional): sharing pseudonymised performance data with partner colleges and scholarship programmes — only with your explicit opt-in consent

3. Pseudonymisation — how opportunity matching works

Before any sharing, student identifiers are replaced with an irreversible cryptographic pseudonym (HMAC-SHA256 with a private server-side key). Partners see concept-mastery, accuracy trends, academic stream and district-level region — never your name, phone, email, or exact location. If a partner wishes to make you an offer, the request comes back to Aphysix, and we contact you for separate permission before revealing anything.

4. What we never do

• Sell raw personal data
• Share parent phone numbers with any third party
• Use student data for advertising networks
• Share identifiable data without specific consent

5. Storage & security

Data is stored on AWS Asia-Pacific (Mumbai, ap-south-1) within an isolated VPC. Encryption in transit (TLS 1.2+) and at rest. Access is role-restricted and logged. OMR scan images are retained only as long as needed for verification.

6. Retention

Active account data is retained while the account or institutional contract is live. On contract termination, personal data is purged within 30 days. Consent records (timestamp, policy version) are retained as required for legal audit.

7. Your rights (DPDP Act 2023)

• Access & correction: view and fix your data via your profile or by request
• Withdraw consent: opt out of opportunity matching at any time from your profile — withdrawal stops future sharing immediately
• Erasure: request deletion of your account and data
• Grievance: write to our Grievance Officer at ceo@aphysix.com — we respond within 30 days

8. Children

For users under 18, consent is obtained through the institution/parent as permitted for educational purposes under the DPDP Act. We do not use children's data for behavioural advertising or any detrimental processing.

9. Changes

Material changes will be notified in-app and require fresh consent where the purpose of processing changes.